================================================================================
  FICTIONAL CVE ENTRIES — EDUCATIONAL EXAMPLES ONLY
  These are fabricated CVE entries in NVD-style format for training purposes.
  None of these CVE IDs, products, or vendors are real.
================================================================================


CVE-2024-90001
==============

Description:
  Stack-based buffer overflow in NexusWebServer version 3.2.1 and earlier.
  The HTTP request handler in http_parse_headers() copies the User-Agent
  header value into a fixed-size 256-byte stack buffer using strcpy()
  without length validation. A remote, unauthenticated attacker can send
  a crafted HTTP request with an oversized User-Agent header to overflow
  the buffer, overwrite the saved return address, and achieve arbitrary
  code execution in the context of the web server process.

Affected Product:     NexusWebServer
Affected Versions:    <= 3.2.1
Fixed Version:        3.2.2
Vendor:               Nexus Systems Inc. (fictional)

CVSS v3.1 Score:      9.8 (Critical)
CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:        Network
Attack Complexity:    Low
Privileges Required:  None
User Interaction:     None
Scope:                Unchanged
Confidentiality:      High
Integrity:            High
Availability:         High

CWE:                  CWE-121 (Stack-based Buffer Overflow)

Exploit Available:    Yes (proof-of-concept on Exploit-DB)
Patch Available:      Yes

References:
  - https://fictional-nexus.example.com/security/advisory-2024-001
  - https://fictional-exploitdb.example.com/exploits/51234
  - https://fictional-nvd.example.com/vuln/CVE-2024-90001

Timeline:
  2024-01-15  Vulnerability discovered by researcher
  2024-01-18  Vendor notified via security@nexus-systems.example.com
  2024-02-20  Patch released in version 3.2.2
  2024-02-25  Public disclosure and CVE assignment


--------------------------------------------------------------------------------


CVE-2024-90002
==============

Description:
  SQL injection vulnerability in CloudDash Admin Panel version 5.4.0
  through 5.7.2. The /api/v2/users endpoint accepts a "sort_by" query
  parameter that is concatenated directly into a SQL ORDER BY clause
  without sanitization or parameterized queries. An authenticated attacker
  with low-privilege (viewer) access can inject arbitrary SQL statements
  to extract sensitive data from the database, including password hashes,
  API keys, and session tokens of other users including administrators.

Affected Product:     CloudDash Admin Panel
Affected Versions:    5.4.0 through 5.7.2
Fixed Version:        5.7.3
Vendor:               CloudDash Technologies (fictional)

CVSS v3.1 Score:      8.8 (High)
CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector:        Network
Attack Complexity:    Low
Privileges Required:  Low (authenticated viewer account)
User Interaction:     None
Scope:                Unchanged
Confidentiality:      High
Integrity:            High (can modify data via stacked queries)
Availability:         High (DROP/TRUNCATE possible)

CWE:                  CWE-89 (SQL Injection)

Exploit Available:    Yes (sqlmap tamper script available)
Patch Available:      Yes

References:
  - https://fictional-clouddash.example.com/security/SA-2024-003
  - https://fictional-hackerone.example.com/reports/1234567
  - https://fictional-nvd.example.com/vuln/CVE-2024-90002

Proof of Concept (sanitized):
  GET /api/v2/users?sort_by=username;SELECT+pg_sleep(5)--
  Response delayed by 5 seconds confirms time-based blind SQL injection.

Timeline:
  2024-03-10  Discovered during authorized penetration test
  2024-03-12  Vendor notified via bug bounty program
  2024-04-01  Patch released in version 5.7.3
  2024-04-15  Public disclosure


--------------------------------------------------------------------------------


CVE-2024-90003
==============

Description:
  Insecure deserialization vulnerability in DataPipeline Java SDK version
  2.0.0 through 2.3.4. The SDK's JobConfig.loadFromNetwork() method
  accepts serialized Java objects over an unauthenticated HTTP endpoint
  on port 8500 and deserializes them using ObjectInputStream without
  class filtering or allowlisting. An attacker with network access to
  the DataPipeline service port can send a crafted serialized object
  (e.g., using ysoserial gadget chains for Commons Collections) to
  achieve remote code execution as the service account running the
  DataPipeline worker process.

Affected Product:     DataPipeline Java SDK
Affected Versions:    2.0.0 through 2.3.4
Fixed Version:        2.4.0
Vendor:               DataPipeline Corp (fictional)

CVSS v3.1 Score:      9.8 (Critical)
CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:        Network
Attack Complexity:    Low
Privileges Required:  None
User Interaction:     None
Scope:                Unchanged
Confidentiality:      High
Integrity:            High
Availability:         High

CWE:                  CWE-502 (Deserialization of Untrusted Data)

Exploit Available:    Yes (ysoserial gadget chain)
Patch Available:      Yes (version 2.4.0 adds ObjectInputFilter allowlist)

References:
  - https://fictional-datapipeline.example.com/security/DSA-2024-007
  - https://fictional-github.example.com/datapipeline/sdk/security/advisories/GHSA-xxxx-yyyy
  - https://fictional-nvd.example.com/vuln/CVE-2024-90003

Technical Details:
  Vulnerable code path:
    JobConfig.loadFromNetwork()
      -> HttpClient.getObject(url)
        -> new ObjectInputStream(response.getBody())
          -> ObjectInputStream.readObject()   // <-- no class filter

  Exploitation requires:
    1. Network access to port 8500 of a DataPipeline worker node
    2. A compatible gadget chain in the application's classpath
       (Commons Collections 3.x confirmed vulnerable)
    3. Generate payload: java -jar ysoserial.jar CommonsCollections6 'cmd'

  Fix in 2.4.0:
    - Replaced ObjectInputStream with JSON-based configuration format
    - Added authentication requirement for the config endpoint
    - Legacy mode (if enabled) uses ObjectInputFilter allowlist

Timeline:
  2024-05-01  Vulnerability identified during code audit
  2024-05-03  Vendor notified via security@datapipeline.example.com
  2024-06-15  Patch released in version 2.4.0
  2024-06-20  Public disclosure and CVE assignment


================================================================================
  END OF FICTIONAL CVE ENTRIES — FOR EDUCATIONAL / CTF USE ONLY
================================================================================
