QLWD/code_shield huggingface dataset:
标题: GnuTLS libgnutls - Double-Free Certificate List Parsing Remote Denial of Service EDB-ID: 24865 CVE: 2012-1663 类型: DOS 平台: LINUX 发布日期: 2013-03-22 漏洞利用脚本: Sorry I forgot to write headers in previous mail.

# Exploit Title: [possible ways to exploit CVE-2012-1663( GNUTLS-3.0.13)]
# Google Dork: [if relevant]  (we will automatically add these to the GHDB)
# Date: [Mar 20, 2013]
# Exploit Author: [Shawn the R0ck]
# Vendor Homepage: [http://www.gnutls.org/]
# Software Link: [download link if available]
# Version: [<= 3.0.13]
# Tested on: [GNU/Linux]
# CVE : [CVE-2012-1663]

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24865.tar.bz2

I'm glad to share this to you guys. The test code was attached. You
also could find them here:
https://github.com/citypw/arsenal-4-sec-testing/tree/master/libgnutls/CVE-2012-1663

CVE-2013-1663[1] is a possible remote DOS attack issue. This issue has
been fixed[2] in >=GNUTLS-3.0.14. I hacked on it for hours and figure out
a few prerequisites could make it vulnerable:

=============================
REQUIRED:

 - prior to GNUTLS 3.0.14
 - crafted certificate

=============================
Attacking SCENES

 - a client import a crafted cert file for sending req to server( CA?)

 - a "server" import a crafted cert file for sending req to other
   server( CA?)

---> With high frequency uses above manipulations

Stand on the client side, the attacker should try to construct a
crafted certificate for triggering the below function fails:

ret = gnutls_pubkey_import_x509(pcert->pubkey, crt, 0);
  if (ret < 0)
    {
      gnutls_pubkey_deinit(pcert->pubkey);
      /* pcert->pubkey should be NULL now */
      ret = gnutls_assert_val(ret);
      goto cleanup;
    }

I made up two crafted cert files( client.pem, client2.pem) seems would
trigger the double free issue in client's side.

Warning: Don't try it on your host machine because it would cost too
much memory then makes your machine very slow.

shawn@sl13:~/gnutls_compile_uses/CVE-2012-1663$ ./ex-serv-x509
processing server set to null?
Server ready. Listening to port '5556'.

shawn@sl13:~/gnutls_compile_uses/CVE-2012-1663$ ./attack.sh
................
.................
...................

Another terminal: killall client

Test platform: Slackware 13.37 + GNUTLS-3.0.13

[1] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1663

[2] Upstream fix
http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=9c62f4feb2bdd6fbbb06eb0c60bfdea80d21bbb8


-- 
GNU powered it...
GPL protect it...
God blessing it...

regards
Shawn URL: https://www.exploit-db.com/exploits/24865
标题: PHP 3/4/5 - Multiple Local/Remote Vulnerabilities (2) EDB-ID: 24855 CVE: 2004-1018 类型: DOS 平台: PHP 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11964/info
 
PHP4 and PHP5 are reported prone to multiple local and remote vulnerabilities that may lead to code execution within the context of the vulnerable process. The following specific issues are reported:
 
A heap-based buffer overflow is reported to affect the PHP 'pack()' function call. An attacker that has the ability to make the PHP interpreter run a malicious script may exploit this condition to execute arbitrary instructions in the context of the vulnerable process.
 
A heap-based memory disclosure vulnerability is reported to affect the PHP 'unpack()' function call. An attacker that has the ability to make the PHP interpreter run a malicious script may exploit this condition to reveal portions of the process heap.
 
PHP safe_mode_exec_dir is reported prone to an access control bypass vulnerability. A local attacker that can manipulate the directory name from which the PHP script is called, may bypass 'safe_mode_exec_dir' restrictions by placing shell metacharacters and restricted commands into the directory name of the current directory.
 
PHP safe_mode is reported prone to an access control bypass vulnerability. An attacker that has the ability to make the PHP interpreter run a malicious script may exploit this condition to execute commands that are otherwise restricted by PHP safe_mode.
 
PHP is reported prone to a 'realpath()' path truncation vulnerability. The vulnerability exists due to a lack of sanitization as to whether a path has been silently truncated by the libc realpath() function or not. This may lead to remote file include vulnerabilities in some cases.
 
The PHP function 'unserialize()' is reported prone to a memory corruption vulnerability. This corruption may be leveraged by a remote attacker that has the ability to make the PHP interpreter run a malicious script to execute arbitrary code in the context of the vulnerable process.
 
The PHP function 'unserialize()' is also reported prone to an information disclosure vulnerability. This issue may be leveraged by a remote attacker to disclose the contents of heap memory. This may allow them to gain access to potentially sensitive information, such as database credentials.
 
Finally, the PHP function 'unserialize()', is reported prone to an additional vulnerability. It is reported that previous versions of this function allow a malicious programmer to set references to entries of a variable hash that have already been freed. This can lead to remote memory corruption.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24855.zip URL: https://www.exploit-db.com/exploits/24855
标题: phpGroupWare 0.9.x - 'viewticket_details.php?ticket_id' SQL Injection EDB-ID: 24846 CVE: 2004-1383 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11952/info
 
Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of the application to properly sanitize user-supplied input.
 
The SQL injection issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
 
The cross-site scripting issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
 
These issues were identified in PHPGroupWare 0.9.16.003, however, it is possible that other versions are affected as well.


http://www.example.com/phpgroupware/tts/viewticket_details.php?ticket_id=355[SQL_QUERY] URL: https://www.exploit-db.com/exploits/24846
标题: ChBg 1.5 - Scenario File Overflow EDB-ID: 24848 CVE: 2004-1264 类型: REMOTE 平台: LINUX 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11957/info

ChBg is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain superuser privileges on a vulnerable computer.

An attacker can exploit this issue by crafting a malicious scenario file. A scenario is a file containing a list of pictures to display.

If a user obtains this file and processes it through ChBg, the attacker-supplied instructions may be executed on the vulnerable computer.

ChBg 1.5 is reported prone to this vulnerability. It is likely that other versions are affected as well.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24848.zip URL: https://www.exploit-db.com/exploits/24848
标题: phpGroupWare 0.9.x - 'viewticket_details.php?ticket_id' Cross-Site Scripting EDB-ID: 24845 CVE: 2004-1384 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11952/info
 
Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of the application to properly sanitize user-supplied input.
 
The SQL injection issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
 
The cross-site scripting issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
 
These issues were identified in PHPGroupWare 0.9.16.003, however, it is possible that other versions are affected as well.

http://www.example.com/phpgroupware/tts/viewticket_details.php?ticket_id=338%22%3E%3Cif
rame%3E URL: https://www.exploit-db.com/exploits/24845
标题: MPG123 0.59 - Find Next File Remote Client-Side Buffer Overflow EDB-ID: 24852 CVE: 2004-1284 类型: REMOTE 平台: LINUX 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11958/info

A remote client-side buffer overflow vulnerability affects mpg123. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24852.list URL: https://www.exploit-db.com/exploits/24852
标题: phpGroupWare 0.9.x - 'index.php' Multiple SQL Injections EDB-ID: 24847 CVE: 2004-1385 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11952/info
 
Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of the application to properly sanitize user-supplied input.
 
The SQL injection issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
 
The cross-site scripting issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
 
These issues were identified in PHPGroupWare 0.9.16.003, however, it is possible that other versions are affected as well.


http://www.example.com/phpgroupware/index.php?menuaction=todo.ui.show_list&order=[SQL_Q
UERY]&sort=ASC&filter=&qfield=&start=&query=
http://www.example.com/phpgroupware/index.php?menuaction=projects.uiprojects.list_proje
cts&order=[SQL_QUERY]&sort=ASC&filter=&qfield=&start=&query=&pro_main=&actio
n=mains
http://www.example.com/phpgroupware/index.php?menuaction=projects.uiprojects.edit_proje
ct&pro_main=31&action=subs&project_id=32[SQL_QUERY]
http://www.example.com/phpgroupware/index.php?menuaction=projects.uiprojects.edit_proje
ct&pro_main=31[SQL_QUERY]&action=subs&project_id=32
http://www.example.com/phpgroupware/index.php?menuaction=projects.uiprojects.view_proje
ct&pro_main=31&action=subs&project_id=32[SQL_QUERY]&domain=default
http://www.example.com/phpgroupware/index.php?menuaction=projects.uiprojects.view_proje
ct&pro_main=31[SQL_QUERY]&action=subs&project_id=32&domain=default&494fbb
http://www.example.com/phpgroupware/index.php?menuaction=projects.uiprojecthours.view_h
ours&project_id=32&pro_parent=&action=subs&hours_id=26[SQL_QUERY]&domain=def
ault URL: https://www.exploit-db.com/exploits/24847
标题: ASP-Rider - SQL Injection EDB-ID: 24840 CVE: 2004-1401 类型: WEBAPPS 平台: ASP 发布日期: 2004-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/11933/info

A remote SQL injection vulnerability reportedly affects ASP-Rider Web blog. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in SQL queries.

An attacker may exploit this issue to manipulate SQL queries to the underlying database. This may facilitate theft sensitive information, potentially including authentication credentials, and data corruption.

http://www.example.com/weblog/blogadmin/verify.asp?username='union select 1,1,1,1,1,1,1,1 from tbl_users where ''='&password=1 URL: https://www.exploit-db.com/exploits/24840
标题: Active Server Corner ASP Calendar 1.0 - Administrative Access EDB-ID: 24838 CVE: 2004-1400 类型: WEBAPPS 平台: ASP 发布日期: 2004-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/11931/info

ASP Calendar is reported prone to an unauthorized administrative access vulnerability. An unauthorized remote attacker can access an administrative script and potentially gain administrative access to the application.

It is believed that this issue affects ASP Calendar Version 1. 

http://www.example.com/***/admin/main.asp
*** : directory of asp calendar URL: https://www.exploit-db.com/exploits/24838
标题: phpGroupWare 0.9.x - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24844 CVE: 2004-1384 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11952/info

Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of the application to properly sanitize user-supplied input. 

The SQL injection issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation. 

The cross-site scripting issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks. 

These issues were identified in PHPGroupWare 0.9.16.003, however, it is possible that other versions are affected as well.

http://www.example.com/phpgroupware/wiki/index.php?kp3=99884d8a63791f406585913d74476b11
%22%3E%3Ciframe%3E
http://www.example.com/phpgroupware/index.php?menuaction=forum.uiforum.post&type=new%22
%3E%3Ciframe%3E
http://www.example.com/phpgroupware/index.php?menuaction=forum.uiforum.read&msg=202%22%
3E%3Ciframe%3E
http://www.example.com/phpgroupware/index.php?menuaction=forum.uiforum.read&forum_id=3%
22%3E%3Ciframe%3E&msg=202
http://www.example.com/phpgroupware/index.php?menuaction=forum.uiforum.read&msg=42&pos=
10%22%3E%3Ciframe%3E
http://www.example.com/phpgroupware/index.php?menuaction=preferences.uicategories.index
&cats_app=%22%3E%3Ciframe%3E
http://www.example.com/phpgroupware/index.php?menuaction=preferences.uicategories.edit&
cats_app=notes&extra=&global_cats=True&cats_level=True&cat_parent=188&cat_id
=188%22%3E%3Ciframe%3E
http://www.example.com/phpgroupware/index.php?menuaction=email.uimessage.message&msgbal
l[msgnum]=1%22%3E%3Ciframe%3E&msgball[folder]=INBOX.hello&msgball[acctnum]=0
&sort=1&order=1&start=0
http://www.example.com/phpgroupware/index.php?menuaction=email.uicompose.compose&fldbal
l[folder]=INBOX.hello&fldball[acctnum]=0&to=%22%3E%3Ciframe%3E&personal=&sor
t=1&order=1&start=0 URL: https://www.exploit-db.com/exploits/24844
标题: PHPGedView 2.5/2.6 - 'calendar.php' Cross-Site Scripting EDB-ID: 24834 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11907/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/calendar.php?action=today&day=1&month=jan&year="><iframe>
http://www.example.com/phpgedview/calendar.php?action=today&day=1&month=<iframe>
http://www.example.com/phpgedview/calendar.php?action=today&day=<iframe> URL: https://www.exploit-db.com/exploits/24834
标题: IWebNegar - Multiple SQL Injections EDB-ID: 24842 CVE: 2004-1402 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11946/info

iWebNegar is reported prone to multiple SQL injection vulnerabilities, these issues exist due to a lack of sufficient boundary checks performed on user-supplied URI parameter data.

These issues could theoretically be exploited to compromise the software by performing unauthorized actions on the database, such as modifying or viewing data. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database. This may depend on the nature of the query being manipulated as well as the capabilities of the database implementation.

http://www.example.com/weblog/index.php?string=[sql injection code] URL: https://www.exploit-db.com/exploits/24842
标题: PHPGedView 2.5/2.6 - 'login.php?Username' Cross-Site Scripting EDB-ID: 24830 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11904/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/login.php?action=login&username="><iframe> URL: https://www.exploit-db.com/exploits/24830
标题: PHPGedView 2.5/2.6 - 'Timeline.php' SQL Injection EDB-ID: 24837 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11925/info

It is reported that PhpGedView is susceptible to a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to including it in an SQL query.

This issue allows remote attackers to manipulate query logic. The issue could theoretically be exploited to compromise the software by performing unauthorized actions on the database, such as modifying or viewing data. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database. This may depend on the nature of the query being manipulated as well as the capabilities of the database implementation.

This issue has been reported to effect PhpGedView 2.65beta5 and earlier.

http://www.example.com/phpgedview/timeline.php?pids=[Evil_Query] URL: https://www.exploit-db.com/exploits/24837
标题: PHPGedView 2.5/2.6 - 'login.php' Newlanguage Cross-Site Scripting EDB-ID: 24831 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11905/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.
 
This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/login.php?&changelanguage=yes&NEWLANGUAGE=<iframe> URL: https://www.exploit-db.com/exploits/24831
标题: PHPGedView 2.5/2.6 - 'Placelist.php' SQL Injection EDB-ID: 24835 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11910/info

It is reported that PhpGedView is susceptible to a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to including it in an SQL query.

This issue allows remote attackers to manipulate query logic, leading to unauthorized access and the disclosure of potentially sensitive information. The issue also allows the possible corruption of database data leading to a loss of integrity. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database.

This issue has been reported to effect PhpGedView 2.65beta5 and earlier.

http://www.example.com/phpgedview/placelist.php?level=1[Evil_Query]
http://www.example.com/phpgedview/placelist.php?level=1&parent[0]=[Evil_Query]
http://www.example.com/phpgedview/placelist.php?level=2&parent[0]=&parent[1]=[Evil_Query] URL: https://www.exploit-db.com/exploits/24835
标题: PHPGedView 2.5/2.6 - 'login.php?URL' Cross-Site Scripting EDB-ID: 24829 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11903/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/login.php?url=/index.php?GEDCOM="><iframe> URL: https://www.exploit-db.com/exploits/24829
标题: PHPGedView 2.5/2.6 - 'Relationship.php' Cross-Site Scripting EDB-ID: 24832 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11906/info
 
It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/relationship.php?path_to_find="><iframe>
http://www.example.com/phpgedview/relationship.php?path_to_find=0&pid1="><iframe>
http://www.example.com/phpgedview/relationship.php?path_to_find=0&pid1=&pid2="><iframe> URL: https://www.exploit-db.com/exploits/24832